On the (Non-)Equivalence of UC Security Notions

Saikrishna Badrinarayanan, Dakshita Khurana, Rafail Ostrovsky +1 more

Jan L. Camenisch, Anja Lehmann, Gregory Neven +1 more

The universal composability (UC) framework enables the modular design of cryptographic protocols by allowing arbitrary compositions of lower-level building blocks. Public-key encryption is unarguably a very important such building block. However, so far no UC-functionality exists that offers non-interactive encryption necessary for modular protocol construction. We provide an ideal functionality for non-committing encryption (i.e., public-key encryption secure against adaptive corruptions) with locally generated, and therefore non-interactive, ciphertexts. As a sanity check, we also provide a property-based security notion that we prove to be equivalent to the UC notion. We then show that the encryption scheme of Camenisch et al. (SCN '16) based on trapdoor permutations securely implements our notion in the random-oracle model without assuming secure erasures. This is the best one can hope to achieve as standard-model constructions do not exist due to the uninstantiability of round-optimal adaptively secure message transfer in the standard model (Nielsen, Crypto '02). We illustrate the modular reusability of our functionality by constructing the first non-interactive signcryption scheme secure against adaptive corruptions without secure erasures in the UC framework.

Ivan Damgård, Jesper Buus Nielsen

Oana Ciobotaru

Abstract. Over the years, various security notions have been proposed in the classical model where protocol participants are assumed either honest or arbitrarily malicious. Recently, the study of security notions has been extended towards comparing notions such as weak precise secure computation with the game-theoretic notion of universal implementation of a mediator. Even though the study of implication relations among various security notions has been very prolific, important open problems remain. For ex-ample, for almost a decade it was not known [25] whether the notions of specialized simulator universally composable security and 1-bit special-ized simulator universally composable security are equivalent or not. An-other open problem [19,20] is finding security notions stronger than weak precise secure computation such that they are equivalent with appropri-ately defined game-theoretic notions. In this work, we give an answer to each of the above mentioned open problems. 1

Masayuki Abe, Miyako Ohkubo

A universally composable (UC) blind signature functionality requres users to commit to the message to be blindly signed. It is thereby impossible to realize in the plain model. This paper shows that even non-committing variants of UC blind signature functionality can not be realized in the plain model. We characterize UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. Usefulness of the characterization is demonstrated by showing that Fischlin’s basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.

Aggelos Kiayias, Hong-Sheng Zhou