Questions tagged [universal-composability]

The framework of universal composability (UC) is a general-purpose model for the analysis of cryptographic protocols.

Filter by
Sorted by
Tagged with
20
votes
1answer
757 views

What are the roles of the simulator in simulation based proofs

I'm trying to better understand simulation based proofs in the UC model - but the guidelines to construct a simulator confuse me. To my understanding, the simulator is activated in two ways: Outbound:...
17
votes
1answer
2k views

Simulation-based proofs and universal composability proofs

I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says The stand-alone ...
9
votes
3answers
2k views

Examples of protocols that are insecure when run concurrently

I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
6
votes
1answer
123 views

Is a composition of clocked entities a clocked entity in the UC model?

In the book titled "Secure Multiparty Computation and Secret Sharing" the authors define an interactive agent and an interactive system. Further, the author defines a clocked entity for considering ...
5
votes
1answer
458 views

Does simulation extractability require that the protocol have a backdoor in it?

As I understand it, one of the properties required to prove UC-security is simulation extractability. One example is the paper by Kosba et al adapting NIZKs to the UC model, but in their construction ...
4
votes
2answers
250 views

Modelling broadcast functionality in Universally Composable Framework

I'm studying the UC framework by Canetti. While I understand the basic idea, there are still a lot of details that I need to work through. One thing that's puzzling me is how to achieve concurrency ...
4
votes
2answers
304 views

passive corruption ?= Byzantine corruption in the UC framework?

Notations: We follow the convention in the UC framework. We use $\mathcal{A}$ to denote the adversary, $\mathcal{P}$ to denote a party in the model. We focus on two types of corruption in the UC ...
3
votes
1answer
87 views

What does “constant rate” mean in universal composable commitment scheme?

I'm wondering what does the "constant rate" mean in universal composable commitment scheme? I have known the rate of a commitment scheme is message length divided by the communication complexity of ...
3
votes
1answer
538 views

What's the principle to design the functionality under UC framework?

Though I can get the basic idea of UC Framework, namely let the environment cannot distinguish the real protocol with the real adversary and the functionality with the simulator, I am still puzzled in ...
3
votes
1answer
147 views

Why would someone prove security in the real-ideal model instead of Universal Composibility framework?

I am somewhat confused in the reasons why one would use the real-ideal model instead of the universal composibility framework. The UC framework seems to me, to provide a much stronger definition of ...
2
votes
1answer
2k views

Security of cloud computational protocols in UC Framework?

The universal composability allows one to the analyze security of cryptographic protocols . But it does have some gaps when it comes to analyzing few protocols especially two party cases when there is ...
2
votes
1answer
256 views

Is this a UC-secure commitment scheme in the ROM?

To prove UC-security (universally composable security) of a commitment scheme, we must show that a commitment scheme is extractable and equivocal. That is, we must construct a simulator that is able ...
2
votes
1answer
61 views

Extract adversary's secret input in simulation based security proofs

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
2
votes
1answer
85 views

Variants of universal composability in security proofs

Universal composability (UC) framework seems to be a powerful framework for proving security of protocols, which guarantees security even in the presence of concurrent composition. Though, I see there ...
2
votes
1answer
223 views

Protocol composition [closed]

I have been trying to wrap my head around different definitions of protocol security (stand alone, sequential composition, parallel composition, universal composition) and how the proofs of any of ...
2
votes
0answers
42 views

Can ideal functionalities share variables

I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$. Now $\mathcal{F}_1$ maintains a ...
2
votes
0answers
98 views

Are zkSTARKs simulation sound extractable in the random oracle model?

I've recently become interested in simulation sound extractable zero-knowledge proofs for use in UC-secure protocols. I've also become interested in the recent instantiation of PCIPs called zkSTARKs. ...
2
votes
0answers
53 views

Detail about reactive simulatability framework

I'm trying to understand the framework of reactive simulatability using *"PfWa2_00AsyncModel"* from this publication which is a tech report behind the paper A model for Asynchronous Reactive Systems ...
1
vote
1answer
67 views

Where was the stand-alone model for simulation-based MPC proposed first?

The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
1
vote
1answer
85 views

UC-framework: Simulating specific cases (proof in PVW)

I am struggling to understand the proof of security in the UC-framework of the OT by PVW. The cases I don't understand are the cases where: i) Both parties are corrupted. In this case, they say ...
1
vote
1answer
232 views

Simplified universal composability (SUC): can I model the use of encryption? Can I prove fairness?

I have been reading Canetti, Cohen and Lindell's paper, "A Simpler Variant of Universally Composable Security for Standard Multiparty Computation", and there are some parts that I didn't understand. ...
1
vote
1answer
102 views

What are limitations of Universally Composable (UC) framework?

I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the ...
1
vote
1answer
108 views

Difference in the Powers of Simulator and Environment in Universal Composability

I know that in UC model, environment controls the real world adversaries but there is still a simulator wrapped around these real-world adversaries in the ideal world (which we sometimes collectively ...
1
vote
1answer
49 views

What is the border between an ideal functionality and a protocol?

In the context of the UC framework, what is the border between an ideal functionality and a protocol? It seems to me that it depends on the level of granularity required for proofs. For example, ...
1
vote
0answers
34 views

Abstract Cryptography: why local simulators?

In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ...
1
vote
0answers
102 views

Why is this functionality chosen for UC-NIZK?

A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness. And, let's say P is a party ...
1
vote
0answers
44 views

Efficient universally composable protocols for aggregate statistics

Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value. An ideal functionality ...
1
vote
0answers
45 views

Proofs of security for anonymity in a multi-party setting

I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
1
vote
0answers
42 views

Are theorems 2 and 3 in the Town Crier paper (Zhang et al, 2016) proven using the UC framework?

I am reading the paper ‘Town Crier: An Authenticated Data Feed for Smart Contracts’ by Zhang et al (2016), but there is something I just cannot wrap my head around. In Section 7 and Appendix C, it ...
0
votes
2answers
78 views

What is the difference between a cryptographic primitive and a functionality?

In the context of papers using the UC framework, I have seen the same cryptographic tools refereed as cryptographic primitives and functionalities. Are the two terms interchangeable? An example is ...
0
votes
1answer
70 views

Example of a problem for which Zero-Knowledge proof is not sequentially composable

There are notions that a Zero-knowledge proof with auxiliary input is necessary for sequential composition. However, the authors here give a very convoluted example of a system which is not ...
0
votes
0answers
14 views

What is the relation between an ideal protocol or functionality and an adversary model?

In the context of the UC framework, what is the relation between an ideal protocol or functionality and an adversary model? Does it make sense to specify the type of adversary an ideal protocol or ...
0
votes
0answers
25 views

Stand-alone vs UC and Non-reactive vs Reactive Functionalities

I'm looking for a simple and concise explanation for the following: What are crucial differences and similarities between UC and stand-alone security? Under what conditions does one imply the other?...
0
votes
0answers
35 views

Some questions about simulator in UC proof

Let's focus on the UC proof in the existence of the dummy adversary $\mathcal{D}$ and the simulator $\mathcal{S}$ that internally runs $\mathcal{D}$. My questions are: Is it true that $\mathcal{S}$ ...
0
votes
0answers
21 views

Question about PKI-based non-deniable authentication by Canetti et al

In Universally Composable Authentication and Key-Exchange with Global PKI, Canetti et al. proposed a non-deniable authentication functionality as well as a protocol that GUC-emulates it. My question ...