Universal composability

Universal composability is a framework for specifying and proving security of cryptographic protocols so that their guarantees survive the framework's protocol-composition operation. It compares a real implementation with an ideal cryptographic functionality describing the intended service, permitted leakage and adversarial influence. Ran Canetti's primary work develops the composition guarantee, including concurrent executions.^[ref]

The comparison uses a cryptographic simulator in the ideal execution and a cryptographic environment trying to distinguish the executions. Schematically, in the computational formulation,Here $A$ is the real adversary, $S$ the simulator, $Z$ the environment, $z$ an auxiliary input and $\lambda$ the cryptographic security parameter. The participants have the specified computational bounds, and ${\approx }_c$ denotes computational indistinguishability. The simulator is chosen for the adversary before universally quantifying over environments; a different simulator chosen after seeing each environment would be a weaker requirement.^[ref]

An original distinguishing example shows why permitted leakage belongs in the specification. Suppose an ideal channel hides a message's length before delivery, but a proposed real implementation exposes that length. An environment privately selects a uniform bit $b$ and supplies an honest sender a one-byte message if $b=0$ or a two-byte message if $b=1$. It asks the adversary to guess $b$ before the honest recipient supplies any output. Visible length lets a real adversary guess perfectly. An ideal simulator receiving no length or content information can guess only with probability $1/2$. The environment accepts when the guess equals its private bit, giving a probability gap $1/2$.

That mismatch can be addressed by changing the implementation, for example with suitable padding, or by specifying the intended length leakage in the ideal service. The two choices describe different security properties. Correctly delivering messages does not by itself resolve the distinction.

The composition theorem permits replacing an ideal-service call by a protocol that realizes that service, under the theorem's interface and execution-model conditions. This supports modular proofs: a larger protocol need not reanalyse the lower-level implementation from scratch.^[ref] The guarantee belongs to the modelled setup, identities and allowed interactions; an isolated confidentiality game is not automatically a proof of universal composability.