Questions tagged [universal-composability]

The framework of universal composability (UC) is a general-purpose model for the analysis of cryptographic protocols.

Filter by
Sorted by
Tagged with
20
votes
1answer
844 views

What are the roles of the simulator in simulation based proofs

I'm trying to better understand simulation based proofs in the UC model - but the guidelines to construct a simulator confuse me. To my understanding, the simulator is activated in two ways: Outbound:...
18
votes
2answers
3k views

Simulation-based proofs and universal composability proofs

I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says The stand-alone ...
9
votes
3answers
2k views

Examples of protocols that are insecure when run concurrently

I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
6
votes
1answer
446 views

What is universal composability guaranteeing, specifically? Where does it apply, and where does it not?

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
6
votes
1answer
128 views

Is a composition of clocked entities a clocked entity in the UC model?

In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering ...
5
votes
1answer
558 views

Does simulation extractability require that the protocol have a backdoor in it?

As I understand it, one of the properties required to prove UC-security is simulation extractability. One example is the paper by Kosba et al adapting NIZKs to the UC model, but in their construction ...
4
votes
2answers
280 views

Modelling broadcast functionality in Universally Composable Framework

I'm studying the UC framework by Canetti. While I understand the basic idea, there are still a lot of details that I need to work through. One thing that's puzzling me is how to achieve concurrency ...
4
votes
2answers
327 views

passive corruption ?= Byzantine corruption in the UC framework?

Notations: We follow the convention in the UC framework. We use $\mathcal{A}$ to denote the adversary, $\mathcal{P}$ to denote a party in the model. We focus on two types of corruption in the UC ...
3
votes
1answer
621 views

What's the principle to design the functionality under UC framework?

Though I can get the basic idea of UC Framework, namely let the environment cannot distinguish the real protocol with the real adversary and the functionality with the simulator, I am still puzzled in ...
3
votes
1answer
92 views

What does "constant rate" mean in universal composable commitment scheme?

I'm wondering what does the "constant rate" mean in universal composable commitment scheme? I have known the rate of a commitment scheme is message length divided by the communication complexity of ...
3
votes
1answer
58 views

Is the following PAKE protocol UC secure?

Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
3
votes
1answer
168 views

Why would someone prove security in the real-ideal model instead of Universal Composibility framework?

I am somewhat confused in the reasons why one would use the real-ideal model instead of the universal composibility framework. The UC framework seems to me, to provide a much stronger definition of ...
3
votes
0answers
104 views

How to write proofs for universal composable security?

Recently, I learn Ran Canetti's famous paper, "Universally Composable Security: A New Paradigm for Cryptographic Protocols". But I find it very difficult to grasp. When I read the paper that ...
2
votes
1answer
2k views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
2
votes
1answer
103 views

Where was the stand-alone model for simulation-based MPC proposed first?

The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
2
votes
1answer
333 views

Is this a UC-secure commitment scheme in the ROM?

To prove UC-security (universally composable security) of a commitment scheme, we must show that a commitment scheme is extractable and equivocal. That is, we must construct a simulator that is able ...
2
votes
2answers
110 views

Why does the PAKE ideal functionallity allow the keys to be the same when the passwords differ?

My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the ...
2
votes
1answer
93 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
2
votes
1answer
120 views

Variants of universal composability in security proofs

Universal composability (UC) framework seems to be a powerful framework for proving security of protocols, which guarantees security even in the presence of concurrent composition. Though, I see there ...
2
votes
1answer
229 views

Protocol composition [closed]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
2
votes
0answers
28 views

Security proof regarding a zero-knowledge counterexample that is secure in the stand-alone model but insecure in the UC model

Background The following zero-knowledge (ZK) counterexample is described in Canetti's work [Security and Composition of Cryptographic Protocols: A Tutorial, page 26] to show that there exists some ...
2
votes
0answers
25 views

Failure of parallel composition

Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
2
votes
0answers
45 views

Can ideal functionalities share variables

I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$. Now $\mathcal{F}_1$ maintains a ...
2
votes
0answers
107 views

Are zkSTARKs simulation sound extractable in the random oracle model?

I've recently become interested in simulation sound extractable zero-knowledge proofs for use in UC-secure protocols. I've also become interested in the recent instantiation of PCIPs called zkSTARKs. ...
2
votes
0answers
55 views

Detail about reactive simulatability framework

I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
1
vote
1answer
104 views

MPC Definitions: UC-Security vs. Real-Ideal Simulation?

I consider the "standard" definition of maliciously-secure 2PC to be the simulation-based, ideal–real-world indistinguishability definition of e.g. Lindell's How to Simulate It [Lin17, ...
1
vote
1answer
31 views

Specialized simulators in Universal composability

The UC framework [Can00 (version of 2020-02-11)] defines security (defn 9) as for all adversaries there exists a simulator such that for all environments the environment output is indistinguishable in ...
1
vote
1answer
109 views

UC-framework: Simulating specific cases (proof in PVW)

I am struggling to understand the proof of security in the UC-framework of the OT by PVW. The cases I don't understand are the cases where: i) Both parties are corrupted. In this case, they say ...
1
vote
1answer
256 views

Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?

I have been reading Canetti, Cohen and Lindell's paper, "A Simpler Variant of Universally Composable Security for Standard Multiparty Computation", and there are some parts that I didn't understand. ...
1
vote
1answer
174 views

What are limitations of Universally Composable (UC) framework?

I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the ...
1
vote
1answer
127 views

Difference in the Powers of Simulator and Environment in Universal Composability

I know that in UC model, environment controls the real world adversaries but there is still a simulator wrapped around these real-world adversaries in the ideal world (which we sometimes collectively ...
1
vote
0answers
38 views

Formal Verification for Multiparty Computation and Homomorphic Encryption?

I've recently found some work on the use of Formal Verification Software, like ProVerif for enclaves. I wonder is if its feasible to have something similar for MPC and Homomorphic Encryption and ...
1
vote
0answers
23 views

Session IDs in (simple) universal composability

In the simple UC framework paper, there is a brief discussion on session identifiers (sids) on page 13. It states The main protocol is given a session identifier sid but it is not entirely clear to ...
1
vote
0answers
53 views

Universal composability: Can an ideal functionality call other ideal functionalities?

I'm new to universal composability. I'm trying to define a protocol, $\pi$, in UC. The protocol involves 3 parties: A, B, and a smart contract $C$. Parties A and B interact with each other and with $C$...
1
vote
1answer
79 views

What is the border between an ideal functionality and a protocol?

In the context of the UC framework, what is the border between an ideal functionality and a protocol? It seems to me that it depends on the level of granularity required for proofs. For example, ...
1
vote
0answers
37 views

Abstract Cryptography: why local simulators?

In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ...
1
vote
0answers
148 views

Why is this functionality chosen for UC-NIZK?

A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness. And, let's say P is a party ...
1
vote
0answers
48 views

Efficient universally composable protocols for aggregate statistics

Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value. An ideal functionality ...
1
vote
0answers
47 views

Proofs of security for anonymity in a multi-party setting

I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
1
vote
0answers
46 views

Are theorems 2 and 3 in the Town Crier paper (Zhang et al, 2016) proven using the UC framework?

I am reading the paper ‘Town Crier: An Authenticated Data Feed for Smart Contracts’ by Zhang et al (2016), but there is something I just cannot wrap my head around. In Section 7 and Appendix C, it ...
0
votes
2answers
195 views

What is the difference between a cryptographic primitive and a functionality?

In the context of papers using the UC framework, I have seen the same cryptographic tools refereed as cryptographic primitives and functionalities. Are the two terms interchangeable? An example is ...
0
votes
1answer
91 views

Example of a problem for which Zero-Knowledge proof is not sequentially composable

There are notions that a Zero-knowledge proof with auxiliary input is necessary for sequential composition. However, the authors here give a very convoluted example of a system which is not ...
0
votes
0answers
22 views

Why a simulator can obtain a corrupted party's input to some subrountine ideal functionality $F$ "for free" in $F$-hybrid model?

In "How To Simulate It" (page 45, line 10), Lindell noted that, in the $f_{\textsf{zk}}$-hybrid model (where $f_{\textsf{zk}}$ denotes the ideal zero-knowledge functionality) in the stand-...
0
votes
0answers
27 views

UC-secure commitment in the ROM

Looking at the question Is this a UC-secure commitment scheme in the ROM?, I was wondering, is the commitment scheme proposed in the answer (which uses $H(M||r)$ as commit) secure in the UC-model, ...