Astrolabous: A Universally Composable Time-Lock Encryption Scheme

Abstract

In this work, we study the cryptographic primitive called time-lock encryption (TLE). The concept of TLE involves a party initiating the encryption of a message that one can only decrypt after a certain amount of time has elapsed. Following the universal composability (UC) paradigm introduced by Canetti [IEEE FOCS 2001], we formally abstract the concept of TLE into an ideal functionality in a flexible way. In addition, we provide a standalone definition for secure TLE schemes in a game-based style and we devise a hybrid protocol that relies on such a secure TLE scheme. We show that if the underlying TLE scheme satisfies the standalone game-based security definition, then our hybrid protocol UC realises the TLE functionality in the random oracle model. Finally, we present Astrolabous, a TLE construction that satisfies our security definition, leading to the first UC realization of the TLE functionality. Interestingly, it is hard to prove UC secure any of the TLE construction proposed in the literature. The reason behind this difficulty relates to the UC framework itself. Intuitively, to capture semantic security, no information should be leaked regarding the plaintext in the ideal world, thus the ciphertext should not contain any information relating to the message. On the other hand, all ciphertexts will eventually open, resulting in a trivial distinction of the real from the ideal world in the standard model. We overcome this limitation by extending any secure TLE construction adopting the techniques of Nielsen [CRYPTO 2002] in the random oracle model. Specifically, the description of the extended TLE algorithms includes calls to the random oracle, allowing our simulator to equivocate. This extension can be applied to any TLE algorithm that satisfies our standalone game-based security definition, and in particular to Astrolabous.

Universally Composable Simultaneous Broadcast against a Dishonest Majority and Applications

“…Although using a programmable RO is standard to enable equivocation in simulation-based security (e.g., in [2,4,10,22]), TLE with adaptive UC security is not available in the literature. To construct it, we rely on the findings of the following papers: (1) The work of Arapinis et al [2] that provides a UC treatment of TLE and a protocol that is secure against a static adversary. (2) The work of Cohen et al [10] that studies the concept of broadcast and fairness in the context of resource-restricted cryptography [14].…”

“…The weaker notion of unfair broadcast [19] can be realized by the Dolev-Strong protocol [11] against 𝑡 < 𝑛 adaptive corruptions. Compared to [2] and [10], we take the following steps: first, we adapt the fair broadcast (FBC) and unfair broadcast (UBC) functionalities in [10] to the UC setting, where multiple senders may perform many broadcasts per round. Then, similar to [2,3,14], we model resource-restriction in UC via wrapper that allows all parties to perform up to a number of RO queries per round.…”

“…Compared to [2] and [10], we take the following steps: first, we adapt the fair broadcast (FBC) and unfair broadcast (UBC) functionalities in [10] to the UC setting, where multiple senders may perform many broadcasts per round. Then, similar to [2,3,14], we model resource-restriction in UC via wrapper that allows all parties to perform up to a number of RO queries per round. Next, we revisit the FBC protocol in [10] by using the TLE algorithms of [2] instead of an arbitrary time-lock puzzle and show that our instantiation UC-realizes our FBC functionality.…”

“…Then, similar to [2,3,14], we model resource-restriction in UC via wrapper that allows all parties to perform up to a number of RO queries per round. Next, we revisit the FBC protocol in [10] by using the TLE algorithms of [2] instead of an arbitrary time-lock puzzle and show that our instantiation UC-realizes our FBC functionality. Finally, we prove that by deploying the TLE protocol of [2] over our FBC functionality is sufficient to provide an adaptively secure realization of the TLE functionality in [2].…”

“…Next, we revisit the FBC protocol in [10] by using the TLE algorithms of [2] instead of an arbitrary time-lock puzzle and show that our instantiation UC-realizes our FBC functionality. Finally, we prove that by deploying the TLE protocol of [2] over our FBC functionality is sufficient to provide an adaptively secure realization of the TLE functionality in [2]. We view the construction of the first adaptively UC secure TLE protocol as a contribution of independent interest.…”