Why are security properties non-compositional?

Question

I had a lecture in security and it was stated that security properties are non-compositional. I don't quite understand what that means and can't find anything in the internet about that.

Can anyone explain?

I'm seeing quite a bit about the search term "security properties are non-compositional", like: http://www.andrew.cmu.edu/user/danupam/dfgjk-sp2011.pdf — schroeder, Mar 25 '19 at 23:52

score 6 · Answer 1 · answered Mar 26 '19 at 00:03

Secure+secure != secure

What "non-compositional" means by definition is that if you have two components/thingies/processes/whatever that each on their own are secure (i.e. satisfy some security property) then, in general, you can not assume that the combination of these two will satisfy that security property; having both these together can make them both insecure.

This general principle applies to many domains of security from app development to theoretical cryptography; many practical exploitable vulnerabilities occur from an unexpected interaction of two parts that each, when viewed in isolation, would be perfectly secure.

Why are security properties non-compositional?

1 Answers1

Secure+secure != secure