= Universal composability
\b[Universal composability] is a framework for specifying and proving security of <cryptographic protocols> so that their guarantees survive the framework's protocol-composition operation. It compares a real implementation with an <ideal cryptographic functionality> describing the intended service, permitted leakage and adversarial influence. <Ran Canetti>'s primary work develops the composition guarantee, including concurrent executions.<Universally Composable Security: A New Paradigm for Cryptographic Protocols by Ran Canetti>[Abstract, modular analysis and universal composition; version history]{ref}
The comparison uses a <cryptographic simulator> in the ideal execution and a <cryptographic environment> trying to distinguish the executions. Schematically, in the computational formulation,
$$
\forall A\ \exists S\ \forall Z:\quad
\operatorname{Exec}_{\pi,A,Z}(1^\lambda,z)
\mathrel{\approx_c}
\operatorname{Exec}_{\mathcal F,S,Z}(1^\lambda,z).
$$
Here $A$ is the real adversary, $S$ the simulator, $Z$ the environment, $z$ an auxiliary input and $\lambda$ the <cryptographic security parameter>. The participants have the specified computational bounds, and $\approx_c$ denotes <computational indistinguishability>. The simulator is chosen for the adversary before universally quantifying over environments; a different simulator chosen after seeing each environment would be a weaker requirement.<Universally Composable Security: A Tutorial by Ran Canetti>[PDF pp. 23–25, protocol emulation and ideal functionalities; pp. 74–76, general formulation and technical restrictions]{ref}
An original distinguishing example shows why permitted leakage belongs in the specification. Suppose an ideal channel hides a message's length before delivery, but a proposed real implementation exposes that length. An environment privately selects a uniform bit $b$ and supplies an honest sender a one-byte message if $b=0$ or a two-byte message if $b=1$. It asks the adversary to guess $b$ before the honest recipient supplies any output. Visible length lets a real adversary guess perfectly. An ideal simulator receiving no length or content information can guess only with probability $1/2$. The environment accepts when the guess equals its private bit, giving a probability gap $1/2$.
That mismatch can be addressed by changing the implementation, for example with suitable padding, or by specifying the intended length leakage in the ideal service. The two choices describe different security properties. Correctly delivering messages does not by itself resolve the distinction.
The composition theorem permits replacing an ideal-service call by a protocol that realizes that service, under the theorem's interface and execution-model conditions. This supports modular proofs: a larger protocol need not reanalyse the lower-level implementation from scratch.<Universally Composable Security: A Tutorial by Ran Canetti>[PDF pp. 48–49, universal composition theorem and quantitative version]{ref} The guarantee belongs to the modelled setup, identities and allowed interactions; an isolated confidentiality game is not automatically a proof of universal composability.
Back to article page
