3
$\begingroup$

I am somewhat confused in the reasons why one would use the real-ideal model instead of the universal composibility framework.

The UC framework seems to me, to provide a much stronger definition of security. Is there some explanation to this?

$\endgroup$

1 Answer 1

1
$\begingroup$

Try to prove something non-trivial using the universal composability framework and you will quickly understand why few people use it.

EDIT: Snide remarks aside, it is pretty widely acknowledge that universal composability is really hard to use in papers. It's even hard to typeset - I've seen proofs with UC functionalities that don't fit on a single page! A colleague of mine has said that proving non-trivial things using UC is like writing a web server in assembly language.

Aside from the practical difficulty of writing proofs with it, there's a more fundamental difference between UC and the real-ideal paradigm: the latter has an intuitive philosophical appeal that comports with the way people think about security. The former doesn't have the same "interpretability" IMO.

$\endgroup$
3
  • $\begingroup$ A part from simplicity of writing proofs, I don't understand if UC would provide stronger security. $\endgroup$ Commented Apr 26, 2017 at 21:54
  • $\begingroup$ Hmm... I don't know enough about UC to give a rule of thumb for comparing strength of results. In some ways UC is too strong - for example, commitments are not straightforward to prove secure in UC, and most commitment schemes can't be proven secure in the basic UC model. $\endgroup$
    – pg1989
    Commented Apr 26, 2017 at 22:10
  • $\begingroup$ It does provide a stronger sense of security in that security is preserved under both sequential and parallel composition, i.e. if you can show a protocol $\Pi$ is UC secure, then you can run it in parallel without worry. The standalone model provides no such guarantees (only sequential composition see Goldreich chapter 4). However, as mentioned above, proving things in the UC model is a pain. $\endgroup$
    – Ari
    Commented Apr 2 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.