Cryptology ePrint Archive: Report 2022/244

Universally Composable Subversion-Resilient Cryptography

Suvradip Chakraborty and Bernardo Magri and Jesper Buus Nielsen and Daniele Venturi

Abstract: Subversion attacks undermine security of cryptographic protocols by replacing a legitimate honest party's implementation with one that leaks information in an undetectable manner. An important limitation of all currently known techniques for designing cryptographic protocols with security against subversion attacks is that they do not automatically guarantee security in the realistic setting where a protocol session may run concurrently with other protocols.

We remedy this situation by providing a foundation of *reverse firewalls* (Mironov and Stephens-Davidowitz, EUROCRYPT'15) in the *universal composability* (UC) framework (Canetti, FOCS'01 and J. ACM'20). More in details, our contributions are threefold:

- We generalize the UC framework to the setting where each party consists of a core (which has secret inputs and is in charge of generating protocol messages) and a firewall (which has no secrets and sanitizes the outgoing/incoming communication from/to the core). Both the core and the firewall can be subject to different flavors of corruption, modeling different kinds of subversion attacks.

For instance, we capture the setting where a subverted core looks like the honest core to any efficient test, yet it may leak secret information via covert channels (which we call *specious subversion*).

- We show how to sanitize UC commitments and UC coin tossing against specious subversion, under the DDH assumption.

- We show how to sanitize the classical GMW compiler (Goldreich, Micali and Wigderson, STOC 1987) for turning MPC with security in the presence of semi-honest adversaries into MPC with security in the presence of malicious adversaries. This yields a completeness theorem for maliciously secure MPC in the presence of specious subversion.

Additionally, all our sanitized protocols are *transparent*, in the sense that communicating with a sanitized core looks indistinguishable from communicating with an honest core. Thanks to the composition theorem, our methodology allows, for the first time, to design subversion-resilient protocols by sanitizing different sub-components in a modular way.

Category / Keywords: cryptographic protocols / subversion, reverse firewalls, universal composability

Original Publication (with major differences): IACR-EUROCRYPT-2022

Date: received 25 Feb 2022

Contact author: suvradip chakraborty at inf ethz ch, bernardo magri at manchester ac uk, jbn at cs au dk, venturi at di uniroma1 it

Available format(s): PDF | BibTeX Citation

Version: 20220302:135430 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]