2

I was learning about composable security frameworks, and I was wondering about the following when I was learning about Constructive Cryptography here (https://youtu.be/l7vyzRtLQCM?feature=shared&t=1143):

Here, we are in the Alice-Bob-Eve setting. Alice wants to send a message to Bob, and Eve is adversarial. Moreover, let:

  • AUT - Authenticated channel between Alice and Bob, where Eve can learn everything that is sent, but cannot modify the message.
  • KEY - Generates a key which is shared with Alice and Bob. Eve learns nothing
  • SECURE - A secure channel between Alice and Bob, where Eve learns when a message is sent and the length of the message sent.

We have the following constructions -

  • AUT || KEY ---> SECURE // Using OTP encryption and decryption, for example
  • AUT ---> KEY // Using DH key exchange, for example

Therefore, we have the following construction: AUT || AUT ---> SECURE

In other words, if we have two authenticated channels, we can construct a secure channel.

On the other hand, in practice, there is one internet, where Alice, Bob, and Eve are attached... Can we formally say that we can construct infinitely many authenticated channels using an authenticated internet?? Something like:

  • Internet ---> AUT || Internet // We can get an Authenticated channel 'for free'

A related question is this - suppose we have an MPC system A, and another MPC system B. Is the parallel composition of A and B supposed to have 2 private networks? In practice though, we have one internet. What is the soundness argument in this case?

Moreover, I think that there might be situations where the underlying resource has nontrivial state. I was wondering how one might model the situation in this case, in both UC and CC?

Suraaj K S
  • 232
  • 1
  • 7

1 Answers1

1

No, you can't.

If Alice and Bob do not share any kind of common trust anchor, you can not create an authenticated channel. A trust anchor in this case could be a 3rd party, a PKI, a shared secret, etc.

If there is nothing in place, trust can not be established out of thin air. Neither Alice nor Bob will actually know any way to authenticate the other party - or who the other party is.

Side note: You do not need two separate authenticated channels to establish a secure channel. In the rules you states, 'AUT||AUT' can also be the same channel. But in a sequence diagram you first need the key exchange, and then you can establish a secure channel with both the authenticated channel and the shared key.

tylo
  • 12,864
  • 26
  • 40