Deniable Authentication on the Internet
Information Security and Cryptology
Local Sequentiality Does Not Help for Concurrent Composition
CT-RSA '09 Proceedings of the The Cryptographers' Track at the RSA Conference 2009 on Topics in Cryptology
A Framework for Universally Composable Non-committing Blind Signatures
ASIACRYPT '09 Proceedings of the 15th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Deniable internet key exchange
ACNS'10 Proceedings of the 8th international conference on Applied cryptography and network security
Information-Theoretically Secure Protocols and Security under Composition
SIAM Journal on Computing
A framework for universally composable non-committing blind signatures
International Journal of Applied Cryptography
A framework for universally composable non-committing blind signatures
International Journal of Applied Cryptography
A unified framework for UC from only OT
ASIACRYPT'12 Proceedings of the 18th international conference on The Theory and Application of Cryptology and Information Security
Non-black-box simulation in the fully concurrent setting
Proceedings of the forty-fifth annual ACM symposium on Theory of computing
Secure outsourced garbled circuit evaluation for mobile devices
SEC'13 Proceedings of the 22nd USENIX conference on Security
Hi-index | 0.00 |
In the setting of concurrent self composition, a single protocol is executed many times concurrently in a network. In this paper, we prove lower bounds and impossibility results for secure protocols in this setting. First and foremost, we prove that there exist large classes of functionalities that cannot be securely computed under concurrent self composition, by any protocol. We also prove a communication complexity lower bound on protocols that securely compute a large class of functionalities in this setting. Specifically, we show that any protocol that computes a functionality from this class and remains secure for m concurrent executions, must have bandwidth of at least m bits. The above results are unconditional and hold for any type of simulation (i.e., even for non-black-box simulation). In addition, we prove a severe lower bound on protocols that are proven secure using black-box simulation. Specifically, we show that any protocol that computes the blind signature or oblivious transfer functionalities and remains secure for m concurrent executions, where security is proven via black-box simulation, must have at least m rounds of communication. Our results hold for the plain model, where no trusted setup phase is assumed. While proving our impossibility results, we also show that for many functionalities, security under concurrent self composition (where a single secure protocol is run many times) is actually equivalent to the seemingly more stringent requirement of security under concurrent general composition (where a secure protocol is run concurrently with other arbitrary protocols). This observation has significance beyond the impossibility results that are derived by it for concurrent self composition.