Contrary to prior belief, we show that there exist commitment, zero-knowledge and general function evaluation protocols with universally composable security, in a model where all parties and all protocols have access to a single, global, random oracle and no other trusted setup. This model provides significantly stronger composable security guarantees than the traditional random oracle model of Bellare and Rogaway [CCS'93] or even the common reference string model. Indeed, these latter models provide no security guarantees in the presence of arbitrary protocols that use the {\em same} random oracle (or reference string or hash function).Contrary to prior belief, we show that there exist commitment, zero-knowledge and general function evaluation protocols with universally composable security, in a model where all parties and all protocols have access to a single, global, random oracle and no other trusted setup. This model provides significantly stronger composable security guarantees than the traditional random oracle model of Bellare and Rogaway [CCS'93] or even the common reference string model. Indeed, these latter models provide no security guarantees in the presence of arbitrary protocols that use the {\em same} random oracle (or reference string or hash function).

ACM SIGSAC Conference on Computer and Communications Security (CCS)Nov 3, 201497 citations

Practical UC security with a Global Random Oracle.

Ran Canetti, Abhishek Jain, Alessandra Scafuro

We show that there exist commitment, zero-knowledge and general function evaluation pro-tocols with universally composable security, in a model where all parties and all protocols have access to a single, global, random oracle and no other trusted setup. This model provides sig-nificantly stronger composable security guarantees than the traditional random oracle model of Bellare and Rogaway [CCS’93] or even the common reference string model. Indeed, these latter models provide no security guarantees in the presence of arbitrary protocols that use the same random oracle (or reference string or hash function). Furthermore, our protocols are highly efficient. Specifically, in the interactive setting, our commitment and general computation protocols are much more efficient than the best known ones due to Lindell [Crypto’11,’13] which are secure in the common reference string model. In the non-interactive setting, our protocols are slightly less efficient than the best known ones presented by Afshar et al. [Eurocrypt ’14] but do away with the need to rely on a non-global (programmable) reference string. 1We show that there exist commitment, zero-knowledge and general function evaluation pro-tocols with universally composable security, in a model where all parties and all protocols have access to a single, global, random oracle and no other trusted setup. This model provides sig-nificantly stronger composable security guarantees than the traditional random oracle model of Bellare and Rogaway [CCS’93] or even the common reference string model. Indeed, these latter models provide no security guarantees in the presence of arbitrary protocols that use the same random oracle (or reference string or hash function). Furthermore, our protocols are highly efficient. Specifically, in the interactive setting, our commitment and general computation protocols are much more efficient than the best known ones due to Lindell [Crypto’11,’13] which are secure in the common reference string model. In the non-interactive setting, our protocols are slightly less efficient than the best known ones presented by Afshar et al. [Eurocrypt ’14] but do away with the need to rely on a non-global (programmable) reference string. 1

Jan 1, 20140 citations

Universally composable zero-knowledge sets

Haixia Xu, Hongda Li, Bao Li

We define and construct universally composable (UC) Zero-Knowledge Set (ZKS) protocols. A ZKS protocol allows a prover to commit to a secret set S and prove statements of the form x ∈ S or x ∉ S without revealing any other information about S. The universal composability framework initiated by Canetti is very useful as it ensures stronger security such as concurrent composition, adaptive security and non-malleability. In this paper, we propose a UC ZKS protocol and prove its security in the random oracle model. Simultaneously, we give the negative result that a UC ZKS cannot exist in the standard model (without a random oracle). The negative result shows that the random oracle has both compression and extraction, which is a pair of paradoxical properties. To our knowledge, this is the first time this kind of property has been considered.We define and construct universally composable (UC) Zero-Knowledge Set (ZKS) protocols. A ZKS protocol allows a prover to commit to a secret set S and prove statements of the form x ∈ S or x ∉ S without revealing any other information about S. The universal composability framework initiated by Canetti is very useful as it ensures stronger security such as concurrent composition, adaptive security and non-malleability. In this paper, we propose a UC ZKS protocol and prove its security in the random oracle model. Simultaneously, we give the negative result that a UC ZKS cannot exist in the standard model (without a random oracle). The negative result shows that the random oracle has both compression and extraction, which is a pair of paradoxical properties. To our knowledge, this is the first time this kind of property has been considered.

International Journal of Grid and Utility ComputingJan 1, 20125 citations