= Cryptographic environment
A \b[cryptographic environment] is the interactive external context used to judge a <cryptographic protocol> in <universal composability>. It supplies honest parties' inputs, observes their outputs, communicates with the adversary, and ultimately outputs a decision bit. The comparison asks whether this bit's <probability distribution> changes detectably between the real execution and an ideal execution with a <cryptographic simulator>.<Universally Composable Security: A Tutorial by Ran Canetti>[PDF pp. 20–24, execution model, protocol emulation and quantitative formulation]{ref}
\Image[/uc-real-ideal-experiments.png]
{title=The same cryptographic environment observes either a real protocol and adversary or an ideal service and simulator. Honest-party forwarding is collapsed into the ideal-service box.}
The <cryptographic environment> models other software using the service, including choices depending on earlier outputs. It can retain private information with which to check later responses. Its view therefore includes the relationship between inputs, outputs and adversarial messages, not just isolated packet statistics.
An original two-bit example shows why that relationship matters. Let $B$ be a <random variable> with the <uniform distribution on a finite set> $\{0,1\}$. One system returns $(B,B)$; another returns $(B,C)$ with $C$ an independent uniform bit. Each individual coordinate has the same <marginal distribution> in both systems. Nevertheless, the test “accept exactly when the two bits agree” has acceptance probabilities
$$
\Pr[B=B]=1,\qquad \Pr[B=C]=\tfrac12.
$$
Its <cryptographic distinguishing advantage> is $1/2$. Matching each output's marginal does not match their <joint probability distribution>. An interactive <cryptographic environment> can perform corresponding consistency checks against its retained inputs.
In the computational definition, the <cryptographic environment> has the specified <polynomial time> bound indexed by the <cryptographic security parameter>. For each real adversary, one <cryptographic simulator> must handle every allowed <cryptographic environment>; choosing a new simulator after learning which particular context will test it changes the requirement.<Universally Composable Security: A Tutorial by Ran Canetti>[PDF p. 23, quantifier order; pp. 74–76, general formulation and restrictions]{ref}
This breadth explains the usefulness of <universal composability>: a service can be analysed within a larger application context. The conclusion still concerns the interactions and <cryptographic leakage> admitted by the stated execution model.
Back to article page
