Questions tagged [universal-composability]
The framework of universal composability (UC) is a general-purpose model for the analysis of cryptographic protocols.
39
questions
1
vote
0answers
17 views
Session IDs in (simple) universal composability
In the simple UC framework paper, there is a brief discussion on session identifiers (sids) on page 13. It states
The main protocol is given a session identifier sid
but it is not entirely clear to ...
3
votes
0answers
80 views
How to write proofs for universal composable security？
Recently, I learn Ran Canetti's famous paper, "Universally Composable Security: A New Paradigm for Cryptographic Protocols". But I find it very difficult to grasp. When I read the paper that ...
2
votes
0answers
23 views
Failure of parallel composition
Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
2
votes
2answers
99 views
Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?
My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the ...
3
votes
1answer
50 views
Is the following PAKE protocol UC secure?
Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
6
votes
1answer
320 views
What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?
I don't have a proper computer science education, so bear with my misunderstandings.
UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
0
votes
0answers
26 views
UC-secure commitment in the ROM
Looking at the question Is this a UC-secure commitment scheme in the ROM?, I was wondering, is the commitment scheme proposed in the answer (which uses $H(M||r)$ as commit) secure in the UC-model, ...
18
votes
2answers
3k views
Simulation-based proofs and universal composability proofs
I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says
The stand-alone ...
1
vote
0answers
50 views
Universal composability: Can an ideal functionality call other ideal functionalities?
I'm new to universal composability.
I'm trying to define a protocol, $\pi$, in UC.
The protocol involves 3 parties: A, B, and a smart contract $C$. Parties A and B interact with each other and with $C$...
0
votes
2answers
158 views
What is the difference between a cryptographic primitive and a functionality?
In the context of papers using the UC framework, I have seen the same cryptographic tools refereed as cryptographic primitives and functionalities. Are the two terms interchangeable?
An example is ...
1
vote
1answer
72 views
What is the border between an ideal functionality and a protocol?
In the context of the UC framework, what is the border between an ideal functionality and a protocol?
It seems to me that it depends on the level of granularity required for proofs.
For example, ...
1
vote
0answers
37 views
Abstract Cryptography: why local simulators?
In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ...
2
votes
1answer
83 views
Extract adversary's secret input in simulation based security proofs
I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
0
votes
1answer
87 views
Example of a problem for which Zero-Knowledge proof is not sequentially composable
There are notions that a Zero-knowledge proof with auxiliary input is necessary for sequential composition. However, the authors here give a very convoluted example of a system which is not ...
2
votes
1answer
92 views
Where was the stand-alone model for simulation-based MPC proposed first?
The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
1
vote
0answers
140 views
Why is this functionality chosen for UC-NIZK?
A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness.
And, let's say P is a party ...
3
votes
1answer
91 views
What does “constant rate” mean in universal composable commitment scheme?
I'm wondering what does the "constant rate" mean in universal composable commitment scheme? I have known the rate of a commitment scheme is message length divided by the communication complexity of ...
9
votes
3answers
2k views
Examples of protocols that are insecure when run concurrently
I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
2
votes
1answer
114 views
Variants of universal composability in security proofs
Universal composability (UC) framework seems to be a powerful framework for proving security of protocols, which guarantees security even in the presence of concurrent composition. Though, I see there ...
1
vote
1answer
156 views
What are limitations of Universally Composable (UC) framework?
I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the ...
2
votes
0answers
45 views
Can ideal functionalities share variables
I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$.
Now $\mathcal{F}_1$ maintains a ...
1
vote
0answers
48 views
Efficient universally composable protocols for aggregate statistics
Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value.
An ideal functionality ...
1
vote
1answer
106 views
UC-framework: Simulating specific cases (proof in PVW)
I am struggling to understand the proof of security in the UC-framework of the OT by PVW.
The cases I don't understand are the cases where:
i) Both parties are corrupted. In this case, they say ...
1
vote
1answer
122 views
Difference in the Powers of Simulator and Environment in Universal Composability
I know that in UC model, environment controls the real world adversaries but there is still a simulator wrapped around these real-world adversaries in the ideal world (which we sometimes collectively ...
1
vote
0answers
47 views
Proofs of security for anonymity in a multi-party setting
I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
4
votes
2answers
320 views
passive corruption ?= Byzantine corruption in the UC framework?
Notations: We follow the convention in the UC framework. We use $\mathcal{A}$ to denote the adversary, $\mathcal{P}$ to denote a party in the model.
We focus on two types of corruption in the UC ...
2
votes
1answer
304 views
Is this a UC-secure commitment scheme in the ROM?
To prove UC-security (universally composable security) of a commitment scheme, we must show that a commitment scheme is extractable and equivocal.
That is, we must construct a simulator that is able ...
2
votes
0answers
105 views
Are zkSTARKs simulation sound extractable in the random oracle model?
I've recently become interested in simulation sound extractable zero-knowledge proofs for use in UC-secure protocols. I've also become interested in the recent instantiation of PCIPs called zkSTARKs. ...
1
vote
0answers
46 views
Are theorems 2 and 3 in the Town Crier paper (Zhang et al, 2016) proven using the UC framework?
I am reading the paper ‘Town Crier: An Authenticated Data Feed for Smart Contracts’ by Zhang et al (2016), but there is something I just cannot wrap my head around.
In Section 7 and Appendix C, it ...
5
votes
1answer
533 views
Does simulation extractability require that the protocol have a backdoor in it?
As I understand it, one of the properties required to prove UC-security is simulation extractability. One example is the paper by Kosba et al adapting NIZKs to the UC model, but in their construction ...
4
votes
2answers
267 views
Modelling broadcast functionality in Universally Composable Framework
I'm studying the UC framework by Canetti. While I understand the basic idea, there are still a lot of details that I need to work through.
One thing that's puzzling me is how to achieve concurrency ...
3
votes
1answer
163 views
Why would someone prove security in the real-ideal model instead of Universal Composibility framework?
I am somewhat confused in the reasons why one would use the real-ideal model instead of the universal composibility framework.
The UC framework seems to me, to provide a much stronger definition of ...
1
vote
1answer
247 views
Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?
I have been reading Canetti, Cohen and Lindell's paper, "A Simpler Variant of Universally Composable Security for Standard Multiparty Computation", and there are some parts that I didn't understand.
...
6
votes
1answer
127 views
Is a composition of clocked entities a clocked entity in the UC model?
In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering ...
20
votes
1answer
816 views
What are the roles of the simulator in simulation based proofs
I'm trying to better understand simulation based proofs in the UC model - but the guidelines to construct a simulator confuse me. To my understanding, the simulator is activated in two ways:
Outbound:...
3
votes
1answer
606 views
What's the principle to design the functionality under UC framework?
Though I can get the basic idea of UC Framework, namely let the environment cannot distinguish the real protocol with the real adversary and the functionality with the simulator, I am still puzzled in ...
2
votes
1answer
228 views
Protocol composition [closed]
I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
2
votes
1answer
2k views
Security of cloud computational protocols in UC Framework?
The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
2
votes
0answers
55 views
Detail about reactive simulatability framework
I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
