Questions tagged [universal-composability]
The framework of universal composability (UC) is a general-purpose model for the analysis of cryptographic protocols.
46
questions
0
votes
0
answers
10
views
Input format of resource bounding computation in uc composabilty
I am currently confused about the "length of message" vs "binary representation" format of input.
Below if the screenshot:
What does the "length of message" mean? Why ...
- 99
0
votes
0
answers
10
views
UC model, ideal functionalities -- interactions and optional inputs
I have two question re ideal functionalities in the UC model.
First, is whether the functionality can ask a party for an input (the party doesn't need to be corrupted). Assume a functionality $F$ is ...
- 101
1
vote
1
answer
170
views
Are there any ways to tell if a cryptographic protocol is UC-secure before formally proven its UC-security?
I do not quite understand the UC framework. Given a protocol to be proven, now I just know firstly we should write down the ideal functionality, and then the concrete protocol, then proving the ...
1
vote
0
answers
58
views
Formal Verification for Multiparty Computation and Homomorphic Encryption?
I've recently found some work on the use of Formal Verification Software, like ProVerif for enclaves. I wonder is if its feasible to have something similar for MPC and Homomorphic Encryption and ...
- 812
1
vote
0
answers
33
views
Why a simulator can obtain a corrupted party's input to some subrountine ideal functionality $F$ "for free" in $F$-hybrid model?
In "How To Simulate It" (page 45, line 10), Lindell noted that, in the $f_{\textsf{zk}}$-hybrid model (where $f_{\textsf{zk}}$ denotes the ideal zero-knowledge functionality) in the stand-...
- 359
3
votes
0
answers
39
views
Security proof regarding a zero-knowledge counterexample that is secure in the stand-alone model but insecure in the UC model
Background
The following zero-knowledge (ZK) counterexample is described in Canetti's work [Security and Composition of Cryptographic Protocols: A Tutorial, page 26] to show that there exists some ...
- 359
1
vote
1
answer
280
views
MPC Definitions: UC-Security vs. Real-Ideal Simulation?
I consider the "standard" definition of maliciously-secure 2PC to be the simulation-based, ideal–real-world indistinguishability definition of e.g. Lindell's How to Simulate It [Lin17, ...
- 3,057
2
votes
1
answer
49
views
Specialized simulators in Universal composability
The UC framework [Can00 (version of 2020-02-11)] defines security (defn 9) as for all adversaries there exists a simulator such that for all environments the environment output is indistinguishable in ...
- 26.9k
1
vote
0
answers
40
views
Session IDs in (simple) universal composability
In the simple UC framework paper, there is a brief discussion on session identifiers (sids) on page 13. It states
The main protocol is given a session identifier sid
but it is not entirely clear to ...
- 451
5
votes
0
answers
191
views
How to write proofs for universal composable security？
Recently, I learn Ran Canetti's famous paper, "Universally Composable Security: A New Paradigm for Cryptographic Protocols". But I find it very difficult to grasp. When I read the paper that ...
- 43.4k
2
votes
0
answers
30
views
Failure of parallel composition [duplicate]
Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
- 35.3k
3
votes
2
answers
138
views
Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?
My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the ...
- 223
3
votes
1
answer
79
views
Is the following PAKE protocol UC secure?
Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
- 10.6k
7
votes
1
answer
994
views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
- 1
18
votes
2
answers
3k
views
Simulation-based proofs and universal composability proofs
I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says
The stand-alone ...
- 936
1
vote
0
answers
73
views
Universal composability: Can an ideal functionality call other ideal functionalities?
I'm new to universal composability.
I'm trying to define a protocol, $\pi$, in UC.
The protocol involves 3 parties: A, B, and a smart contract $C$. Parties A and B interact with each other and with $C$...
- 422
0
votes
2
answers
315
views
What is the difference between a cryptographic primitive and a functionality?
In the context of papers using the UC framework, I have seen the same cryptographic tools refereed as cryptographic primitives and functionalities. Are the two terms interchangeable?
An example is ...
- 85.2k
1
vote
1
answer
137
views
What is the border between an ideal functionality and a protocol?
In the context of the UC framework, what is the border between an ideal functionality and a protocol?
It seems to me that it depends on the level of granularity required for proofs.
For example, ...
- 67
1
vote
0
answers
40
views
Abstract Cryptography: why local simulators?
In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ...
- 936
2
votes
1
answer
113
views
Extract adversary's secret input in simulation based security proofs
I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
- 453
0
votes
1
answer
100
views
Example of a problem for which Zero-Knowledge proof is not sequentially composable
There are notions that a Zero-knowledge proof with auxiliary input is necessary for sequential composition. However, the authors here give a very convoluted example of a system which is not ...
- 26.9k
2
votes
1
answer
118
views
Where was the stand-alone model for simulation-based MPC proposed first?
The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
- 26.9k
1
vote
0
answers
170
views
Why is this functionality chosen for UC-NIZK?
A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness.
And, let's say P is a party ...
- 57
3
votes
1
answer
93
views
What does "constant rate" mean in universal composable commitment scheme?
I'm wondering what does the "constant rate" mean in universal composable commitment scheme? I have known the rate of a commitment scheme is message length divided by the communication complexity of ...
- 3,057
9
votes
3
answers
2k
views
Examples of protocols that are insecure when run concurrently
I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
- 16.7k
3
votes
1
answer
133
views
Variants of universal composability in security proofs
Universal composability (UC) framework seems to be a powerful framework for proving security of protocols, which guarantees security even in the presence of concurrent composition. Though, I see there ...
- 16.7k
1
vote
1
answer
235
views
What are limitations of Universally Composable (UC) framework?
I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the ...
- 16.7k
2
votes
0
answers
46
views
Can ideal functionalities share variables
I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$.
Now $\mathcal{F}_1$ maintains a ...
- 78
1
vote
0
answers
55
views
Efficient universally composable protocols for aggregate statistics
Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value.
An ideal functionality ...
- 33
1
vote
1
answer
124
views
UC-framework: Simulating specific cases (proof in PVW)
I am struggling to understand the proof of security in the UC-framework of the OT by PVW.
The cases I don't understand are the cases where:
i) Both parties are corrupted. In this case, they say ...
- 4,018
1
vote
1
answer
143
views
Difference in the Powers of Simulator and Environment in Universal Composability
I know that in UC model, environment controls the real world adversaries but there is still a simulator wrapped around these real-world adversaries in the ideal world (which we sometimes collectively ...
- 11
1
vote
0
answers
53
views
Proofs of security for anonymity in a multi-party setting
I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
- 78
4
votes
2
answers
355
views
passive corruption ?= Byzantine corruption in the UC framework?
Notations: We follow the convention in the UC framework. We use $\mathcal{A}$ to denote the adversary, $\mathcal{P}$ to denote a party in the model.
We focus on two types of corruption in the UC ...
CommunityBot
- 1
2
votes
1
answer
381
views
Is this a UC-secure commitment scheme in the ROM?
To prove UC-security (universally composable security) of a commitment scheme, we must show that a commitment scheme is extractable and equivocal.
That is, we must construct a simulator that is able ...
- 10.6k
2
votes
0
answers
115
views
Are zkSTARKs simulation sound extractable in the random oracle model?
I've recently become interested in simulation sound extractable zero-knowledge proofs for use in UC-secure protocols. I've also become interested in the recent instantiation of PCIPs called zkSTARKs. ...
- 435
1
vote
0
answers
53
views
Are theorems 2 and 3 in the Town Crier paper (Zhang et al, 2016) proven using the UC framework?
I am reading the paper ‘Town Crier: An Authenticated Data Feed for Smart Contracts’ by Zhang et al (2016), but there is something I just cannot wrap my head around.
In Section 7 and Appendix C, it ...
- 21
5
votes
1
answer
642
views
Does simulation extractability require that the protocol have a backdoor in it?
As I understand it, one of the properties required to prove UC-security is simulation extractability. One example is the paper by Kosba et al adapting NIZKs to the UC model, but in their construction ...
- 1,293
4
votes
2
answers
299
views
Modelling broadcast functionality in Universally Composable Framework
I'm studying the UC framework by Canetti. While I understand the basic idea, there are still a lot of details that I need to work through.
One thing that's puzzling me is how to achieve concurrency ...
- 10.6k
3
votes
1
answer
192
views
Why would someone prove security in the real-ideal model instead of Universal Composibility framework?
I am somewhat confused in the reasons why one would use the real-ideal model instead of the universal composibility framework.
The UC framework seems to me, to provide a much stronger definition of ...
- 4,548
1
vote
1
answer
274
views
Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?
I have been reading Canetti, Cohen and Lindell's paper, "A Simpler Variant of Universally Composable Security for Standard Multiparty Computation", and there are some parts that I didn't understand.
...
- 10.6k
6
votes
1
answer
130
views
Is a composition of clocked entities a clocked entity in the UC model?
In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering ...
- 626
20
votes
1
answer
976
views
What are the roles of the simulator in simulation based proofs
I'm trying to better understand simulation based proofs in the UC model - but the guidelines to construct a simulator confuse me. To my understanding, the simulator is activated in two ways:
Outbound:...
- 26.9k
4
votes
1
answer
655
views
What's the principle to design the functionality under UC framework?
Though I can get the basic idea of UC Framework, namely let the environment cannot distinguish the real protocol with the real adversary and the functionality with the simulator, I am still puzzled in ...
- 12.3k
2
votes
1
answer
232
views
Protocol composition [closed]
I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
- 5,944
2
votes
1
answer
2k
views
Security of cloud computational protocols in UC Framework?
The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
- 37.7k
2
votes
0
answers
56
views
Detail about reactive simulatability framework
I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
- 17.4k