I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the composable protocol. But I am wondering what are the main limitations of UC? I note that it is non-trivial to transform simulation-based security (or game-based security) into UC security. But does there exist compiler to transform form simulation-based security to UC security.
1
-
$\begingroup$ One limitation is that the notational extraganza of UC leaves you drunk with jargon and unable to stand on one foot or write a straight line. $\endgroup$– Squeamish OssifrageMay 20, 2019 at 15:19
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
"Simulation-based security" is a very general notion. UC security is much more specific - it refers to a simulation-based security proof in the UC framework. As such, simulation-based security encompass the UC framework, which is a particular case of it, and there is no general transformation from any primitive with a simulation-style security argument to a UC secure primitive.
One of the main limitations of the UC framework is that it's strength - arbitrary composability features - also gives rise to strong impossibility results: many important cryptographic primitives are provably impossible to realize with UC-security in the plain model, hence one must rely on trusted setup assumptions, such as the common reference string model, to build protocols in the UC framework.
Arguably, a second limitation is the relative complexity of the framework, which is not so easy to understand and master in depth - although there are now countless examples of proofs in the UC model to look at, as well as simplifications of the model such as simple UC.
answered May 20, 2019 at 9:03