### Universally Composable Subversion-Resilient Cryptography

Suvradip Chakraborty, Bernardo Magri, Jesper Buus Nielsen, and Daniele Venturi

##### Abstract

Subversion attacks undermine security of cryptographic protocols by replacing a legitimate honest party's implementation with one that leaks information in an undetectable manner. An important limitation of all currently known techniques for designing cryptographic protocols with security against subversion attacks is that they do not automatically guarantee security in the realistic setting where a protocol session may run concurrently with other protocols. We remedy this situation by providing a foundation of *reverse firewalls* (Mironov and Stephens-Davidowitz, EUROCRYPT'15) in the *universal composability* (UC) framework (Canetti, FOCS'01 and J. ACM'20). More in details, our contributions are threefold: - We generalize the UC framework to the setting where each party consists of a core (which has secret inputs and is in charge of generating protocol messages) and a firewall (which has no secrets and sanitizes the outgoing/incoming communication from/to the core). Both the core and the firewall can be subject to different flavors of corruption, modeling different kinds of subversion attacks. For instance, we capture the setting where a subverted core looks like the honest core to any efficient test, yet it may leak secret information via covert channels (which we call *specious subversion*). - We show how to sanitize UC commitments and UC coin tossing against specious subversion, under the DDH assumption. - We show how to sanitize the classical GMW compiler (Goldreich, Micali and Wigderson, STOC 1987) for turning MPC with security in the presence of semi-honest adversaries into MPC with security in the presence of malicious adversaries. This yields a completeness theorem for maliciously secure MPC in the presence of specious subversion. Additionally, all our sanitized protocols are *transparent*, in the sense that communicating with a sanitized core looks indistinguishable from communicating with an honest core. Thanks to the composition theorem, our methodology allows, for the first time, to design subversion-resilient protocols by sanitizing different sub-components in a modular way.

Available format(s)
Category
Cryptographic protocols
Publication info
A major revision of an IACR publication in EUROCRYPT 2022
Keywords
subversionreverse firewallsuniversal composability
Contact author(s)
suvradip chakraborty @ inf ethz ch
bernardo magri @ manchester ac uk
jbn @ cs au dk
venturi @ di uniroma1 it
History
Short URL
https://ia.cr/2022/244

CC BY

BibTeX

@misc{cryptoeprint:2022/244,
author = {Suvradip Chakraborty and Bernardo Magri and Jesper Buus Nielsen and Daniele Venturi},
title = {Universally Composable Subversion-Resilient Cryptography},
howpublished = {Cryptology ePrint Archive, Paper 2022/244},
year = {2022},
note = {\url{https://eprint.iacr.org/2022/244}},
url = {https://eprint.iacr.org/2022/244}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.