The number as well as the complexity of the cryptographic protocols that are used in practice has increased substantially in the last few years. Unfortunately, cryptographic protocols used in practice often do not come with proper security proofs but rather with hand wavy arguments that they will fulfill their requirements. In the past two decades, the cryptographic community has made substantial progress in modeling cryptographic protocols and proving their security: a number of security frameworks have emerged that guarantee that a cryptographic protocol remains secure under composition, i.e., it remains secure no matter in what environment it is used. While this is the kind of security guarantee that is needed for all cryptographic protocols and in particular those used in practice, protocols designed in these composable security frameworks tend to be not sufficiently efficient to be usable in practice.

The main goal of this Dagstuhl Seminar is to assess the state of the art of the design, modeling, and security analysis of cryptographic protocols and to identify new approaches and directions that allow one to design cryptographic protocols that are efficient and yet offer the strongest security guarantees. To this end, we aim to identify hurdles preventing provably secure protocols from being efficient, and to compare the different composability frameworks proposed in the literature with respect to their ability to analyze practical protocols.

The topics to be considered in more detail in the seminar include the following ones:

• Design of practical yet provably secure cryptographic protocols
• Identification of hurdles for achieving efficient and provable UC security, identification of solutions
• Modeling and comparison of different set-up assumptions and their implications
• Comparison of the different composability frameworks

We plan to strike a balance between talks and open discussion sessions in order to identify and ignite future research towards security composition frameworks that facilitate the design and analysis of efficient cryptographic protocols. In accordance with the philosophy of Dagstuhl Seminars, we want to provide an inspiring environment for thought and discussion.

Creative Commons BY 3.0 DE

Jan Camenisch, Ralf Küsters, Anna Lysyanskaya, and Alessandra Scafuro

• Jan Camenisch (Dfinity Foundation - Zug, CH) [dblp]
• Ran Canetti (Tel Aviv University, IL) [dblp]
• Celine Chevalier (University Paris II, FR) [dblp]
• Ran Cohen (MIT - Cambridge, US) [dblp]
• Manu Drijvers (Dfinity - Zürich, CH) [dblp]
• Marc Fischlin (TU Darmstadt, DE) [dblp]
• Dov Gordon (George Mason University - Fairfax, US) [dblp]
• Jens Groth (London, GB) [dblp]
• Timo Hanke (Dfinity Foundation - Zug, CH) [dblp]
• Dennis Hofheinz (KIT - Karlsruher Institut für Technologie, DE) [dblp]
• Markulf Kohlweiss (University of Edinburgh, GB) [dblp]
• Stephan Krenn (AIT - Austrian Institute of Technology - Wien, AT) [dblp]
• Ralf Küsters (Universität Stuttgart, DE) [dblp]
• Anna Lysyanskaya (Brown University - Providence, US) [dblp]
• Mary Maller (University College London, GB) [dblp]
• Ueli Maurer (ETH Zürich, CH) [dblp]
• Arpita Patra (Indian Institute of Science - Bangalore, IN) [dblp]
• Antigoni Polychroniadou (Cornell Tech - New York, US) [dblp]
• Daniel Rausch (Universität Stuttgart, DE) [dblp]
• Alessandra Scafuro (North Carolina State University - Raleigh, US) [dblp]
• Daniel Slamanig (AIT - Austrian Institute of Technology - Wien, AT) [dblp]
• Björn Tackmann (IBM Research-Zurich, CH) [dblp]
• Muthuramakrishnan Venkitasubramaniam (University of Rochester, US) [dblp]
• Ivan Visconti (University of Salerno, IT) [dblp]
• Sophia Yakoubov (MIT Lincoln Laboratory - Lexington, US) [dblp]
• Vassilis Zikas (University of Edinburgh, GB) [dblp]