Skip to main content
Cryptography

Questions tagged [universal-composability]

Ask Question

The framework of universal composability (UC) is a general-purpose model for the analysis of cryptographic protocols.

65 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
1 vote
1 answer
82 views

Universally composable (UC) security is defined in the ideal/real model paradigm. In this paradigm, a real protocol $\Pi$ is defined to be secure when the outputs of this protocol are ...
Apo's user avatar
  • 111
1 vote
0 answers
53 views

I was reading the paper How to simute it - A Tutorial on the Simulation Proof Technique by Yehuda Lindell, where he considers the Oblivious Transfer problem. (page 11) Basically, Oblivious Transfer is ...
Ace Roze's user avatar
  • 11
6 votes
0 answers
124 views

All the time I see cryptographic engineers praising the virtues of domain separation. Frequently, papers describing vulnerabilities in real-world protocols find domain separation problems. The core ...
Sam Jaques's user avatar
  • 1,920
1 vote
2 answers
211 views

Suppose a key $K$, two messages $X,Y \in \{0,1\}^n$ and a encryption function $\text{Enc}_K(\cdot)$ that produces independent indistinguishable from uniform cyphertexts in $\{0,1\}^m$. Is $\text{Enc}...
Ntcld's user avatar
  • 35
2 votes
1 answer
220 views

I was reading the book “Introduction to Modern Cryptography”, 2nd edition by Jonathan Katz and Yehuda Lindell. Page 67 of the book gives a scheme (Construction 3.17) similar to One-Time Pad, but with ...
Ntcld's user avatar
  • 35
3 votes
1 answer
110 views

I've been trying to understand the execution model in the UC framework. Suppose Alice (A) wants to communicate to Bob (B) via a channel (Ch). I have a mental picture that looks like the following: <...
Suraaj K S's user avatar
  • 232
3 votes
1 answer
89 views

The following question is intentionally informal because I don't understand things well enough to make them entirely formal. The topic is Universal Composability. An important notion in the definition ...
Suraaj K S's user avatar
  • 232
2 votes
2 answers
136 views

Consider the following simple UC module, described via pseudocode: Read input from environment, and save it to var Send var to adversary Send var to environment If I understand correctly, this can be ...
Suraaj K S's user avatar
  • 232
2 votes
1 answer
101 views

In UC, consider the protocol ρ^φ, which uses the protocol φ 'as a subroutine'. If I understand correctly, ρ would call φ with arguments, which would then perform computations, perhaps even calling its ...
Suraaj K S's user avatar
  • 232
2 votes
1 answer
130 views

I was learning about composable security frameworks, and I was wondering about the following when I was learning about Constructive Cryptography here (https://youtu.be/l7vyzRtLQCM?feature=shared&t=...
Suraaj K S's user avatar
  • 232
0 votes
1 answer
127 views

I have read into many papers and tutorials regarding "Universally Composable Security Proofs." I still have one confusion about the initial setup by the environment. On one hand, I got that ...
Novice User's user avatar
  • 101
2 votes
1 answer
102 views

I started learning about cryptography very recently, and I got interested in the Simplest-OT protocol of Chou and Orlandi. However (as the authors themselves noted) the protocol is not UC-secure ...
Daniel Turizo's user avatar
  • 121
2 votes
1 answer
160 views

In my understanding, the main difference in the proof between UC and standalone model is the ability to "rewind", which appears to related to malicious security only. So if we are only ...
vince.h's user avatar
  • 304
3 votes
1 answer
315 views

Could anyone direct me to literature regarding privacy proofs in the MPC setting. For example, how can one prove the following simple problem: Suppose a setting with $n$ parties $S_1, \ldots, S_n$ ...
Kolja's user avatar
  • 165
3 votes
1 answer
415 views

Using Fiat-Shamir, an interactive 3-round sigma protocol can be compiled into a non-interactive zero-knowledge proof in the random oracle model. A NIZK through Fiat-Shamir is not UC-Secure due to ...
Atonal's user avatar
  • 155
2 votes
0 answers
105 views

There are two papers that propose oblivious transfer protocols, both claiming to be universally composable (UC). The first protocol is more complex, and I am convinced that it is indeed UC. The second ...
user2249675's user avatar
  • 358
2 votes
1 answer
287 views

This is a follow-up question to Mikero’s answer to Simulation-based proofs and universal composability proofs. Let there be some protocol $\pi$ running between two parties $A$ and $B$. Furthermore, ...
Simulator's user avatar
  • 23
2 votes
0 answers
67 views

You can get access to this document via institutional login at https://www.researchgate.net/publication/220556089_Security_and_composition_of_cryptographic_protocols_A_tutorial So in Ran Canettis ...
killertoge's user avatar
  • 309
1 vote
0 answers
176 views

I am trying to get into Universal Composable Security, but before diving deeper I would like to confirm my intuition of the framework. https://eprint.iacr.org/2000/067.pdf A protocol $\pi$ securely ...
killertoge's user avatar
  • 309
2 votes
0 answers
179 views

Consider secure two-party computation against malicious adversaries in the standalone model. I know that the "rewinding" technique can be used to extract the corrupt party's input, e.g., in $...
X. G.'s user avatar
  • 424
4 votes
0 answers
221 views

I've been in my PhD program for a few months, and every time I try to understand the simulation and UC proof-paradigms I get so confused. I feel like what I really need is an easy set of (guided) ...
FearfulJoe's user avatar
  • 41
1 vote
1 answer
269 views

I do not quite understand the UC framework. Given a protocol to be proven, now I just know firstly we should write down the ideal functionality, and then the concrete protocol, then proving the ...
Eric_Qin's user avatar
  • 807
5 votes
1 answer
366 views

I've recently found some work on the use of Formal Verification Software, like ProVerif for enclaves. I wonder is if its feasible to have something similar for MPC and Homomorphic Encryption and ...
DaWNFoRCe's user avatar
  • 892
2 votes
0 answers
84 views

In "How To Simulate It" (page 45, line 10), Lindell noted that, in the $f_{\textsf{zk}}$-hybrid model (where $f_{\textsf{zk}}$ denotes the ideal zero-knowledge functionality) in the stand-...
X. G.'s user avatar
  • 424
4 votes
0 answers
76 views

Background The following zero-knowledge (ZK) counterexample is described in Canetti's work [Security and Composition of Cryptographic Protocols: A Tutorial, page 26] to show that there exists some ...
X. G.'s user avatar
  • 424
1 vote
1 answer
1k views

I consider the "standard" definition of maliciously-secure 2PC to be the simulation-based, ideal–real-world indistinguishability definition of e.g. Lindell's How to Simulate It [Lin17, ...
BD107's user avatar
  • 155
2 votes
1 answer
99 views

The UC framework [Can00 (version of 2020-02-11)] defines security (defn 9) as for all adversaries there exists a simulator such that for all environments the environment output is indistinguishable in ...
Sebastian's user avatar
  • 461
1 vote
0 answers
168 views

In the simple UC framework paper, there is a brief discussion on session identifiers (sids) on page 13. It states The main protocol is given a session identifier sid but it is not entirely clear to ...
Sebastian's user avatar
  • 461
10 votes
0 answers
965 views

Recently, I learn Ran Canetti's famous paper, "Universally Composable Security: A New Paradigm for Cryptographic Protocols". But I find it very difficult to grasp. When I read the paper that ...
Eric_Qin's user avatar
  • 807
2 votes
0 answers
41 views

Is there a simple example of a cryptographic protocol that is secure when used on its own (with only one instance active at a time) but becomes insecure in a concurrent setting, i.e., a failure of ...
D.W.'s user avatar
  • 37.1k
3 votes
1 answer
173 views

Consider the following (simplification of a) PAKE protocol: Alice and Bob start with a pre-agreed password pw. To establish a new session key $k$, first Alice samples a random nonce $r$ and sends it ...
Jabari's user avatar
  • 33
3 votes
2 answers
310 views

My intuition for the security a symmetric PAKE is supposed to provide comes from the example of a login page. Both the user and the server know the password (assuming unhashed passwords), and the ...
qbt937's user avatar
  • 258
15 votes
1 answer
4k views

I don't have a proper computer science education, so bear with my misunderstandings. UC is supposed to "guarantee strong security properties". From what I stand, if you have some secure ...
Expectator's user avatar
  • 362
1 vote
0 answers
159 views

I'm new to universal composability. I'm trying to define a protocol, $\pi$, in UC. The protocol involves 3 parties: A, B, and a smart contract $C$. Parties A and B interact with each other and with $C$...
Aydin's user avatar
  • 452
1 vote
2 answers
597 views

In the context of papers using the UC framework, I have seen the same cryptographic tools refereed as cryptographic primitives and functionalities. Are the two terms interchangeable? An example is ...
Lorenzo's user avatar
  • 149
1 vote
1 answer
435 views

In the context of the UC framework, what is the border between an ideal functionality and a protocol? It seems to me that it depends on the level of granularity required for proofs. For example, ...
Lorenzo's user avatar
  • 149
1 vote
0 answers
60 views

In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ...
Léo Colisson's user avatar
  • 1,551
2 votes
1 answer
273 views

I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the ...
WYC's user avatar
  • 41
0 votes
1 answer
186 views

There are notions that a Zero-knowledge proof with auxiliary input is necessary for sequential composition. However, the authors here give a very convoluted example of a system which is not ...
QuestionEverything's user avatar
  • 247
2 votes
1 answer
252 views

The stand-alone model and the UC model for simulation-based proofs in multiparty computation differ in the guarantees that they provide: The stand-alone model provides security under sequential ...
Daniel's user avatar
  • 4,122
1 vote
0 answers
317 views

A correct proof (a proof which is indistinguishable from previously sent proof) can be tagged as wrong by the ideal functionality here if the adversary sends no witness. And, let's say P is a party ...
Severus's user avatar
  • 67
12 votes
3 answers
2k views

I was reading Canetti00 Universally Composable security paper. The first page of introduction says that there are some MPC protocols and Zero knowledge protocols that are insecure under concurrent ...
satya's user avatar
  • 1,484
1 vote
1 answer
503 views

I am beginning to read some UC framework papers, and I guess it is similar to the simulation-based security analysis. I can understand the main advantage of UC is to assist us to analyze the ...
Z.P.'s user avatar
  • 353
4 votes
1 answer
261 views

Universal composability (UC) framework seems to be a powerful framework for proving security of protocols, which guarantees security even in the presence of concurrent composition. Though, I see there ...
user avatar
2 votes
0 answers
61 views

I am trying to define an ideal world for a protocol that requires two functionalities to interact with each other. Lets call them $\mathcal{F}_1$ and $\mathcal{F}_2$. Now $\mathcal{F}_1$ maintains a ...
zkvroon's user avatar
  • 88
1 vote
0 answers
62 views

Let's say we have multiple parties $P_1, \dots P_n$ that gather personal data, and a party $C$ that is interested in aggregate statistics on these data, i.e. the average value. An ideal functionality ...
bit's user avatar
  • 33
1 vote
1 answer
221 views

I am struggling to understand the proof of security in the UC-framework of the OT by PVW. The cases I don't understand are the cases where: i) Both parties are corrupted. In this case, they say ...
P.B.'s user avatar
  • 516
3 votes
1 answer
120 views

I'm wondering what does the "constant rate" mean in universal composable commitment scheme? I have known the rate of a commitment scheme is message length divided by the communication complexity of ...
CryptoLover's user avatar
  • 942
1 vote
0 answers
64 views

I'm looking for material that proves the anonymity of parties in a non-interactive setting. I would like to know if there are simulation based proofs (UC) and property based proofs (game based) for ...
zkvroon's user avatar
  • 88
4 votes
2 answers
461 views

Notations: We follow the convention in the UC framework. We use $\mathcal{A}$ to denote the adversary, $\mathcal{P}$ to denote a party in the model. We focus on two types of corruption in the UC ...
Weikeng Chen's user avatar
  • 574

1
2