Paper 2025/934

Diving Deep Into UC: Uncovering and Resolving Issues in Universal Composability

Abstract

Introduced by Canetti in 2001, Universal Composability (UC) is a widely adopted security model that enables the specification and proof of security for a broad range of protocols, offering strong security guarantees. At its core lies the universal composition theorem (UC theorem), which ensures that protocols proven secure within the framework remain secure even when deployed in real-world environments with multiple instances of them. In this work, we present two key contributions. First, we identify several problems with the UC framework, in particular the UC Theorem. They include counterexamples, limitations that make it unusable for important classes of protocols, and weaknesses in its proof. These problems reveal flaws in nearly all the fundamental concepts of UC. Second, we propose a revised formulation of the main concepts of UC to address these issues. Although the resulting modifications are nontrivial, our updated definitions are designed to remain as faithful as possible to the structure and intent of the original model.

Note: This is an extended version of the article accepted and published in Volume~3, Issue~1 of IACR Communications in Cryptology. The main change in this version is the addition of Appendices~C, D, and~E, which provide missing proofs, constructions, and descriptions of issues. Note relative to previous ePrint versions. While most technical details were already present in the previous version, the present version includes numerous editorial improvements, as well as a change of template.