Time-Bounded Task-PIOAs: A Framework for Analyzing Security Protocols

Abstract

We present the Time-Bounded Task-PIOA modeling framework, an extension of the Probabilistic I/O Automata (PIOA) framework that is intended to support modeling and verification of security protocols. Time-Bounded Task-PIOAs directly model probabilistic and nondeterministic behavior, partial-information adversarial scheduling, and time-bounded computation. Together, these features are adequate to support modeling of key aspects of security protocols, including secrecy requirements and limitations on the knowledge and computational power of adversarial parties. They also support security protocol verification, using methods that are compatible with informal approaches used in the computational cryptography research community. We illustrate the use of our framework by outlining a proof of functional correctness and security properties for a well-known Oblivious Transfer protocol.

Input-Aware Equivocable Commitments and UC-secure Commitments with Atomic Exchanges

“…The next step of the simulation defines from state the last algorithm that S * would have sent to F atomic such that A(state,X 0 ; r A ) would produce (X, X ), using solely on the view of A since in fact X, X should be the output m of F atomic . By the assumptions we use, we now have another algorithm E(state,X 0 ; r A ) that yields x such that X = g x or R COM aborts 7 . Thus, our constructed I can simply run E(state,X 0 ; r A ) by using the view of S * .…”

Threshold Homomorphic Encryption in the Universally Composable Cryptographic Library

“…Such assumptions on the idealprocess adversary are relatively wide-spread, but little-researched. They appeared already in the original report introducing universal composability [19], where the ideal signature functionality F SIG assumed the adversary to return a bit-string representing the signature when asked so. The rationale of putting such restrictions on the ideal adversary are twofold.…”

Several Weak Bit-Commitments Using Seal-Once Tamper-Evident Devices

“…Most of the recent approaches to primitive-construction employ the universal composability (UC) framework [6] in order to specify and prove the correctness/security of their cryptographic designs. The UC framework is a formalism that allows for cryptographic protocols to be computationally analysed in a single session, yet the security guarantees thereby obtained are preserved when multiple sessions are composed concurrently, in parallel and/or sequentially.…”

“…The UC framework is a formalism that allows for cryptographic protocols to be computationally analysed in a single session, yet the security guarantees thereby obtained are preserved when multiple sessions are composed concurrently, in parallel and/or sequentially. See Appendix A, for a short wrap-up on UC frameworks [6,8] and UC proofs. In [6], Canetti shows that any polynomial-time multi-party functionality is feasible in the UC framework if the majority of participants are honest.…”

“…See Appendix A, for a short wrap-up on UC frameworks [6,8] and UC proofs. In [6], Canetti shows that any polynomial-time multi-party functionality is feasible in the UC framework if the majority of participants are honest. Otherwise, feasibility is usually attained if the models are augmented with "setup-assumptions", obtaining the so-called "UC hybrid models" (i.e., extra ideal functionalities are made available to the parties).…”