Adaptive versus Static Security in the UC Model

Abstract

Abstract. We show that for certain class of unconditionally secure protocols and target functionalities, static security implies adaptive security in the UC model. Similar results were previously only known for models with weaker security and/or composition guarantees. The result is, for instance, applicable to a wide range of protocols based on secret sharing. It "explains" why an often used proof technique for such protocols works, namely where the simulator runs in its head a copy of the honest players using dummy inputs and generates a protocol execution by letting the dummy players interact with the adversary. When a new player Pi is corrupted, the simulator adjusts the state of its dummy copy of Pi to be consistent with the real inputs and outputs of Pi and gives the state to the adversary. Our result gives a characterization of the cases where this idea will work to prove adaptive security. As a special case, we use our framework to give the first proof of adaptive security of the seminal BGW protocol in the UC framework.

Fine-Grained Trackability in Protocol Executions

“…Firstly, one of the above trackability attack strategies has to be implemented in a model in a trace-based verification tool. On the one hand, selective blocking comes almost for free in any DY [20] tool: the attacker can and will try to block any message, and the "selective" nature is achieved by writing a model with a set of rules, restrictions and/or predicates, which quantify over a particular ID whose messages were "selectively" blocked 18 . On the other hand, forced conditions are implicitly implemented in any DY tool: the DY attacker will try arbitrary inputs forcing both the if and the else branch of all protocol tests.…”

“…We use the terminology of "static" and "adaptive" attackers as per the usual ways in security[18]. Therein, adaptive attackers can change behaviour during their attack.…”

Foundations of Programmable Secure Computation

“…As a result, different sharings are independent from each other and it is sufficient to prove simulatability of a single sharing. In case of adaptive corruption, the secret sharing scheme must be efficiently patchable [56] as the simulator must progressively disclose shares of an unknown value. The existence of trusted setup F allows to achieve integrity even for honest minority.…”