Universal Composability Research Articles

A Core Calculus for Equational Proofs of Cryptographic Protocols

Many proofs of interactive cryptographic protocols (e.g., as in Universal Composability) operate by proving the protocol at hand to be observationally equivalent to an idealized specification. While pervasive, formal tool support for observational equivalence of cryptographic protocols is still a nascent area of research. Current mechanization efforts tend to either focus on diff-equivalence, which establishes observational equivalence between protocols with identical control structures, or require an explicit witness for the observational equivalence in the form of a bisimulation relation. Our goal is to simplify proofs for cryptographic protocols by introducing a core calculus, IPDL, for cryptographic observational equivalences. Via IPDL, we aim to address a number of theoretical issues for cryptographic proofs in a simple manner, including probabilistic behaviors, distributed message-passing, and resource-bounded adversaries and simulators. We demonstrate IPDL on a number of case studies, including a distributed coin toss protocol, Oblivious Transfer, and the GMW multi-party computation protocol. All proofs of case studies are mechanized via an embedding of IPDL into the Coq proof assistant.

Adaptively code-correlation robustness functions and its applications to private set intersection

In this paper, we propose a novel concept of adaptively code-correlation robustness functions (CCRFs) and construct this primitive from public random permutation. The security of our construction can be proved by H-Coefficient technique. Furthermore, the public random permutation can be instantiated by some lightweight designs like ChaCha20 512-bit permutation which is faster than SHA-512 and BLAKE2.We also give a one-sided malicious private set intersection (PSI) protocol in Universal Composability (UC) framework without random oracle model (ROM) assumption based on the adaptively CCRFs. In the high bandwidth setting, our implementation is nearly as fast as state-of-the-art semi-honest KKRT protocol, and sometimes even faster than it, owing to the efficiency of our instantiation of adaptively CCRFs, which may be of independent interest used in other secure protocols.

HyperMaze: Towards Privacy-Preserving and Scalable Permissioned Blockchain

Blockchain systems face two emergent problems, namely scalability and privacy, each of which has been addressed independently. However, how to achieve privacy and scalability simultaneously remains a challenging problem for blockchains. In this article, we propose a privacy-preserving and scalable permissioned blockchain system called HyperMaze employing the zero knowledge proof technique and a hierarchical system architecture. It gains scalability by adopting a hierarchy of multiple blockchains that processes transactions in parallel. We design an <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ID-based dual-balance account model</i> where an identity-based account is associated with two types of balances–a plaintext balance and a private (zero-knowledge) balance. Furthermore, we design a two-phase cross-chain transaction mechanism (2PXT) to achieve transaction privacy for both intra-chain and cross-chain transactions. We rigorously formulate a security model for HyperMaze under the universal composability framework, and then provide a simulation-based security proof. A prototype of HyperMaze is implemented and a series of experiments are conducted over up to 2,600 nodes to evaluate its performance. The experimental results show that a 4-level, (7,10)-threshold, 6-ary HyperMaze system can reach 19,440 TPS and the transaction confirmation latency is only 9.5 seconds. To our best knowledge, HyperMaze is the first high-throughput privacy-preserving blockchain whose throughput is over 19,000 TPS.

Cross-Chain Virtual Payment Channels

With the emergence of countless independent blockchain systems in recent years, cross-chain transactions have attracted considerable attention, and lots of solutions have been put forth by both industry and academia. However, most of the existing solutions suffer from either centralization or scalability issues. To mitigate these issues, in this paper, we propose the concept of cross-chain virtual payment channels, which allows two users in different blockchain systems to conduct limitless off-chain transactions with the help of an intermediate node, hence solving the centralization and scalability issues. Furthermore, as the intermediate node is only involved in the channel open and close operations, it further improves the efficiency of cross-chain transactions, and to a certain extent, it even enhances the privacy of the cross-chain transaction. Meanwhile, we also present the first concrete cross-chain virtual payment channel scheme, which only requires one of the blockchain systems supporting the Turing-complete scripting language. The corresponding detailed security analysis in the Universal Composability framework demonstrates that our proposal holds the Consensus on Open, Update, and Close. Finally, we implement and deploy our cross-chain virtual payment channel scheme on the Ethereum and Bitcoin test networks. The extensive experimental results show that our proposal dramatically improves the efficiency of cross-chain transactions, and the advantage becomes more pronounced as the number of transactions increases.

SIoVChain: Time-Lock Contract Based Privacy-Preserving Data Sharing in SIoV

Social Internet of Vehicles (SIoV) is an emerging technology in the smart city environment, enabling smart vehicles to form social groups and exchange data among themselves. SIoV facilitates many applications aiming to improve driving safety and traffic monitoring by sharing data among vehicles. It ensures a safe and comfortable drive. However, privacy, data confidentiality, and data integrity are the major challenges during multi-hop data transfer that must be addressed for the wide adoption of SIoV. The existing solutions do not provide anonymity and consume more network resources. To address these issues, we propose SIoVChain, a time-lock contract-based privacy-preserving data sharing scheme with incentives for SIoV. It does not only enable data sharing between vehicles anonymously but incentivizes them also. In addition, the proposed framework imposes a penalty anonymously if a malicious vehicle disseminates false information. SIoVChain is shown to be secure against stealing processing fee attack while preserving sender-receiver privacy and path privacy. Universal Composability (UC) framework is used to verify user privacy. The feasibility and efficiency of the scheme are also demonstrated.

Privacy-Oriented Transaction for Public Blockchain via Secret Sharing

Immutability and traceability are the main reasons for the popularity of blockchain. Nevertheless, its transparency also makes the transactions visible to all participants, which seriously violates the privacy of some dealers. In order to transfer accounts over blockchain, all verifiers should be empowered with the ability to confirm the transactions, leading to the conflict between extensive consensus and individual privacy. Orienting to privacy issues of UTXO (Unspent Transaction Output), this paper exploited the unconditional security of Shamir’s secret sharing to construct a logic-physical map for public chain, which enabled noninteractive transaction verification without privacy infringement. A comprehensive analysis indicated that the proposed scheme is secure under UC (Universal Composability) framework with practical computation and communication overheads.

Practical continuous-variable quantum key distribution with composable security

A quantum key distribution (QKD) system must fulfill the requirement of universal composability to ensure that any cryptographic application (using the QKD system) is also secure. Furthermore, the theoretical proof responsible for security analysis and key generation should cater to the number N of the distributed quantum states being finite in practice. Continuous-variable (CV) QKD based on coherent states, despite being a suitable candidate for integration in the telecom infrastructure, has so far been unable to demonstrate composability as existing proofs require a rather large N for successful key generation. Here we report a Gaussian-modulated coherent state CVQKD system that is able to overcome these challenges and can generate composable keys secure against collective attacks with N ≈ 2 × 108 coherent states. With this advance, possible due to improvements to the security proof and a fast, yet low-noise and highly stable system operation, CVQKD implementations take a significant step towards their discrete-variable counterparts in practicality, performance, and security.

Multiverse of HawkNess: A Universally-Composable MPC-Based Hawk Variant

The evolution of smart contracts in recent years inspired a crucial question: do smart contract evaluation protocols provide the required level of privacy when executing contracts on the blockchain? The Hawk (IEEE S&amp;P ’16) paper introduces a way to solve the problem of privacy in smart contracts by evaluating the contracts off-chain, albeit with the trust assumption of a manager. To avoid the partially trusted manager altogether, a novel approach named zkHawk (IEEE BRAINS ’21) explains how we can evaluate the contracts privately off-chain using a multi-party computation (MPC) protocol instead of trusting said manager. This paper dives deeper into the detailed construction of a variant of the zkHawk protocol titled V-zkHawk using formal proofs to construct the said protocol and model its security in the universal composability (UC) framework (FOCS ’01). The V-zkHawk protocol discussed here does not support immediate closure, i.e., all the parties (n) have to send a message to inform the blockchain that the contract has been executed with corruption allowed for up to t parties, where t&lt;n. In the most quintessential sense, the V-zkHawk is a variant because the outcome of the protocol is similar (i.e., execution of smart contract via an MPC function evaluation) to zkHawk, but we modify key aspects of the protocol, essentially creating a small trade-off (removing immediate closure) to provide UC (stronger) security. The V-zkHawk protocol leverages joint Schnorr signature schemes, encryption schemes, Non-Interactive Zero-Knowledge Proofs (NIZKs), and commitment schemes with Common Reference String (CRS) assumptions, MPC function evaluations, and assumes the existence of asynchronous, authenticated broadcast channels. We achieve malicious security in a dishonest majority setting in the UC framework.

SmartAuction: A blockchain-based secure implementation of private data queries

A data marketplace provides a platform for data trading by bringing together data owners and data consumers with a data broker. Recent advancements in mechanism design of data marketplaces have introduced a number of private data query mechanisms that facilitate the trading of private data. A critical assumption to ensuring that these mechanisms function as intended in a real-world online platform, which is often overlooked in the mechanism design literature, is that they are implemented in a network infrastructure that guarantees secure and fair trade. Such a network infrastructure should allow data storage, communications and transactions to satisfy confidentiality, data integrity, fair brokerage, and privacy requirements. In this paper, we propose SmartAuction, the first blockchain-based secure implementation of a private data query system. SmartAuction utilises a public-key encryption scheme, a digital signature scheme and two smart contracts to facilitate the four tasks of a data trade: data submission, data request, auction and query, and payment and delivery. Using universal composability (UC) framework, we verify that SmartAuction satisfies the desirable properties mentioned above. We also conduct experiment to show that SmartAuction can be implemented in real Ethereum platforms and it has a broad applicability.

ZeroCross: A sidechain-based privacy-preserving Cross-chain solution for Monero

Sidechain-based Cross-chain exchange protocols enable payers to exchange cryptocurrencies among different blockchains via a sidechain. Many efforts, such as P2DEX (ACNS' 21), have been proposed to enhance cross-chain exchange privacy protection. However, existing sidechain-based cross-chain solutions for Monero on privacy concerns have limitations: requiring multiple pairs of parties paying simultaneously or fixed transaction amounts. This paper proposes ZeroCross, a novel privacy-preserving sidechain-based scheme that guarantees transaction unlinkability, exchanging fairness, and value confidentiality. ZeroCross designs: (i) a key exchange mechanism that guarantees exchanging fairness and (ii) a verification mechanism that utilizes CP-SNARK to ensure the transaction is confirmed without revealing the details of transactions. In addition, we discuss the influence of the remote side-channel attack in cross-chain exchange and the defence strategy. Finally, we prove the privacy and security of ZeroCross under the Universal Composability (UC) framework and evaluate the practical performance on computation and communication costs.

Accountable Private Set Cardinality for Distributed Measurement

We introduce cryptographic protocols for securely and efficiently computing the cardinality of set union and set intersection. Our private set-cardinality protocols ( PSC ) are designed for the setting in which a large set of parties in a distributed system makes observations, and a small set of parties with more resources and higher reliability aggregates the observations. PSC allows for secure and useful statistics gathering in privacy-preserving distributed systems. For example, it allows operators of anonymity networks such as Tor to securely answer the questions: How many unique users are using the network? and How many hidden services are being accessed? We prove the correctness and security of PSC in the Universal Composability framework against an active adversary that compromises all but one of the aggregating parties. Although successful output cannot be guaranteed in this setting, PSC either succeeds or terminates with an abort, and we furthermore make the adversary accountable for causing an abort by blaming at least one malicious party. We also show that PSC prevents adaptive corruption of the data parties from revealing past observations, which prevents them from being victims of targeted compromise, and we ensure safe measurements by making outputs differentially private. We present a proof-of-concept implementation of PSC and use it to demonstrate that PSC operates with low computational overhead and reasonable bandwidth. It can count tens of thousands of unique observations from tens to hundreds of data-collecting parties while completing within hours. PSC is thus suitable for daily measurements in a distributed system.

Pistis: Issuing Trusted and Authorized Certificates With Distributed Ledger and TEE

The security of HTTPS fundamentally relies on SSL/TLS certificates issued by Certificate Authorities (CAs), which, however, are vulnerable to be compromised to issue unauthorized certificates (i.e., certificates issued without domains’ permission). Current countermeasures such as Certificate Transparency (CT) can only detect unauthorized certificates rather than preventing them. In this article, we present <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Pistis</small> , a framework for issuing authorized and trusted certificates with the distributed ledger and Trusted Execution Environment (TEE) technology. In <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Pistis</small> , TEE nodes validate whether the domain in a requested certificate passes the domain ownership validation (i.e., under corresponding applicants’ control) and submit attested results to a smart contract in the distributed ledger. The smart contract issues a certificate to the applicant when an attested result shows a pass. Therefore, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Pistis</small> can ensure its issued certificates are authorized due to the domain ownership validation mechanism in the TEE. Furthermore, as the issued certificates are stored in a Merkle Patricia Tree (MPT) in <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Pistis</small> , they are trusted and can be verified by a normal user easily. The security of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Pistis</small> is formally proved in the Universally Composable (UC) framework. Compared with state-of-the-art, <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Pistis</small> avoids potential damages by preventing unauthorized certificates from issuing.

PUBA: Privacy-Preserving User-Data Bookkeeping and Analytics

Abstract In this paper we propose Privacy-preserving User-data Bookkeeping &amp; Analytics (PUBA), a building block destined to enable the implementation of business models (e.g., targeted advertising) and regulations (e.g., fraud detection) requiring user-data analysis in a privacy-preserving way. In PUBA, users keep an unlinkable but authenticated cryptographic logbook containing their historic data on their device. This logbook can only be updated by the operator while its content is not revealed. Users can take part in a privacy-preserving analytics computation, where it is ensured that their logbook is up-to-date and authentic while the potentially secret analytics function is verified to be privacy-friendly. Taking constrained devices into account, users may also outsource analytic computations (to a potentially malicious proxy not colluding with the operator).We model our novel building block in the Universal Composability framework and provide a practical protocol instantiation. To demonstrate the flexibility of PUBA, we sketch instantiations of privacy-preserving fraud detection and targeted advertising, although it could be used in many more scenarios, e.g. data analytics for multi-modal transportation systems. We implemented our bookkeeping protocols and an exemplary outsourced analytics computation based on logistic regression using the MP-SPDZ MPC framework. Performance evaluations using a smartphone as user device and more powerful hardware for operator and proxy suggest that PUBA for smaller logbooks can indeed be practical.

Denial-of-Service Vulnerability of Hash-based Transaction Sharding: Attack and Countermeasure

Since 2016, sharding has become an auspicious solution to tackle the scalability issue in legacy blockchain systems. Despite its potential to strongly boost the blockchain throughput, sharding comes with its own security issues. To ease the process of deciding which shard to place transactions, existing sharding protocols use a hash-based transaction sharding in which the hash value of a transaction determines its output shard. Unfortunately, we show that this mechanism opens up a loophole that could be exploited to conduct a single-shard flooding attack, a type of Denial-of-Service (DoS) attack, to overwhelm a single shard that ends up reducing the performance of the system as a whole. To counter the single-shard flooding attack, we propose a countermeasure that essentially eliminates the loophole by rejecting the use of hash-based transaction sharding. The countermeasure leverages the Trusted Execution Environment (TEE) to let blockchain's validators securely execute a transaction sharding algorithm with a negligible overhead. We provide a formal specification for the countermeasure and analyze its security properties in the Universal Composability (UC) framework. Finally, a proof-of-concept is developed to demonstrate the feasibility and practicality of our solution.

Integrating Threshold Opening With Threshold Issuance of Anonymous Credentials Over Blockchains for a Multi-Certifier Communication Model

Authentication while maintaining anonymity when availing a service over the internet is a significant privacy challenge. Anonymous credentials (AC) address this by providing the user with a credential issued by a trusted entity that convinces the service provider ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SP</i> ) that the user is authenticated but reveals no other information. The existing AC schemes assume a single trusted authority (certifier) that validates all the user attributes. In practice, however, a user may require different attributes to be attested by different certifiers. This means that the user has to get multiple credentials, increasing the burden on the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SP</i> who has to verify each one of them. Moreover, complete anonymity can be misused. We propose a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">decentralized threshold revocable anonymous credential (DTRAC)</i> scheme over blockchains that supports – a) attestation of attributes by multiple certifiers, and b) anonymity revocation through a set of distributed openers, by integrating threshold opening to the state-of-the-art threshold anonymous credential issuance scheme, Coconut [34]. DTRAC generates a single credential on attributes that are attested by multiple certifiers, freeing the SP from the hassle of verifying multiple credentials. We analyze the security of DTRAC formally in the universal composability (UC) framework. We also implement a prototype on Ethereum using smart contracts and give a detailed analysis of its performance.We compare the verification time for credentials with attributes attested by multiple certifiers in both DTRAC and Coconut and see that in terms of execution time and gas consumption, DTRAC performs significantly better than Coconut. It also scales better, with the performance gain of DTRAC over Coconut increasing linearly with the number of certifiers.

Toward Round-Efficient Verifiable Re-Encryption Mix-Net

Re-encryption mix-nets (RMNs) provide an efficient, cryptographic, anonymous channel for useful applications, such as e-voting and web browsing. Many studies have been devoted to achieving practically efficient RMN protocols, but less attention has been paid to addressing their round efficiency than to computation and communication measures. However, in many interactive cryptographic protocols, network latency governs the overall execution time. Because e-voting systems are particularly interaction intensive, the design of a round-efficient RMN protocol is of particular interest. We propose a constant-round RMN protocol in a three-party model that consists of senders, mix servers and some number of receivers. Here, the main role of the receivers is to jointly decrypt a list of ciphertexts obtained from the mixing stage. Such an explicit three-party model is most suitable for e-voting applications. We define an ideal three-party RMN in the universally composable (UC) framework. We then present a constant-round RMN protocol based on the standard assumptions and prove that it UC realizes the ideal three-party RMN with respect to a static adversary that can corrupt a minority of mix servers, disallowing receivers who collude with other players.We implement and evaluate our RMN protocol over various ranges of the numbers of senders and mix servers. Our evaluation shows that our protocol runs up to 2.5&#x00D7; faster than the Universal RMN protocol. In addition, we provide a detailed theoretical analysis of our protocol in terms of computation, transmission, and round efficiency.

Efficient Privacy-Preserving Outsourced Discrete Wavelet Transform in the Encrypted Domain

Signal processing in the encrypted domain is a potential tool to protect sensitive signals against untrusted cloud servers and malicious users in the delegated computing setting, without affecting the accuracy of signal analyzing and processing. Most existing approaches use Paillier's public key additively homomorphic encryption to encrypt each signal in a large bundle; thus, incurring significant computational costs at local, often resource-constrained, devices while guaranteeing only signal input privacy. To address these limitations, in this paper, an efficient privacy-preserving outsourced discrete wavelet transform scheme (PPDWT), comprising PPDWT-1 and PPDWT-2, without leveraging public key (fully) homomorphic encryption is proposed. Specifically, they are respectively proposed to achieve signal input privacy, coefficient privacy and discrete wavelet transform result privacy against the collusion between honest-but-curious cloud and malicious users. Both constructions leverage the offline execution of any one-way trapdoor permutation only once to encrypt batch signals, and permit signal processing in the encrypted domain. We also discuss the expanding factor, the upper bound and various extensions to privacy-preserving discrete cosine/fourier transform in the encrypted domain. Finally, our proposed PPDWT is formally proved secure under the universal composability (UC) model. We then evaluate the proposed approach using case studies to demonstrate its effectiveness and practicability.

Privacy-preserving FairSwap: Fairness and privacy interplay

Abstract Fair exchange protocols are among the most important cryptographic primitives in electronic commerce. A basic fair exchange protocol requires that two parties who want to exchange their digital items either receive what they have been promised, or lose nothing. Privacy of fair exchange requires that no one else (other than the two parties) learns anything about the items. Fairness and privacy have been considered as two distinct properties of an exchange protocol. In this paper, we show that subtle ways of leaking the exchange item to the third parties affect fairness in fair exchange protocols when the item is confidential. Our focus is on Fair-Swap, a recently proposed fair exchange protocol that uses a smart contract for dispute resolution, has proven security in UC (Universal Composability) framework, and provides privacy when both parties are honest. We demonstrate, however, that FairSwap’s dispute resolution protocol leaks information to the public and this leakage provides opportunities for the dishonest parties to influence the protocol’s fairness guarantee. We then propose an efficient privacy-enhanced version of Fair-Swap, prove its security and give an implementation and performance evaluation of our proposed system. Our privacy enhancement uses circuit randomization, and we prove its security and privacy in an extension of universal composability model for non-monolithic adversaries that would be of independent interest.

Postquantum Cut-and-Choose Oblivious Transfer Protocol Based on LWE

We propose postquantum universal composable (UC) cut-and-choose oblivious transfer (CCOT) protocol under the malicious adversary model. In secure two-party computation, we construct s copies’ garbled circuits, including half check circuit and half evaluation circuit. The sender can transfer the key to the receiver by CCOT protocol. Compared to PVW-OT [6] framework, we invoke WQ-OT [35] framework with reusability of common random string ( crs ) and better security. Relying on LWE’s assumption and the property of the Rounding function, we construct an UC-CCOT protocol, which can resist quantum attack in secure two-party computation.

Fair and Secure Multi-Party Computation with Cheater Detection

Secure multi-party computation (SMC) is a cryptographic protocol that allows participants to compute the desired output without revealing their inputs. A variety of results related to increasing the efficiency of SMC protocol have been reported, and thus, SMC can be used in various applications. With the SMC protocol in smart grids, it becomes possible to obtain information for load balancing and various statistics, without revealing sensitive user information. To prevent malicious users from tampering with input values, SMC requires cheater detection. Several studies have been conducted on SMC with cheater detection, but none of these has been able to guarantee the fairness of the protocol. In such cases, only a malicious user can obtain a correct output prior to detection. This can be a critical problem if the result of the computation is real-time information of considerable economic value. In this paper, we propose a fair and secure multi-party computation protocol, which detects malicious parties participating in the protocol before computing the final output and prevents them from obtaining it. The security of our protocol is proven in the universal composability framework. Furthermore, we develop an enhanced version of the protocol that is more efficient when computing an average after detecting cheaters. We apply the proposed protocols to a smart grid as an application and analyze their efficiency in terms of computational cost.