# passive corruption ?= Byzantine corruption in the UC framework?

Notations: We follow the convention in the UC framework. We use $\mathcal{A}$ to denote the adversary, $\mathcal{P}$ to denote a party in the model.

We focus on two types of corruption in the UC framework, which we rephrase now.

• Byzantine corruption: $\mathcal{A}$ takes the full control of $\mathcal{P}$.
• Passive corruption: $\mathcal{A}$ sees the internal state of $\mathcal{P}$.

My question is:

Is passive corruption actually equivalent to Byzantine corruption?

Now I explain the reason behind my question.

In the UC framework, $\mathcal{A}$ controls the network, if $\mathcal{A}$ only has the ability to see the internal state of $\mathcal{P}$, $\mathcal{A}$ can do the following to approximate "controlling $\mathcal{P}$" in the real-world model:

1. $\mathcal{A}$ isolates $\mathcal{P}$ from the network.
2. $\mathcal{A}$ copies the internal state of $\mathcal{P}$ and launches a virtual machine $\widetilde{\mathcal{P}}$.
3. $\widetilde{\mathcal{P}}$ has the same internal state as $\mathcal{P}$ at the time of corruption. But, $\mathcal{A}$ takes the full control of $\widetilde{\mathcal{P}}$.
4. $\widetilde{\mathcal{P}}$ pretends to be $\mathcal{P}$ in the rest of the execution.

Some readers may suspect whether 4 is possible in the UC framework with authenticated channels. Now I explain my concerns.

In the UC framework, it is non-trivial to know who actually sends the message. We need to rely on "authenticated channels". We use $\mathcal{F}_\mathsf{auth}$ to denote the ideal functionality for such a communication channel.

Via $\mathcal{F}_\mathsf{auth}$, parties in the protocol can make sure who sends the message. If $\mathcal{P}$ is Byzantinely corrupted by $\mathcal{A}$, $\mathcal{A}$ can send messages in the name of $\mathcal{P}$.

But, what if $\mathcal{A}$ passively corrupt $\mathcal{P}$?

• The definition of $\mathcal{F}_\mathsf{auth}$ allows $\mathcal{A}$ to change the messages sending out from $\mathcal{P}$ if $\mathcal{A}$ corrupts $\mathcal{P}$. It is not clear whether it differs in the case of passive corruption.
• Existing realizations of $\mathcal{F}_\mathsf{auth}$ rely on some secrets in $\mathcal{P}$, such as the signing key. If $\mathcal{A}$ just sees the internal state of $\mathcal{P}$, which includes such secrets, then $\mathcal{A}$ can pretend to be $\mathcal{P}$ in these realizations.

Or in other words, passive corruption does not reduce $\mathcal{A}$'s ability to impersonate $\mathcal{P}$.

Back to my question:

Is passive corruption actually equivalent to Byzantine corruption?

And a followed-up question.

How should I model something similar to passive corruption?

Let me add an example to assist explanation.

Consider that I can passively corrupt the webserver of CVS. I can steal their TLS/SSL certificate private keys in the CVS webserver's internal state.

Then, I make a man-in-the-middle attack to a specific client, and if I also control the network, I can mimic CVS website to this client and display wrong pharmacy records.

Reference:

1. Canetti's paper on the UC framework. "Universally Composable Security: A New Paradigm for Cryptographic Protocols". https://eprint.iacr.org/2000/067.pdf
2. Canetti's paper on realizing $\mathcal{F}_\mathsf{auth}$ using $\mathcal{F}_\mathsf{sig}$. "Universally Composable Signature, Certification, and Authentication". https://eprint.iacr.org/2003/239.pdf
3. Canetti-Shahaf-Vald's paper on realizing $\mathcal{F}_\mathsf{auth}$ with a global PKI (a bulletin-board certificate authority) also using $\mathcal{F}_\mathsf{sig}$. "Universally Composable Authentication and Key-exchange with Global PKI". https://eprint.iacr.org/2014/432.pdf
4. Backes-Pfitzmann-Waidner's paper on realizing $\mathcal{F}_\mathsf{sig}$ with a public-key signing scheme. "A Universally Composable Cryptographic Library". https://eprint.iacr.org/2003/015.pdf
• "Another standard corruption model only allows the adversary to observe the internal state of the corrupted party." – redplum Jul 7 '18 at 22:31
• @redplum Thanks for the information. I think my concern is whether the internal state contains the secrets that are enough for the adversary to pretend to be the corrupted party using the existing power in the model. – Weikeng Chen Jul 7 '18 at 23:38
• @redplum let me add some information. So in 2000/267, passive corruption is captured by having the corrupted party send out the internal state upon receiving the (corrupted) signal. My claim is that, even if the adversary can only observe the internal state (with only such an ability), it is enough to escalate this ability with the adversary's ability to control the network. – Weikeng Chen Jul 7 '18 at 23:44
• @redplum or in other words, I think the way 2000/267 captures the passive corruptions by "Passive corruptions can be captured by changing the reaction of the shell of a party to a (corrupt) message from the adversary, as follow..." does not exclude the case that the adversary can keep the corrupted party running without modification, but the adversary isolates it from the rest of the network. – Weikeng Chen Jul 8 '18 at 0:02
• If $\mathcal{A}$ isolates $\mathcal{P}$ from the network, isn't that an active attack at that point? – mikeazo Jul 9 '18 at 19:37

Is passive corruption actually equivalent to Byzantine corruption?

The answer is clearly no, otherwise cryptographers wouldn't spend so much time on developing protocols for active security.

Let me add an example to assist explanation.

Consider that I can passively corrupt the webserver of CVS. I can steal their TLS/SSL certificate private keys in the CVS webserver's internal state.

Then, I make a man-in-the-middle attack to a specific client, and if I also control the network, I can mimic CVS website to this client and display wrong pharmacy records.

The man-in-the-middle attack you specify is an active attack. Yes, in real-life, an attacker that has the internal state of the webserver can get their TLS/SSL private key and then could cause all sort of trouble. But, the whole point of the passive model is that we assume that the attacker does not do this. The only thing they do is record plaintext messages/internal state of the parties they have corrupted.

Why do we make this assumption? To make our lives easier, of course. We have to start somewhere, so we start with a fairly simple adversary model. It does not assume a completely trusted third party, yet we can still develop secure protocols. That is a win. Whether that win translates into the real world is another question. There have been papers (I'm looking, I'll update when found) that use passively secure protocols and argue that this is okay since, because of the application, there are other mechanisms in place that will force parties to be honest.

So, if you are worried about active attackers you should use protocols that are secure against active attackers. Passively secure protocols will break royally if the adversary is actually active.

• I think one point of my confusion is: Is "passive corruption" in the UC framework the adversary's self-discipline or the adversary's inability? From the original UC paper, it models the corruption as "an intentional backdoor" of the party. The party receives a (corrupted) signal and then starts to leak information. I think it means the latter. – Weikeng Chen Jul 9 '18 at 20:09
• For the examples, I recommend "SecureML: A System for Scalable Privacy-Preserving Machine Learning" (S&P). – Weikeng Chen Jul 9 '18 at 20:11
• And, for The answer is clearly no, otherwise, cryptographers wouldn't spend so much time on developing protocols for active security., I think actually mean slightly different. I mean "passive corruption" is a concept that is not self-consistent, so we need to move forward to "Byzantine corruption". – Weikeng Chen Jul 9 '18 at 20:25
• There may be some instances where passive security is sufficient, but for the most part, I agree. – mikeazo Jul 9 '18 at 22:36
• Just a small addition to this discussion: There are generic transformations that take a protocol with a weaker security guarantees (e.g. passive security) and transform it efficiently into a protocol with stronger security guarantees (e.g. covert and active security). As such developing efficient passively secure protocols can be done with the intention of directly getting active security. – Cryptonaut Jul 14 '18 at 8:39

It seems the solution is to separate sessions and processes. The signing oracle/module is on the OS level. When a session is corrupted, the signing key used for authentication is still kept secret.

Further reading can be found in the following paper by Canetti, Shahaf, and Vald. https://eprint.iacr.org/2014/432.pdf