{"date_published":"2005-09-12T00:00:00Z","page":"55 - 65","status":"public","year":"2005","publisher":"Springer","day":"12","citation":{"mla":"Pietrzak, Krzysztof Z. <i>Composition Does Not Imply Adaptive Security</i>. Vol. 3621, Springer, 2005, pp. 55–65, doi:<a href=\"https://doi.org/10.1007/11535218_4\">10.1007/11535218_4</a>.","ama":"Pietrzak KZ. Composition does not imply adaptive security. In: Vol 3621. Springer; 2005:55-65. doi:<a href=\"https://doi.org/10.1007/11535218_4\">10.1007/11535218_4</a>","short":"K.Z. Pietrzak, in:, Springer, 2005, pp. 55–65.","ieee":"K. Z. Pietrzak, “Composition does not imply adaptive security,” presented at the CRYPTO: International Cryptology Conference, 2005, vol. 3621, pp. 55–65.","chicago":"Pietrzak, Krzysztof Z. “Composition Does Not Imply Adaptive Security,” 3621:55–65. Springer, 2005. <a href=\"https://doi.org/10.1007/11535218_4\">https://doi.org/10.1007/11535218_4</a>.","ista":"Pietrzak KZ. 2005. Composition does not imply adaptive security. CRYPTO: International Cryptology Conference, LNCS, vol. 3621, 55–65.","apa":"Pietrzak, K. Z. (2005). Composition does not imply adaptive security (Vol. 3621, pp. 55–65). Presented at the CRYPTO: International Cryptology Conference, Springer. <a href=\"https://doi.org/10.1007/11535218_4\">https://doi.org/10.1007/11535218_4</a>"},"date_created":"2018-12-11T12:02:03Z","month":"09","acknowledgement":"Supported by the Swiss National Science Foundation, project No. 200020-103847/1.","publication_status":"published","abstract":[{"text":"We study the question whether the sequential or parallel composition of two functions, each indistinguishable from a random function by non-adaptive distinguishers is secure against adaptive distinguishers. The sequential composition of F and G is the function G(F()), the parallel composition is F G where ⋆ is some group operation. It has been shown that composition indeed gives adaptive security in the information theoretic setting, but unfortunately the proof does not translate into the more interesting computational case.\nIn this work we show that in the computational setting composition does not imply adaptive security: If there is a prime order cyclic group where the decisional Diffie-Hellman assumption holds, then there are functions F and G which are indistinguishable by non-adaptive polynomially time-bounded adversaries, but whose parallel composition can be completely broken (i.e. we recover the key) with only three adaptive queries. We give a similar result for sequential composition. Interestingly, we need a standard assumption from the asymmetric (aka. public-key) world to prove a negative result for symmetric (aka. private-key) systems.","lang":"eng"}],"conference":{"name":"CRYPTO: International Cryptology Conference"},"author":[{"last_name":"Pietrzak","id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87","full_name":"Krzysztof Pietrzak","first_name":"Krzysztof Z","orcid":"0000-0002-9139-1654"}],"doi":"10.1007/11535218_4","_id":"3213","title":"Composition does not imply adaptive security","alternative_title":["LNCS"],"quality_controlled":0,"intvolume":"      3621","volume":3621,"publist_id":"3468","date_updated":"2021-01-12T07:41:50Z","type":"conference","extern":1}