Skip to main content

Questions tagged [universal-composability]

The framework of universal composability (UC) is a general-purpose model for the analysis of cryptographic protocols.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Question about Environment Set in Universally Composable Security Proof

I have read into many papers and tutorials regarding "Universally Composable Security Proofs." I still have one confusion about the initial setup by the environment. On one hand, I got that ...
Novice User's user avatar
1 vote
1 answer
44 views

Is the Simplest OT universally composable against a semi-honest adversary?

I started learning about cryptography very recently, and I got interested in the Simplest-OT protocol of Chou and Orlandi. However (as the authors themselves noted) the protocol is not UC-secure ...
Daniel Turizo's user avatar
2 votes
1 answer
80 views

Is UC security only meaningful in malicious setting

In my understanding, the main difference in the proof between UC and standalone model is the ability to "rewind", which appears to related to malicious security only. So if we are only ...
vince.h's user avatar
  • 147
3 votes
1 answer
216 views

Resources for simple MPC proofs

Could anyone direct me to literature regarding privacy proofs in the MPC setting. For example, how can one prove the following simple problem: Suppose a setting with $n$ parties $S_1, \ldots, S_n$ ...
Kolja's user avatar
  • 143
3 votes
1 answer
177 views

Fischlin vs. Fiat-Shamir Performance

Using Fiat-Shamir, an interactive 3-round sigma protocol can be compiled into a non-interactive zero-knowledge proof in the random oracle model. A NIZK through Fiat-Shamir is not UC-Secure due to ...
Atonal's user avatar
  • 155
2 votes
0 answers
55 views

Claims about universally composable oblivious transfer, which ones are correct?

There are two papers that propose oblivious transfer protocols, both claiming to be universally composable (UC). The first protocol is more complex, and I am convinced that it is indeed UC. The second ...
user2249675's user avatar
2 votes
1 answer
186 views

Expanding stand-alone simulation-based proofs to UC proofs

This is a follow-up question to Mikero’s answer to Simulation-based proofs and universal composability proofs. Let there be some protocol $\pi$ running between two parties $A$ and $B$. Furthermore, ...
Simulator's user avatar
2 votes
0 answers
47 views

Difference between Non-Concurrent Composition and Concurrent Composition

You can get access to this document via institutional login at https://www.researchgate.net/publication/220556089_Security_and_composition_of_cryptographic_protocols_A_tutorial So in Ran Canettis ...
killertoge's user avatar
1 vote
0 answers
113 views

Intuition of the UC framework

I am trying to get into Universal Composable Security, but before diving deeper I would like to confirm my intuition of the framework. https://eprint.iacr.org/2000/067.pdf A protocol $\pi$ securely ...
killertoge's user avatar
2 votes
0 answers
131 views

A Question on the "rewinding" technique in secure computation

Consider secure two-party computation against malicious adversaries in the standalone model. I know that the "rewinding" technique can be used to extract the corrupt party's input, e.g., in $...
X. G.'s user avatar
  • 424
4 votes
0 answers
126 views

How to get started with Simulation and UC proofs?

I've been in my PhD program for a few months, and every time I try to understand the simulation and UC proof-paradigms I get so confused. I feel like what I really need is an easy set of (guided) ...
FearfulJoe's user avatar
1 vote
1 answer
232 views

Are there any ways to tell if a cryptographic protocol is UC-secure before formally proven its UC-security?

I do not quite understand the UC framework. Given a protocol to be proven, now I just know firstly we should write down the ideal functionality, and then the concrete protocol, then proving the ...
user77340's user avatar
  • 797
4 votes
0 answers
199 views

Formal Verification for Multiparty Computation and Homomorphic Encryption?

I've recently found some work on the use of Formal Verification Software, like ProVerif for enclaves. I wonder is if its feasible to have something similar for MPC and Homomorphic Encryption and ...
DaWNFoRCe's user avatar
  • 872
2 votes
0 answers
66 views

Why a simulator can obtain a corrupted party's input to some subrountine ideal functionality $F$ "for free" in $F$-hybrid model?

In "How To Simulate It" (page 45, line 10), Lindell noted that, in the $f_{\textsf{zk}}$-hybrid model (where $f_{\textsf{zk}}$ denotes the ideal zero-knowledge functionality) in the stand-...
X. G.'s user avatar
  • 424
4 votes
0 answers
66 views

Security proof regarding a zero-knowledge counterexample that is secure in the stand-alone model but insecure in the UC model

Background The following zero-knowledge (ZK) counterexample is described in Canetti's work [Security and Composition of Cryptographic Protocols: A Tutorial, page 26] to show that there exists some ...
X. G.'s user avatar
  • 424
1 vote
1 answer
871 views

MPC Definitions: UC-Security vs. Real-Ideal Simulation?

I consider the "standard" definition of maliciously-secure 2PC to be the simulation-based, ideal–real-world indistinguishability definition of e.g. Lindell's How to Simulate It [Lin17, ...
BD107's user avatar
  • 145
2 votes
1 answer
82 views

Specialized simulators in Universal composability

The UC framework [Can00 (version of 2020-02-11)] defines security (defn 9) as for all adversaries there exists a simulator such that for all environments the environment output is indistinguishable in ...
Sebastian's user avatar
  • 461
1 vote
0 answers
128 views

Session IDs in (simple) universal composability

In the simple UC framework paper, there is a brief discussion on session identifiers (sids) on page 13. It states The main protocol is given a session identifier sid but it is not entirely clear to ...
Sebastian's user avatar
  • 461
10 votes
0 answers
669 views

How to write proofs for universal composable security?

Recently, I learn Ran Canetti's famous paper, "Universally Composable Security: A New Paradigm for Cryptographic Protocols". But I find it very difficult to grasp. When I read the paper that ...
user77340's user avatar
  • 797
2 votes
0 answers
36 views

Failure of parallel composition [duplicate]

Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
D.W.'s user avatar
  • 36.5k
3 votes
1 answer
128 views

Is the following PAKE protocol UC secure?

Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
Jabari's user avatar
  • 33
3 votes
2 answers
248 views

Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?

My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the ...
qbt937's user avatar
  • 258
12 votes
1 answer
3k views

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
Expectator's user avatar
1 vote
0 answers
133 views

Universal composability: Can an ideal functionality call other ideal functionalities?

I'm new to universal composability. I'm trying to define a protocol, $\pi$, in UC. The protocol involves 3 parties: A, B, and a smart contract $C$. Parties A and B interact with each other and with $C$...
Aydin's user avatar
  • 442
1 vote
2 answers
473 views

What is the difference between a cryptographic primitive and a functionality?

In the context of papers using the UC framework, I have seen the same cryptographic tools refereed as cryptographic primitives and functionalities. Are the two terms interchangeable? An example is ...
Lorenzo's user avatar
  • 149
1 vote
1 answer
351 views

What is the border between an ideal functionality and a protocol?

In the context of the UC framework, what is the border between an ideal functionality and a protocol? It seems to me that it depends on the level of granularity required for proofs. For example, ...
Lorenzo's user avatar
  • 149
1 vote
0 answers
48 views

Abstract Cryptography: why local simulators?

In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ...
Léo Colisson's user avatar
2 votes
1 answer
186 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
WYC's user avatar
  • 41
0 votes
1 answer
144 views

Example of a problem for which Zero-Knowledge proof is not sequentially composable

There are notions that a Zero-knowledge proof with auxiliary input is necessary for sequential composition. However, the authors here give a very convoluted example of a system which is not ...
QuestionEverything's user avatar
2 votes
1 answer
204 views

Where was the stand-alone model for simulation-based MPC proposed first?

The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
Daniel's user avatar
  • 3,972
1 vote
0 answers
244 views

Why is this functionality chosen for UC-NIZK?

A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness. And, let's say P is a party ...
Severus's user avatar
  • 57
12 votes
3 answers
2k views

Examples of protocols that are insecure when run concurrently

I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
satya's user avatar
  • 1,414
1 vote
1 answer
370 views

What are limitations of Universally Composable (UC) framework?

I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the ...
Z.P.'s user avatar
  • 353
4 votes
1 answer
201 views

Variants of universal composability in security proofs

Universal composability (UC) framework seems to be a powerful framework for proving security of protocols, which guarantees security even in the presence of concurrent composition. Though, I see there ...
user avatar
2 votes
0 answers
55 views

Can ideal functionalities share variables

I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$. Now $\mathcal{F}_1$ maintains a ...
zkvroon's user avatar
  • 88
1 vote
0 answers
58 views

Efficient universally composable protocols for aggregate statistics

Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value. An ideal functionality ...
bit's user avatar
  • 33
1 vote
1 answer
172 views

UC-framework: Simulating specific cases (proof in PVW)

I am struggling to understand the proof of security in the UC-framework of the OT by PVW. The cases I don't understand are the cases where: i) Both parties are corrupted. In this case, they say ...
P.B.'s user avatar
  • 516
3 votes
1 answer
106 views

What does "constant rate" mean in universal composable commitment scheme?

I'm wondering what does the "constant rate" mean in universal composable commitment scheme? I have known the rate of a commitment scheme is message length divided by the communication complexity of ...
CryptoLover's user avatar
1 vote
0 answers
56 views

Proofs of security for anonymity in a multi-party setting

I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
zkvroon's user avatar
  • 88
4 votes
2 answers
416 views

passive corruption ?= Byzantine corruption in the UC framework?

Notations: We follow the convention in the UC framework. We use $\mathcal{A}$ to denote the adversary, $\mathcal{P}$ to denote a party in the model. We focus on two types of corruption in the UC ...
Weikeng Chen's user avatar
1 vote
1 answer
188 views

Difference in the Powers of Simulator and Environment in Universal Composability

I know that in UC model, environment controls the real world adversaries but there is still a simulator wrapped around these real-world adversaries in the ideal world (which we sometimes collectively ...
Mayank's user avatar
  • 447
2 votes
1 answer
493 views

Is this a UC-secure commitment scheme in the ROM?

To prove UC-security (universally composable security) of a commitment scheme, we must show that a commitment scheme is extractable and equivocal. That is, we must construct a simulator that is able ...
P.B.'s user avatar
  • 516
4 votes
0 answers
152 views

Are zkSTARKs simulation sound extractable in the random oracle model?

I've recently become interested in simulation sound extractable zero-knowledge proofs for use in UC-secure protocols. I've also become interested in the recent instantiation of PCIPs called zkSTARKs. ...
Ian MathWiz's user avatar
1 vote
0 answers
58 views

Are theorems 2 and 3 in the Town Crier paper (Zhang et al, 2016) proven using the UC framework?

I am reading the paper ‘Town Crier: An Authenticated Data Feed for Smart Contracts’ by Zhang et al (2016), but there is something I just cannot wrap my head around. In Section 7 and Appendix C, it ...
Saffie's user avatar
  • 131
5 votes
1 answer
944 views

Does simulation extractability require that the protocol have a backdoor in it?

As I understand it, one of the properties required to prove UC-security is simulation extractability. One example is the paper by Kosba et al adapting NIZKs to the UC model, but in their construction ...
Ian MathWiz's user avatar
4 votes
2 answers
336 views

Modelling broadcast functionality in Universally Composable Framework

I'm studying the UC framework by Canetti. While I understand the basic idea, there are still a lot of details that I need to work through. One thing that's puzzling me is how to achieve concurrency ...
lamba's user avatar
  • 1,365
3 votes
1 answer
220 views

Why would someone prove security in the real-ideal model instead of Universal Composibility framework?

I am somewhat confused in the reasons why one would use the real-ideal model instead of the universal composibility framework. The UC framework seems to me, to provide a much stronger definition of ...
graphtheory92's user avatar
1 vote
1 answer
324 views

Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?

I have been reading Canetti, Cohen and Lindell's paper, "A Simpler Variant of Universally Composable Security for Standard Multiparty Computation", and there are some parts that I didn't understand. ...
jeff's user avatar
  • 11
6 votes
1 answer
135 views

Is a composition of clocked entities a clocked entity in the UC model?

In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering ...
sun's user avatar
  • 540
18 votes
2 answers
5k views

Simulation-based proofs and universal composability proofs

I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says The stand-alone ...
Luke's user avatar
  • 307