Paper 2026/1190

CMoSS: Composable Modular Security Specifications Framework

Sara Wrótniak, University of Connecticut
Hemi Leibowitz, The College of Management Academic Studies
Ewa Syta, Trinity College
Amir Herzberg, University of Connecticut
Abstract

CMoSS facilitates modular specifications, design and analysis of cryptographic protocols. Modular design and analysis is achieved by supporting provably-secure compositions of protocols; typically, a protocol uses a blackbox subprotocol, and is proven secure when composed with any subprotocol meeting the blackbox specifications. For modularity of specifications, CMoSS extends the approach of the MoSS framework: protocol specifications are defined modularly, by a set of independent predicates (games) for each model (assumption) and requirement (goal). CMoSS makes it feasible to rigorously specify, develop and analyze realistic applied cryptographic protocols, supporting real-time concurrency and involving different attacker capabilities, delays, faults and synchronization challenges. CMoSS specifications provide a precise formalization of the informal specifications used by practitioners, facilitating provable security for practical protocols.

Metadata
Available format(s)
PDF
Category
Foundations
Publication info
Preprint.
Keywords
provable securityprotocolsspecificationscompositionmodular
Contact author(s)
sara wrotniak @ uconn edu
menahemle @ colman ac il
ewa syta @ trincoll edu
amir herzberg @ uconn edu
History
2026-06-10: approved
2026-06-07: received
See all versions
Short URL
https://ia.cr/2026/1190
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2026/1190,
      author = {Sara Wrótniak and Hemi Leibowitz and Ewa Syta and Amir Herzberg},
      title = {{CMoSS}: Composable Modular Security Specifications Framework},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/1190},
      year = {2026},
      url = {https://eprint.iacr.org/2026/1190}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.