Universal Composability Research Articles

Securing wireless mesh networks in a unified security framework with corruption-resilience

Wireless mesh networks (WMN) are expected to be widespread due to their excellent properties like low-cost deployment, easy arrangement and self-organization. Although some proposed security schemes for WMNs with various security objectives have been put forward recently, it is a challenge to employ a uniform cryptography context to achieve resilience to trust authority corruption and maintain trust relationships flexibly among different domains. In this paper, a unified security framework (USF) for multi-domain wireless mesh networks is proposed. The identity-based encryption and the certificateless signature are unified in the proposed cryptography operations utilizing bilinear groups to solve key escrow problem. To ensure secure muliti-hop communication in WMN, the intra and inter domain authentication and key agreement protocols are devised sophisticatedly to achieve perfect forward secrecy and attack-resilience. With the enhanced security properties in the USF scheme, when a trust authority is corrupted, parts of the WMN could be survivable in the local area if proper measures are taken. A formal security proof of the proposed authentication protocols is presented based on Universal Composable security theory. The detailed performance analysis shows that the enhanced security attributes are achieved with reasonable overhead.

An Efficient Non-interactive Universally Composable String-Commitment Scheme

This paper presents a new non-interactive string-commitment scheme that achieves universally composable security. Security is proven under the decisional composite residuosity (DCR) assumption (or the decisional Diffie-Hellman (DDH) assumption) in the common reference string (CRS) model. The universal composability (UC) is a very strong security notion. If cryptographic protocols are proven secure in the UC framework, then they remain secure even if they are composed with arbitrary protocols and polynomially many copies of the protocols are run concurrently. Many UC commitment schemes in the CRS model have been proposed, but they are either interactive commitment or bit-commitment (not string-commitment) schemes. We note, however, that although our scheme is the first non-interactive UC string-commitment scheme, a CRS is not reusable. We use an extension of all-but-one trapdoor functions (ABO-TDFs) proposed by Peikert and Waters at STOC 2008 as an essential building block. Our main idea is to extend (original deterministic) ABO-TDFs to probabilistic ones by using the homomorphic properties of their function indices. The function indices of ABO-TDFs consist of ciphertexts of homomorphic encryption schemes (such as ElGamal, and Damgard-Jurik encryption). Therefore we can re-randomize the output of ABO-TDFs by re-randomization of ciphertexts. This is a new application of ABO-TDFs.

A framework for universally composable non-committing blind signatures

This paper studies non-committing type of universally composable (UC) blind signature protocols where an adversary does not necessarily commit to a message when requesting a signature. An ordinary UC blind signature functionality requires users to commit to the message to be blindly signed. It is thereby impossible to realise in the plain model. This paper first shows that even non-committing variants cannot be realised in the plain model. We then characterise UC non-committing blind signatures in the common reference string model by presenting equivalent stand-alone security notions under static corruption. The usefulness of the characterisation is demonstrated by showing that Fischlin's basic stand-alone blind signature scheme can be transformed into a UC non-committing blind signature protocol without using extra cryptographic components. We extend the results to the adaptive corruption model and present analogous notions, theorems, and constructions both in the erasure model and the non-erasure model.

Universally composable zero-knowledge sets

We define and construct universally composable (UC) Zero-Knowledge Set (ZKS) protocols. A ZKS protocol allows a prover to commit to a secret set S and prove statements of the form x ∈ S or x ∉ S without revealing any other information about S. The universal composability framework initiated by Canetti is very useful as it ensures stronger security such as concurrent composition, adaptive security and non-malleability. In this paper, we propose a UC ZKS protocol and prove its security in the random oracle model. Simultaneously, we give the negative result that a UC ZKS cannot exist in the standard model (without a random oracle). The negative result shows that the random oracle has both compression and extraction, which is a pair of paradoxical properties. To our knowledge, this is the first time this kind of property has been considered.

A Survey on Privacy Frameworks for RFID Authentication

Due to rapid growth of RFID system applications, the security and privacy problems become more and more important to guarantee the validity of RFID systems. Without introducing proper privacy protection mechanisms, widespread deployment of RFID could raise privacy concerns to both companies and individuals. As a fundamental issue for the design and analysis of secure RFID systems, some formal RFID privacy frameworks were proposed in recent years to give the principles for evaluating the security and privacy in RFID system. However, readers can be confused with so many proposed frameworks. In this paper, we make a comparative and survey study on the proposed RFID privacy frameworks. We mainly divide the existing models into three categories, the four-oracle framework, eight-oracle framework and Universal Composability framework. We give a brief review on the existing models and describe their abilities to model the adversarial behavior in RFID systems. We then analyze relations among those existing RFID privacy models and make some comparisons among their properties.

Universal Composable Password Authenticated Key Exchange Protocol in the Standard Model

PDF HTML阅读 XML下载 导出引用 引用提醒 标准模型下通用可组合的口令认证密钥交换协议 DOI: 10.3724/SP.J.1001.2011.03910 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: 国家自然科学基金(60873261); 国家高技术研究发展计划(863)(2009AA01Z417); 国家科技支撑计划(2008BAH37B02-2) Universal Composable Password Authenticated Key Exchange Protocol in the Standard Model Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:通过构造不可延展的、可提取的且是弱模拟可靠的陷门承诺体制,以及相应的平滑投射Hash 函数簇,设计了一个高效的通用可组合(universal composable,简称UC)安全的两方口令认证密钥交换(password authenticated key exchange,简称PAKE)协议,并在静态腐化模型下给出了严格的安全性证明.该协议使得PAKE 协议在UC框架下达到了最优的两轮.与已有的协议相比,该协议避免了零知识证明协议的使用,在保持计算复杂度相当的前提下有效地提高了通信效率. Abstract:Through constructing and utilizing non-malleable, extractable, and weak simulation-sound trapdoor commitment schemes and corresponding smooth projective hash function familes, this paper proposes an efficient two-party password authenticated key exchange (PAKE) protocol within the universal composable (UC) framework, which is the optimal two-round PAKE protocol in this setting. Rigorous security proofs based on standard assumptions in the presence of static corruption adversary are then given out. Comparisons with previously proposed protocols show that, this protocol avoids the use of zero-knowledge protocols, and achieves a higher performance in terms of communication efficiency while attaining a comparable computational complexity. 参考文献 相似文献 引证文献

Resource Fairness and Composability of Cryptographic Protocols

We introduce the notion of resource-fair protocols. Informally, this property states that if one party learns the output of the protocol, then so can all other parties, as long as they expend roughly the same amount of resources. As opposed to previously proposed definitions related to fairness, our definition follows the standard simulation paradigm and enjoys strong composability properties. In particular, our definition is similar to the security definition in the universal composability (UC) framework, but works in a model that allows any party to request additional resources from the environment to deal with dishonest parties that may prematurely abort. In this model we specify the ideally fair functionality as allowing parties to “invest resources” in return for outputs, but in such an event offering all other parties a fair deal. (The formulation of fair dealings is kept independent of any particular functionality, by defining it using a “wrapper.”) Thus, by relaxing the notion of fairness, we avoid a well-known impossibility result for fair multi-party computation with corrupted majority; in particular, our definition admits constructions that tolerate arbitrary number of corruptions. We also show that, as in the UC framework, protocols in our framework may be arbitrarily and concurrently composed. Turning to constructions, we define a “commit-prove-fair-open” functionality and design an efficient resource-fair protocol that securely realizes it, using a new variant of a cryptographic primitive known as “time-lines.” With (the fairly wrapped version of) this functionality we show that some of the existing secure multi-party computation protocols can be easily transformed into resource-fair protocols while preserving their security.

Simplified Universally Composable Proxy Re-Signature

The paper presents a simple proxy re-signature scheme and its two equivalent security model.One is based on the universal composability framework,another is game-based security model.The proposed scheme is bidirectional,multi-use,transitive and key optimal.It is very attractive for its simplicity.Its security can be reduced to the Computational Diffie-Hellman assumption in the Random Oracle Model.It is also secure under the universal composability framework.

Secure Computation Without Authentication

Research on secure multiparty computation has mainly concentrated on the case where the parties can authenticate each other and the communication between them. This work addresses the question of what security can be guaranteed when authentication is not available. We consider a completely unauthenticated setting, where all messages sent by the parties may be tampered with and modified by the adversary without the uncorrupted parties being able to detect this fact. In this model, it is not possible to achieve the same level of security as in the authenticated-channel setting. Nevertheless, we show that meaningful security guarantees can be provided: Essentially, all the adversary can do is to partition the network into disjoint sets, where in each set the computation is secure in of itself, and also independent of the computation in the other sets. In this setting we provide, for the first time, nontrivial security guarantees in a model with no setup assumptions whatsoever. We also obtain similar results while guaranteeing universal composability, in some variants of the common reference string model. Finally, our protocols can be used to provide conceptually simple and unified solutions to a number of problems that were studied separately in the past, including password-based authenticated key exchange and nonmalleable commitments. As an application of our results, we study the question of constructing secure protocols in partially authenticated networks, where some of the links are authenticated, and some are not (as is the case in most networks today).

Impossibility Results for Universal Composability in Public-Key Models and with Fixed Inputs

Universal composability and concurrent general composition consider a setting where secure protocols are run concurrently with each other and with arbitrary other possibly insecure protocols. Protocols that meet the definition of universal composability are guaranteed to remain secure even when run in this strongly adversarial setting. In the case of an honest majority, or where there is a trusted setup phase of some kind (like a common reference string or the key-registration public-key infrastructure of Barak et al. in FOCS 2004), it has been shown that any functionality can be securely computed in a universally composable way. On the negative side, it has also been shown that in the plain model where there is no trusted setup at all, there are large classes of functionalities which cannot be securely computed in a universally composable way without an honest majority.In this paper, we extend these impossibility results for universal composability. We study a number of public-key models and show for which models the impossibility results of universal composability hold and for which they do not. We also consider a setting where the inputs to the protocols running in the network are fixed before any execution begins. The majority of our results are negative and we show that the known impossibility results for universal composability in the case of no honest majority extend to many other settings.

Long-Term Security and Universal Composability

Algorithmic progress and future technological advances threaten today’s cryptographic protocols. This may allow adversaries to break a protocol retrospectively by breaking the underlying complexity assumptions long after the execution of the protocol. Long-term secure protocols, protocols that after the end of the execution do not reveal any information to a then possibly unlimited adversary, could meet this threat. On the other hand, in many applications, it is necessary that a protocol is secure not only when executed alone, but within arbitrary contexts. The established notion of universal composability (UC) captures this requirement. This is the first paper to study protocols which are simultaneously long-term secure and universally composable. We show that the usual set-up assumptions used for UC protocols (e.g. a common reference string) are not sufficient to achieve long-term secure and composable protocols for commitments or zero-knowledge protocols. We give practical alternatives (e.g. signature cards) to these usual setup-assumptions and show that these enable the implementation of the important primitives commitment and zero-knowledge protocols.

Universally composable secure TNC model and EAP-TNC protocol in IF-T

This paper analyzes trusted network connect (TNC) protocols within the universally composable (UC) framework. We propose the first TNC model in the UC framework by first designing the TNC ideal functionality ℱTNC, the EAP ideal functionality ℱEAP and the EAP-TNC ideal functionality ℱE-PA. Then, we construct a trusted network connect protocol named TK-TNC that UC-realizes ℱTNC in the (ℱEAP, ℱE-PA)-hybrid model. Subsequently, we perform a security analysis on protocol D-H PN given in the TCG specification and show that this protocol cannot securely realize the EAP-TNC ideal functionality and be resistant to an attack. Finally, we propose an alternative protocol using the twin Diffie-Hellman key-exchange technique, named protocol TD-H PN, which can securely realize the EAP-TNC ideal functionality in the (ℱREG, ℱCERT)-hybrid model.

Split-ballot voting

In this article, we propose a new voting protocol with several desirable security properties. The voting stage of the protocol can be performed by humans without computers; it provides every voter with the means to verify that all the votes were counted correctly (universal verifiability) while preserving ballot secrecy. The protocol has “everlasting privacy”: Even a computationally unbounded adversary gains no information about specific votes from observing the protocol's output. Unlike previous protocols with these properties, this protocol distributes trust between two authorities: a single corrupt authority will not cause voter privacy to be breached. Finally, the protocol is receipt-free: A voter cannot prove how she voted even if she wants to do so. We formally prove the security of the protocol in the universal composability framework, based on number-theoretic assumptions.

Using IND-CVA for constructing secure communication

Within the framework of UC (universally composable) security, a general method is presented to construct a secure channel protocol with using IND-CVA (indistinguishability of encryption scheme under ciphertext verification attacks). A channel protocol with using the method first invokes an ideal key-exchange protocol to get a session key, and then computes the messages with an authenticated encryption scheme. The paper shows that a channel protocol is UC secure if and only if the underlying authenticated encryption scheme is both IND-CVA secure and INT-PTXT secure. The condition about secure channel protocol in this paper is much weaker than IND-CCA secure and INT-CTXT secure. The IND-CVA can be presented for describing the privacy requirements of secure channels in detail. Moreover, the method for designing secure channel protocol in the paper reduces the UC security of secure channels, which are measured by action-simulation in the UC security framework, to the security of authenticated encryption schemes, which are measured semantically.

Composability in quantum cryptography

If we combine two secure cryptographic systems, is the resulting system still secure? Answering this question is highly nontrivial and has recently sparked a considerable research effort, in particular, in the area of classical cryptography. A central insight was that the answer to the question is yes, but only within a well-specified composability framework and for carefully chosen security definitions.In this article, we review several aspects of composability in the context of quantum cryptography. The first part is devoted to key distribution. We discuss the security criteria that a quantum key distribution (QKD) protocol must fulfill to allow its safe use within a larger security application (e.g. for secure message transmission); and we demonstrate—by an explicit example—what can go wrong if conventional (non-composable) security definitions are used. Finally, to illustrate the practical use of composability, we show how to generate a continuous key stream by sequentially composing rounds of a QKD protocol.In the second part, we take a more general point of view, which is necessary for the study of cryptographic situations involving, for example, mutually distrustful parties. We explain the universal composability (UC) framework and state the composition theorem that guarantees that secure protocols can securely be composed to larger applications. We focus on the secure composition of quantum protocols into unconditionally secure classical protocols. However, the resulting security definition is so strict that some tasks become impossible without additional security assumptions. Quantum bit commitment is impossible in the UC framework even with mere computational security. Similar problems arise in the quantum bounded storage model and we observe a trade-off between the UC and the use of the weakest possible security assumptions.

A universal composability framework for analysis of proxy threshold signature

The universal composability framework is a new approach for designing and analyzing the security of cryptographic protocols. In this framework, the security of protocols is maintained under a general protocol composition operation. In the paper, we propose the universal composability framework for the analysis of proxy threshold signature and present a universally composable secure proxy threshold signature scheme which is the first one in this area. The proposed scheme is suitable for the mobile agents, which should migrate across different environment through network. Furthermore, we give the concrete analysis of the reduction to prove the security of the proposed scheme.

A note on the feasibility of generalised universal composability

In this paper we study (interpret) the precise composability guarantee of the generalised universal composability (GUC) feasibility with global setups that was proposed in the recent paper Canetti et al. (2007) from the point of view of full universal composability (FUC), that is, composability with arbitrary protocols, which was the original security goal and motivation for UC. By observing a counter-intuitive phenomenon, we note that the GUC feasibility implicitly assumes that the adversary has limited access to arbitrary external protocols. We then clarify a general principle for achieving FUC security, and propose some approaches for fixing the GUC feasibility under the general principle. Finally, we discuss the relationship between GUC and FUC from both technical and philosophical points of view. This should be helpful in gaining a precise understanding of the GUC feasibility, and for preventing potential misinterpretations and/or misuses in practice.

Universally composable proactive threshold RSA signature

Recently some efforts were made towards capturing the security requirements within the composable security framework. This modeling has some significant advantages in designing and analyzing complex systems. The threshold signature was discussed and a definition was given based on the universal composability framework, which is proved to be equivalent to the standard security definition. Furthermore, a simple, efficient and proactive threshold RSA signature protocol was presented. It is proved to be correct, consistent and unforgeable relative to the environment that at most t − 1 parties are corrupted in each proactive stage. It is also secure under the universal composability framework. It is a UC based security and is proved to be equivalent to the standard security.

A Probabilistic Multicast with Universally Composable Anonymity in MANETs

Current anonymous routing protocols do not provide anonymous mechanism for multicast in MANETs and have only had ad-hoc anonymity analysis. This paper proposes a new scheme called probabilistic multicast with universally composable anonymity. One-Time key pair is used to keep a route record in privacy during route discovery processes. Gossip-Scheme, secret DH path and Bloom Filter are adopted to realize anonymous source multicast during transmission of data packets. Finally, the protocol is analyzed based on the UC (universally composable) framework and its performance is evaluated by simulation. The analysis and simulation results show

General Composition and Universal Composability in Secure Multiparty Computation

Concurrent general composition relates to a setting where a secure protocol is run in a network concurrently with other, arbitrary protocols. Clearly, security in such a setting is what is desired, or even needed, in modern computer networks where many different protocols are executed concurrently. Our main result is a proof that security under concurrent general composition is equivalent to a relaxed variant of universal composability (where the only difference relates to the order of quantifiers in the definition). An important corollary of this theorem is that existing impossibility results for universal composability (or actually its relaxed variant) are inherent in any definition achieving security under concurrent general composition. We stress that the impossibility results obtained are not "black-box", and apply even to non-black-box simulation. Our main result also demonstrates that the definition of universal composability is somewhat "minimal", in that the composition guarantee provided by universal composability (almost) implies the definition itself. This indicates that the security definition of universal composability is not overly restrictive.