Disjoint encryption and exact compositional trust

Prove or refute that disjoint encryption, in which neither protocol creates nor opens the other protocol's encrypted units, is sufficient to ensure that the weakest trust of a composed protocol equals the join of the weakest trusts of its component protocols under the conditions of Theorem~\ref{thm:composition}.

Background

The composition theorem establishes a lower bound: when component attacks carry over appropriately, the composed protocol requires at least the join of the component weakest trusts. Equality requires every minimal composition attack to contain a component minimal attack's stopping set.

The authors conjecture that the disjoint-encryption condition of Guttman and Thayer implies this equality. They have not verified how stopping sets behave under the transformation used in the disjoint-encryption independence proof.

References

Disjoint encryption in the sense of should be a sufficient condition for the equality, and we record why without claiming it as an instance. Their independence result transforms every run of the composition into behaviour of the components, preserving the regular strands and granting the adversary no capability it lacked. An attack on $\chi_i$ would then map to a component attack whose stopping set is contained in the original's, which is what the equality condition asks. Verifying this requires tracking stopping sets through the transformation of , which we have not carried out, so we state it as a conjecture.

— Trust a Few: The Weakest Assumptions a Protocol Needs  (2610.09730 - Mittal et al., 7 Oct 2026) in Remark 4.2, Section 4.2 “Composition, and When It Is a Join” (Remark \ref{rem:disjoint}); Section 7.7