A Framework for Universally Composable Diffie-Hellman Key Exchange

Küsters, Ralf; Rausch, Daniel

doi:10.1109/sp.2017.63

Cited by 17 publications

(29 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…For example, a secure channel protocol might use a key exchange protocol or an authenticated channel as a subprotocol, and cryptographic primitives (such as encryption or digital signatures) could be modeled as subprotocols (see Sect. 10.4 and [25,28,29]).…”

Section: Subprotocols and Ideal Functionalitiesmentioning

confidence: 94%

“…Q and E | Q such that corresponding runs produce the same output and have the same probability of occurring. 25 Since, by assumption, Q is environmentally strictly bounded, there exists a polynomial p in the security parameter plus the length of the external input such that for all runs of E | Q the number of steps taken by Q is bounded by p. It follows that there exists a polynomial p such that for every run of E | ! Q the number of steps taken by the session invoked by E (i.e., the overall number of steps taken by machines in mode Compute belonging to that session) in this run is bounded p .…”

Section: On the Composability Of Environmentally Strictly Bounded Sysmentioning

confidence: 98%

“…Furthermore, the multi-session version of the multi-session version of Q, i.e., ! Q-in this system 25 Here we use that Q is a protocol system, in particular Condition (ii) of Definition 11. Without this condition, there could be several copies of a machine in !…”

Section: On the Composability Of Environmentally Strictly Bounded Sysmentioning

confidence: 99%

“…In Sect. 10.4, we present concrete protocols and functionalities and illustrate how they can be modeled in the IITM model (see also, e.g., [3,[25][26][27][28][29][30] for other examples). In Sect.…”

Section: Instantiation Of the Iitm Modelmentioning

confidence: 99%

“…As further discussed in [28], this allows for a faithful analysis of protocols that do not use pre-established SIDs, which is the case for most real-world authentication, key exchange, and secure channel protocols. This approach has been successfully used in [25] to faithfully model and analyze several key exchange protocols from practice that do not pre-establish global SIDs.…”

Section: Addressing Of Multiple Sessions Of Idealmentioning

confidence: 99%

See 4 more Smart Citations

The IITM Model: A Simple and Expressive Model for Universal Composability

2020

Self Cite

View full text Add to dashboard Cite

The universal composability paradigm allows for the modular design and analysis of cryptographic protocols. It has been widely and successfully used in cryptography. However, devising a coherent yet simple and expressive model for universal composability is, as the history of such models shows, highly non-trivial. For example, several partly severe problems have been pointed out in the literature for the UC model. In this work, we propose a coherent model for universal composability, called the IITM model (“Inexhaustible Interactive Turing Machine”). A main feature of the model is that it is stated without a priori fixing irrelevant details, such as a specific way of addressing of machines by session and party identifiers, a specific modeling of corruption, or a specific protocol hierarchy. In addition, we employ a very general notion of runtime. All reasonable protocols and ideal functionalities should be expressible based on this notion in a direct and natural way, and without tweaks, such as (artificial) padding of messages or (artificially) adding extra messages. Not least because of these features, the model is simple and expressive. Also the general results that we prove, such as composition theorems, hold independently of how such details are fixed for concrete applications. Being inspired by other models for universal composability, in particular the UC model and because of the flexibility and expressivity of the IITM model, conceptually, results formulated in these models directly carry over to the IITM model.

show abstract

Section: Subprotocols and Ideal Functionalitiesmentioning

confidence: 94%

Section: On the Composability Of Environmentally Strictly Bounded Sysmentioning

confidence: 98%

Section: On the Composability Of Environmentally Strictly Bounded Sysmentioning

confidence: 99%