Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Dagstuhl reports

Practical Yet Composably Secure Cryptographic Protocols (Dagstuhl Seminar 19042)

Jan L. Camenisch, Ralf Küsters, Anna Lysyanskaya, Alessandra Scafuro

Published Jan 1, 2019• 2 citations
Publisher

Abstract

This report documents the program and the outcomes of Dagstuhl Seminar 19042 "Practical Yet Composably Secure Cryptographic Protocols". The workshop's main aim was to enhance the community's understanding of (1) what a good model was for how various protocols and systems co-exist in a larger system; (2) how to model important tasks and security protocols in such a model; (3) how to prove security of protocols in such a model.

DOI
10.4230/dagrep.9.1.88

Related papers

Quantum Cryptanalysis (Dagstuhl Seminar 13371)

Serge Fehr, Michele Mosca, Martin Rötteler +1 more

This report documents the program and the outcomes of Dagstuhl Seminar 13371 "Quantum Cryptanalysis". In the first part, the motivation and organizational aspects of this meeting are outlined. Thereafter, abstracts for the presentations are provided (sorted alphabetically by last name of the presenter)

Dagstuhl reports•Jan 1, 2014•0 citations

Quantum Cryptanalysis (Dagstuhl Seminar 25431)

Gorjan Alagic, Simona Etinski, Stacey Jeffery +1 more

This report documents the program and the outcomes of Dagstuhl Seminar 25431 "Quantum Cryptanalysis". The seminar took place as an in-person event in October 2025 and was the eighth installment of the Dagstuhl Seminar series on Quantum Cryptanalysis. This report describes the motivation and technical scope of the seminar as well as the (updated) organizational structure of this week-long event. We also include abstracts of the seminar presentations given by participants and a description of the activities of the working groups.

Dagstuhl reports•Jan 1, 2026•0 citations

Quantum Programming Languages (Dagstuhl Seminar 18381)

Michele Mosca, Martin Roetteler, Peter Selinger

This report documents the program and the outcomes of Dagstuhl Seminar 18381 "Quantum Programming Languages", which brought together researchers from quantum computing and classical programming languages.

Dagstuhl reports•Jan 1, 2019•12 citations

Quantum Cryptanalysis (Dagstuhl Seminar 15371)

Michele Mosca, Martin Roetteler, Nicolas Sendrier +1 more

This report documents the program and the outcomes of Dagstuhl Seminar 15371 "Quantum Cryptanalysis". In this seminar, participants explored the impact that quantum algorithms will have on cryptology once a large-scale quantum computer becomes available. Research highlights in this seminar included both computational resource requirement and availability estimates for meaningful quantum cryptanalytic attacks against conventional cryptography, as well as the security of proposed quantum-safe cryptosystems against emerging quantum cryptanalytic attacks.

Dagstuhl reports•Jan 1, 2016•0 citations

Universally composable security: a new paradigm for cryptographic protocols

Ran Canetti

We propose a novel paradigm for defining security of cryptographic protocols, called universally composable security. The salient property of universally composable definitions of security is that they guarantee security even when a secure protocol is composed of an arbitrary set of protocols, or more generally when the protocol is used as a component of an arbitrary system. This is an essential property for maintaining security of cryptographic protocols in complex and unpredictable environments such as the Internet. In particular, universally composable definitions guarantee security even when an unbounded number of protocol instances are executed concurrently in an adversarially controlled manner, they guarantee non-malleability with respect to arbitrary protocols, and more. We show how to formulate universally composable definitions of security for practically any cryptographic task. Furthermore, we demonstrate that practically any such definition can be realized using known techniques, as long as only a minority of the participants are corrupted. We then proceed to formulate universally composable definitions of a wide array of cryptographic tasks, including authenticated and secure communication, key-exchange, public-key encryption, signature, commitment, oblivious transfer, zero knowledge and more. We also make initial steps towards studying the realizability of the proposed definitions in various settings.

Annual Symposium on Foundations of Computer Science•Jan 1, 2001•3,358 citations

Can universally composable cryptographic protocols be practical?

István Vajda

The Universal Composability (UC) framework provides provable security guaranties for harsh application environment, where we want to construct protocols which keep security guarantees even when they are concurrently composed with arbitrary number of arbitrary (even hostile) protocols.This is a very strong guarantee.The UC-framework inherently supports the modular design, which allows secure composition of arbitrary number of UC-secure components with an arbitrary protocol.In contrast, traditional analysis and design is a stand alone analysis where security of a single instance is considered, i.e. an instance which is not in potential interaction with any concurrent instances.Furthermore, a typical traditional analysis is informal, i.e. without a formal proof.In spite of these facts, beyond the task of key-exchange this technology have not really took the attention of the community of applied cryptography.From practitioner's point of view the UC-world may seem more or less an academic interest of theoretical cryptographers.Accordingly we take a pragmatic approach, where we concentrate on meaningful compromises between the assumed adversarial strength, ideality wishes and realization complexity while keeping provable security guarantees within the UC-framework.We believe that even modest but provable goals (especially, if tunable to application scenarios) are interesting if a wider penetration of the UC-technology is desired into the daily-practice of protocol applications.

International Journal of Computer Network and Information Security•Sep 8, 2015•2 citations
This report documents the program and the outcomes of Dagstuhl Seminar 19042 "Practical Yet Composably Secure Cryptographic Protocols". The workshop's main aim was to enhance the community's understanding of (1) what a good model was for how various protocols and systems co-exist in a larger system; (2) how to model important tasks and security protocols in such a model; (3) how to prove security of protocols in such a model.
This report documents the program and the outcomes of Dagstuhl Seminar 25431 "Quantum Cryptanalysis". The seminar took place as an in-person event in October 2025 and was the eighth installment of the Dagstuhl Seminar series on Quantum Cryptanalysis. This report describes the motivation and technical scope of the seminar as well as the (updated) organizational structure of this week-long event. We also include abstracts of the seminar presentations given by participants and a description of the activities of the working groups.
This report documents the program and the outcomes of Dagstuhl Seminar 15371 "Quantum Cryptanalysis". In this seminar, participants explored the impact that quantum algorithms will have on cryptology once a large-scale quantum computer becomes available. Research highlights in this seminar included both computational resource requirement and availability estimates for meaningful quantum cryptanalytic attacks against conventional cryptography, as well as the security of proposed quantum-safe cryptosystems against emerging quantum cryptanalytic attacks.
We propose a novel paradigm for defining security of cryptographic protocols, called universally composable security. The salient property of universally composable definitions of security is that they guarantee security even when a secure protocol is composed of an arbitrary set of protocols, or more generally when the protocol is used as a component of an arbitrary system. This is an essential property for maintaining security of cryptographic protocols in complex and unpredictable environments such as the Internet. In particular, universally composable definitions guarantee security even when an unbounded number of protocol instances are executed concurrently in an adversarially controlled manner, they guarantee non-malleability with respect to arbitrary protocols, and more. We show how to formulate universally composable definitions of security for practically any cryptographic task. Furthermore, we demonstrate that practically any such definition can be realized using known techniques, as long as only a minority of the participants are corrupted. We then proceed to formulate universally composable definitions of a wide array of cryptographic tasks, including authenticated and secure communication, key-exchange, public-key encryption, signature, commitment, oblivious transfer, zero knowledge and more. We also make initial steps towards studying the realizability of the proposed definitions in various settings.
The Universal Composability (UC) framework provides provable security guaranties for harsh application environment, where we want to construct protocols which keep security guarantees even when they are concurrently composed with arbitrary number of arbitrary (even hostile) protocols.This is a very strong guarantee.The UC-framework inherently supports the modular design, which allows secure composition of arbitrary number of UC-secure components with an arbitrary protocol.In contrast, traditional analysis and design is a stand alone analysis where security of a single instance is considered, i.e. an instance which is not in potential interaction with any concurrent instances.Furthermore, a typical traditional analysis is informal, i.e. without a formal proof.In spite of these facts, beyond the task of key-exchange this technology have not really took the attention of the community of applied cryptography.From practitioner's point of view the UC-world may seem more or less an academic interest of theoretical cryptographers.Accordingly we take a pragmatic approach, where we concentrate on meaningful compromises between the assumed adversarial strength, ideality wishes and realization complexity while keeping provable security guarantees within the UC-framework.We believe that even modest but provable goals (especially, if tunable to application scenarios) are interesting if a wider penetration of the UC-technology is desired into the daily-practice of protocol applications.