Technology is linking the slightest of our actions to the virtual world. In such connected environments, cryptography aims at building schemes with provable security in order to mathematically protect the users' security in electronic exchanges. Relying on the existence of pairings in bilinear groups wherein the discrete logarithm problem is hard, this thesis puts forth mechanisms to efficiently enhance the privacy in three of the most fundamental cryptographic primitives, namely, digital signatures, encryption schemes and zero-knowledge proofs. Furthermore, these mechanisms support public verifiability so as to force the honesty of all participants in the standard model. We first focus on group signatures, a primitive proposed some 20 years ago, for which we propose the first efficient revocation mechanisms, overcoming the main obstacle to the deployment of this primitive in practical applications. We then focus on P-homomorphic signatures that make it possible to modify a signed message in a controlled way. In particular, we propose new mechanisms providing structure-preserving linearly homomorphic signatures, from which we build the first constant-size non-malleable commitments compatible with standard proof systems, as well as a generalization of this construction into a generic transformation. Finally we further investigate the unexpected applications of this kind of malleable signatures to non-malleable cryptography. This leads us to new proof systems for linear languages which in turn provide the most efficient publicly verifiable CCA-secure threshold encryption to date, and other new extensions.
The growing demands of users and industry have led to an increase in both size and complexity of deployed software in recent years. This tendency mainly stems from a growing number of interconnected mobile devices and from the huge amounts of data that is collected every day by a growing number of sensors and interfaces.\nSuch increase in complexity imposes various challenges -- not only in terms of software correctness, but also with respect to security. This thesis addresses three complementary approaches to cope with the challenges: (i) appropriate high-level abstractions and verifiable translation methods to executable applications in order to guarantee flawless implementations, (ii) strong cryptographic mechanisms in order to realize the desired security goals, and (iii) convenient methods in order to incentivize the correct usage of existing techniques and tools.\nIn more detail, the thesis presents two frameworks for the declarative specification of functionality and security, together with advanced compilers for the verifiable translation to executable applications. Moreover, the thesis presents two cryptographic primitives for the enforcement of cloud-based security properties: homomorphic message authentication codes ensure the correctness of evaluating functions over data outsourced to unreliable cloud servers; and efficiently verifiable non-interactive zero-knowledge proofs convince verifiers of computation results without the verifiers having access to the computation input.
Secure two-party computation cannot be fair against malicious adversaries, unless a trusted third party (TTP) or a gradual-release type super-constant round protocol is employed. Existing optimistic fair two-party computation protocols with constant rounds are either too costly to arbitrate (e.g., the TTP may need to re-do almost the whole computation), or require the use of electronic payments. Furthermore, most of the existing solutions were proven secure and fair via a partial simulation, which, we show, may lead to insecurity overall. We propose a new framework for fair and secure two-party computation that can be applied on top of any secure two party computation protocol based on Yao’s garbled circuits and zero-knowledge proofs. We show that our fairness overhead is minimal, compared to all known existing work. Furthermore, our protocol is fair even in terms of the work performed by Alice and Bob. We also prove our protocol is fair and secure simultaneously, through one simulator, which guarantees that our fairness extensions do not leak any private information. Lastly, we ensure that the TTP never learns the inputs or outputs of the computation. Therefore, even if the TTP becomes malicious and causes unfairness by colluding with one party, the security of the underlying protocol is still preserved.
Nico Döttling, Daniel Kraschewski, Jörn Müller‐Quade, Tobias Nilges
Universally composable secure computation was assumed to require trusted setups, until it was realized that parties exchanging (untrusted) tamper-proof hardware tokens allow an alternative approach (Katz; EUROCRYPT 2007). This discovery initialized a line of research dealing with two different types of tokens. Using only a single stateful token, one can implement general statistically secure two-party computation (Dottling, Kraschewski, Muller-Quade; TCC 2011); though all security is lost if an adversarial token receiver manages to physically reset and rerun the token. Stateless tokens, which are secure by definition against any such resetting-attacks, however, do provably not suffice for statistically secure computation in general (Goyal, Ishai, Mahmoody, Sahai; CRYPTO 2010). We investigate the natural question of what is possible if an adversary can reset a token at most a bounded number of times (e.g., because each resetting attempt imposes a significant risk to trigger a self-destruction mechanism of the token). Somewhat surprisingly, our results come close to the known positive results with respect to non-resettable stateful tokens. In particular, we construct polynomially many instances of statistically secure and universally composable oblivious transfer, using only a constant number of tokens. Our techniques have some abstract similarities to previous solutions, which we grasp by defining a new security property for protocols that use oracle access. Additionally, we apply our techniques to zero-knowledge proofs and obtain a protocol that achieves the same properties as bounded-query zero-knowledge PCPs (Kilian, Petrank, Tardos; STOC 1997), even if a malicious prover may issue stateful PCP oracles.
J-PAKE is a Password-Authenticated Key Exchange protocol, proposed in 2008 and presented again in 2010 and 2011. It does not require any public key infrastructure but uses zero-knowledge proofs. J-PAKE has been submitted as a candidate for the IEEE P1363.2 standard for password-based public key cryptography, and included in OpenSSL and OpenSSH. Since December 2010, J-PAKE has been used in Mozilla Firefox web browser. In this paper, we show that J-PAKE is vulnerable to password compromise impersonation attack, replay attack, and unknown key-share attack. We also propose some improvements for thwarting replay and unknown key-share attacks.
In a world where computers are involved in most aspects of our lives, it becomes more and more important to digitally identify entities. To achieve this goal, many existing systems use unique identifiers. This is a simple solution, but also makes it easy to trace the user’s actions. A privacy-friendly alternative is to use attributebased credentials as a basis for authentication and authorisation. Such credentials serve as a cryptographic container for attributes, that is, properties of the user, which are certified by an authority. With these attributes the user can be authenticated to access a resource or receive a service solely on the properties that are relevant for that specific resource or service. In this thesis we discuss three attribute-based credential technologies for which we have developed efficient smart card implementations. These technologies are: Self-blindable Credentials These credentials are based on elliptic curve cryptography with bilinear pairings. This technology shifts the computational burden to the terminal which makes a very compact smart card implementation possible. Unfortunately the support for elliptic curve cryptography on smart cards is limited to standard algorithms, which made it hard to develop other variants of this technology. This results in a minimal feature set compared to the other technologies. U-Prove The U-Prove issuance and verification protocols are, respectively, based on Schnorr’s blind signature scheme and zero-knowledge proofs. This technology offers the fastest implementation for attribute verification. With respect to privacy there is only one important drawback: U-Prove does not protect against linking multiple verification sessions to each other. This means that these credentials basically act as a pseudonym for the user. Identity Mixer This technology is based on the Camenisch-Lysyanskaya signature scheme which provides a blind signature protocol, which can be used for credential issuance, and zero-knowledge proofs for attribute verification. The performance of this implementation is not the best among these technologies, but this technology provides a broad feature set and offers proper unlinkability. This makes it possible to use a credential multiple times without becoming traceable. The goal of the research presented in this thesis has been to develop efficient smart card implementations of attribute-based credentials and compare various cryptographic systems for attribute-based credentials. This has resulted in a detailed
Ivan Damgård, Bernardo David, Irene Giacomelli, Jesper Buus Nielsen
We present a new compact verifiable secret sharing scheme, based on this we present the first construction of a homomorphic UC commitment scheme that requires only cheap symmetric cryptography, except for a small number of seed OTs. To commit to a k -bit string, the amortized communication cost is O ( k ) bits. Assuming a sufficiently efficient pseudorandom generator, the computational complexity is O ( k ) for the verifier and O ( k 1 + ε ) for the committer (where ε < 1 is a constant). In an alternative variant of the construction, all complexities are O ( k · polylog ( k )). Our commitment scheme extends to vectors over any finite field and is additively homomorphic. By sending one extra message, the prover can allow the verifier to also check multiplicative relations on committed strings, as well as verifying that committed vectors a , b satisfy a = φ ( b ) for a linear function φ . These properties allow us to non-interactively implement any one-sided functionality where only one party has input (this includes UC secure zero-knowledge proofs of knowledge). We also present a perfectly secure implementation of any multiparty functionality, based directly on our VSS. The communication required is proportional to a circuit implementing the functionality, up to a logarithmic factor. For a large natural class of circuits the overhead is even constant. We also improve earlier results by Ranellucci et al. on the amount of correlated randomness required for string commitments with individual opening of bits. These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.
Abstract. In this work, we first formalize the notion of dynamic group signatures with distributed traceability, where the capability to trace signatures is distributed among nmanagers without requiring any interaction. This ensures that only the participation of all tracing managers permits tracing a signature, which reduces the trust placed in a single tracing manager. The threshold variant follows easily from our definitions and constructions. Our model offers strong security requirements. Our second contribution is a generic construction for the notion which has a concurrent join protocol, meets strong security requirements, and offers efficient traceability, i.e. without requiring tracing managers to produce expensive zero-knowledge proofs for tracing correctness. To dispense with the expensive zero-knowledge proofs required in the tracing, we deploy a distributed tag-based encryption with public verifiability. Finally, we provide some concrete instantiations, which, to the best of our knowledge, are the first efficient provably secure realizations in the standard model simultaneously offering all the aforementioned properties. To realize our constructions efficiently, we construct an efficient distributed (and threshold) tag-based encryption scheme that works in the efficient Type-III asymmetric bilinear groups. Our distributed tag-based encryption scheme yields short ciphertexts (only 1280 bits at 128-bit security), and is secure under an existing variant of the standard decisional linear assumption. Our tag-based encryption scheme is of independent interest and is useful for many applications beyond the scope of this paper. As a special case of our distributed tag-based encryption scheme, we get an efficient tag-based encryption scheme in Type-III asymmetric bilinear groups that is secure in the standard model.
We introduce a novel concept of dual-system simulation-sound non-interactive zero-knowledge (NIZK) proofs. Dual-system NIZK proof system can be seen as a two-tier proof system. As op-posed to the usual notion of zero-knowledge proofs, dual-system defines an intermediate partial-simulation world, where the proof simulator may have access to additional auxiliary information about the potential language member, for example a membership bit, and simulation of proofs is only guaranteed if the membership bit is correct. Further, dual-system NIZK proofs allow a quasi-adaptive setting where the CRS can be generated based on language parameters. This allows for the further possibility that the partial-world CRS simulator may have access to fur-ther trapdoors related to the language parameters. We show that for important hard languages like the Diffie-Hellman language, such dual-system proof systems can be given which allow unbounded partial simulation soundness, and which further allow transition between partial simulation world and single-theorem full simulation world even when proofs are sought on non-members. The construction is surprisingly simple, involving only two additional group elements in asymmetric bilinear pairing groups.
Payman Mohassel, Seyed Saeed Sadeghian, Nigel P. Smart
Abstract. We propose the first general framework for designing actively secure private function eval-uation (PFE), not based on universal circuits. Our framework is naturally divided into pre-processing and online stages and can be instantiated using any generic actively secure multiparty computation (MPC) protocol. Our framework helps address the main open questions about efficiency of actively secure PFE. On the theoretical side, our framework yields the first actively secure PFE with linear complexity in the circuit size. On the practical side, we obtain the first actively secure PFE for arithmetic circuits with O(g · log g) complexity where g is the circuit size. The best previous construction (of practical interest) is based on an arithmetic universal circuit and has complexity O(g5). We also introduce the first linear Zero-Knowledge proof of correctness of “extended permutation ” of ciphertexts (a generalization of ZK proof of correct shuffles) which maybe of independent interest.
In the last few years the efficiency of secure multi-party computation (MPC) increased in several orders of magnitudes. However, this alone might not be enough if we want MPC protocols to be used in practice. A crucial property that is needed in many applications is that everyone can check that a given (secure) computation was performed correctly – even in the extreme case where all the parties involved in the computation are corrupted, and even if the party who wants to verify the result was not participating. This is especially relevant in the clients-servers setting, where many clients provide input to a secure computation performed by a few servers. An obvious example of this is electronic voting, but also in many types of auctions one may want independent verification of the result. Traditionally, this is achieved by using non-interactive zero-knowledge proofs during the computation. A recent trend in MPC protocols is to have a more expensive preprocessing phase followed by a very efficient online phase, e.g., the recent so-called SPDZ protocol by Damgard et al. Applications such as voting and some auctions are perfect use-case for these protocols, as the parties usually know well in advance when the computation will take place, and using those protocols allows us to use only cheap information-theoretic primitives in the actual computation. Unfortunately no protocol of the SPDZ type supports an audit phase. In this paper, we show how to achieve efficient MPC with a public audit. We formalize the concept of publicly auditable secure computation and provide an enhanced version of the SPDZ protocol where, even if all the servers are corrupted, anyone with access to the transcript of the protocol can check that the output is indeed correct. Most importantly, we do so without significantly compromising the performance of SPDZ i.e. our online phase has complexity approximately twice that of SPDZ.
The notion of Zero Knowledge introduced by Goldwasser, Micali and Rackoff in STOC 1985 is fundamental in Cryptography. Motivated by conceptual and practical reasons, this notion has been explored under stronger definitions. We will consider the following two main strengthened notions. Statistical Zero Knowledge: here the zero-knowledge property will last forever, even in case in future the adversary will have unlimited power. Concurrent Non-Malleable Zero Knowledge: here the zero-knowledge property is combined with non-transferability and the adversary fails in mounting a concurrent man-inthe-middle attack aiming at transferring zero-knowledge proofs/arguments. Besides the well-known importance of both notions, it is still unknown whether one can design a zero-knowledge protocol that satisfies both notions simultaneously. In this work we shed light on this question in a very strong sense. We show a statistical concurrent non-malleable zero-knowledge argument system for N P with a black-box simulatorextractor. 1
Abstract. We construct a 3-move public coin special honest verifier zero-knowledge proof, a so-called Sigma-protocol, for a list of commitments having at least one commit-ment that opens to 0. It is not required for the prover to know openings of the other commitments. The proof system is efficient, in particular in terms of communication requiring only the transmission of a logarithmic number of commitments. We use our proof system to instantiate both ring signatures and zerocoin, a novel mech-anism for bitcoin privacy. We use our Sigma-protocol as a (linkable) ad-hoc group identi-fication scheme where the users have public keys that are commitments and demonstrate knowledge of an opening for one of the commitments to unlinkably identify themselves (once) as belonging to the group. Applying the Fiat-Shamir transform on the group identification scheme gives rise to ring signatures, applying it to the linkable group iden-tification scheme gives rise to zerocoin. Our ring signatures are very small compared to other ring signature schemes and we only assume the users ’ secret keys to be the discrete logarithms of single group elements so the setup is quite realistic. Similarly, compared with the original zerocoin protocol we rely on a weak cryptographic assumption and do not require a trusted setup. A third application of our Sigma protocol is an efficient proof of membership of a secret committed value u belonging to a public list L = {λ1,..., λN}.
Are there differences between the sale of an unopened Super Mario Bros. computer game and of the digital collage of 5,000 images? Viewed from the perspective of the doctrine of exhaustion, we can easily conclude that the two transfers have significant differences. The auction of the tangible data carrier of the Super Mario’s 1986 edition (for $660,000) 1 fits well into the doctrine. The auction of the NFT (non-fungible token) representing Beeple’s “Everdays: the First 5000 Days” (for an equivalent of an astounding $69.3 million) 2 seems to be hype with a snowball effect rather than a modern encapsulation of digital exhaustion. Some commentators, 3 including the present author in collaboration with Alexandra Giannapoulou, João Pedro Quintais, and Balázs Bodó, 4 have thoroughly introduced the incompatibility of the NFT mania with the existing copyright status quo, and so – in connection with the present book’s topic – the sale of tokenized information, which is capable of representing information related to digital artworks, is practically excluded from the scope of the exhaustion of the right of distribution. At the same time, NFTs de facto offer a “code-based digital ecosystem that has practical consequences for the copyright-relevant fields of creativeness.” 5 The sale and resale of NFTs is possible; an exchange of information and title to “own” and “trade” information related to copyrightable subject matter is technologically guaranteed. In line with that, a quasi-exhaustion regime has also emerged. As such, the NFT mania can practically evidence the need for and modern technology’s capability of offering digital marketplaces for artworks as well.
Zero knowledge proof system which has received extensive attention since it was proposed is an important branch of cryptography and computational complexity theory. Thereinto, noninteractive zero knowledge proof system contains only one message sent by the prover to the verifier. It is widely used in the construction of various types of cryptographic protocols and cryptographic algorithms because of its good privacy, authentication, and lower interactive complexity. This paper reviews and analyzes the basic principles of noninteractive zero knowledge proof system, and summarizes the research progress achieved by noninteractive zero knowledge proof system on the following aspects: the definition and related models of noninteractive zero knowledge proof system, noninteractive zero knowledge proof system of NP problems, noninteractive statistical and perfect zero knowledge, the connection between noninteractive zero knowledge proof system, interactive zero knowledge proof system, and zap, and the specific applications of noninteractive zero knowledge proof system. This paper also points out the future research directions.
Fabrice Benhamouda, Stephan Krenn, Vadim Lyubashevsky, Krzysztof Pietrzak
Abstract. We design an efficient commitment scheme, and companion zero-knowledge proofs of knowledge, based on the learning with errors over rings (RLWE) problem. In particular, for rings in which almost all elements have inverses, we construct a perfectly binding commitment scheme whose hiding property relies on the RLWE assumption. Our scheme maps elements from the ring (or equivalently, n elements from Fq) to a small constant number of ring elements. We then construct Σ-protocols for proving, in a zero-knowledge manner, knowledge of the message contained in a commitment. We are able to further extend our basic protocol to allow us to prove additive and multiplicative relations among committed values. Our protocols have a communication complexity of O(Mn log q) and achieve a negligible knowledge error in one run. Here M is the constant from a rejection sampling technique that we employ, and can be set close to 1 by adjusting other parameters. Previously known Σ-protocols for LWE-related languages either relied on “smudging ” out the error (which necessitates working over large fields, resulting in poor efficiency) or only achieved a noticeable or even constant knowledge error (thus requiring many repetitions of the protocol).
Eli Ben‐Sasson, Alessandro Chiesa, Christina Garman, Matthew Green · 7 authors
Bit coin is the first digital currency to see widespread adoption. While payments are conducted between pseudonyms, Bit coin cannot offer strong privacy guarantees: payment transactions are recorded in a public decentralized ledger, from which much information can be deduced. Zero coin (Miers et al., IEEE S&P 2013) tackles some of these privacy issues by unlinking transactions from the payment's origin. Yet, it still reveals payments' destinations and amounts, and is limited in functionality. In this paper, we construct a full-fledged ledger-based digital currency with strong privacy guarantees. Our results leverage recent advances in zero-knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs). First, we formulate and construct decentralized anonymous payment schemes (DAP schemes). A DAP scheme enables users to directly pay each other privately: the corresponding transaction hides the payment's origin, destination, and transferred amount. We provide formal definitions and proofs of the construction's security. Second, we build Zero cash, a practical instantiation of our DAP scheme construction. In Zero cash, transactions are less than 1 kB and take under 6 ms to verify - orders of magnitude more efficient than the less-anonymous Zero coin and competitive with plain Bit coin.
One of important issues of information security in the interaction of users is the use of methods and tools, allowing one party to make sure of the authenticity of another party. The proof of knowledge protocols which have the additional property of zero-knowledge are applied to solve this problem. The protocols based on asymmetric encryption have received wide acceptance, such as the Fiat-Shamir, Schnorr, Okamoto, Guillou-Quisquater, Brickell-McCurley, Feige-Fiat-Shamir protocols. Cryptographic strength of these protocols is defined by discrete logarithms in a finite prime field, as well as an increase in the number of accreditation cycles. As a result of the development of methods and tools of cryptanalysis and rapid development of technologies and power of computing systems, there is a need to increase the sizes of system-wide parameters of the protocol, leading to increased resource intensity and performance complexity of basic operations in the fields.Cryptographic zero-knowledge protocols on elliptic curves are proposed in the paper. The strength of cryptosystems on elliptic curves is based on the difficulty of solving the discrete logarithm problem in the group of elliptic curve points, and is more difficult than the discrete logarithm problem in the finite field. The completeness and soundness of protocols were determined, computation examples were given. The tools of the Strength Protocol Animator package were applied to verify the protocols for resistance to enemy attacks. Consequently, the use of cryptographic protocols on elliptic curves will significantly reduce the sizes of protocol parameters and increase the cryptographic strength
Simone Fatichi, Sebastian Leuzinger, Christian Körner
Knowledge of future terrestrial carbon (C) pools and fluxes is based on simulations by Dynamic Global Vegetation Models (DGVMs; Cox et al., 2000; Sitch et al., 2008). For simplicity we used the DGVMs acronym to include all of the models able to simulate C and vegetation dynamics at large spatial scales, which are sometimes referred to as Terrestrial Biosphere Models, Terrestrial Ecosystem Models, vegetation components of Earth System Models, and Land Ecosystem Models. DGVMs are now typically coupled to climate models to account for biophysical and biogeochemical feedback caused by vegetation (Bonan, 2008; Chapin et al., 2008; Anderson et al., 2011). The ultimate aim is to simulate climate–vegetation dynamics that explicitly account for mutual interactions and thus provide us with a better spatiotemporal description of water fluxes together with the most realistic scenarios for the future climate and C cycle (Friedlingstein et al., 2006; Thornton et al., 2007; Bonan et al., 2011). Current DGVMs are simulating long-term tree and forest stand growth as a consequence of the amount of assimilated C, triggering an inevitable positive feedback between C assimilation and growth. The key factors affecting stomatal aperture and C assimilation are atmospheric CO2 concentration, water availability, light, vapor pressure deficit and temperature (Sellers et al., 1997; Lawson et al., 2011). However, direct control of C sinks (defined as growth in the sense of C investment on plant tissue expansion) via environmental factors has been shown to be more important than indirect control via photosynthesis (the C source, see Fig. 1). For example, water- or temperature-limited plants tend to reduce growth but increase C storage (Körner, 2003; Sala & Hoch, 2009; Woodruff & Meinzer, 2011; Sala et al., 2012), which suggests that environmental controls act first on sink activity rather than source activity (Körner, 2013). Nevertheless, in all existing DGVMs, plant growth is driven by photosynthesis directly without considering water and thermal limitations via metabolic, cambial and meristematic activity (blue arrows in Fig. 1; Bonan et al., 2003; Sitch et al., 2003; Krinner et al., 2005). The entire photosynthesized net C (the source) is then partitioned among different C pools, mostly based on allometric rules derived from observations (Poorter et al., 2012) or using simplified functional allocation schemes (Friedlingstein et al., 1998; Franklin et al., 2012). Allocation to carbohydrate reserves, root exudates and export to symbionts are mostly missing. This opens up a huge discrepancy between the way plant growth is modeled today (blue arrows in Fig. 1) and the way it is understood based on experimental evidence (red arrows in Fig. 1). In this article, we suggest a revised hierarchy of plant growth control by removing the causal link from C assimilation to plant growth and by providing a description of the mechanistic connections among processes. Available soil water, temperature, nutrients, light, and CO2 are indisputably the key drivers of plant growth (Boisvenue & Running, 2006; McMurtrie et al., 2008; Ågren et al., 2012; Fig. 1). The former three (water, temperature, and nutrients) are fundamentally different from the latter two (light and CO2) because they can affect both sink and source activities, while light and CO2 only affect the source activity (C assimilation, Fig. 1). In this section, we compare the hierarchy of such limitations based on experimental evidence, which will lead into the discussion of strategies for modeling plant growth. When water limitations occur, there is evidence that cambial and leaf growth are inhibited at much lower levels of water stress (higher water potentials) than photosynthesis (Fig. 2; Boyer, 1970; Hsiao, 1973; Hsiao et al., 1976; Muller et al., 2011; Tardieu et al., 2011). Because organ expansion is affected earlier and more intensively than photosynthesis, plants experiencing soil water deficit often accumulate nonstructural carbohydrates (NSC) and reduce growth (Würth et al., 2005; Woodruff & Meinzer, 2011). Drought stressed or more apical parts of trees show lower xylem- or leaf-water potential than well-watered or more basal parts. This decrease in xylem- or leaf-water potential implies a reduction in cell turgor and in the capacity to transport sugars (Woodruff et al., 2004; Sala et al., 2011; Woodruff & Meinzer, 2011). Specifically, lower cell turgor has the potential to limit cell wall expansion, cell wall synthesis and protein synthesis (Lockhart, 1965; Hsiao, 1973; Sala et al., 2011). This means that C assimilation continues while sink activity (tissue growth) is inhibited, which most likely explains the accumulation of NSC in stressed plants (Körner, 2003). For example, Sala & Hoch (2009) showed that in Pinus ponderosa, mobile C compounds increase with increasing tree height. The possibility of plants actively prioritizing storage over growth allows additional interpretations of the role of accumulating NSC, for example, to maintain the integrity of the hydraulic system (Sala et al., 2012) or for signaling purposes (Rolland et al., 2006). However, recent evidence seems to support that when hydraulic transport is not affected, NSC is significantly depleted as a consequence of C demand (Hartmann et al., 2013; Sevanto et al., 2013). Exacerbation of these mechanisms (low turgor and incapability to transport sugars) also seems to play an important role in tree mortality and therefore long-term forest dynamics (McDowell, 2011; McDowell et al., 2011). Inhibition of sink activity via low water potentials and the resulting accumulation of photo-assimilates in leaves can also lead to direct feedback, that is downregulating photosynthesis (Paul & Foyer, 2001; Nikinmaa et al., 2013), which demonstrates a direct control of photosynthesis via growth (red horizontal arrow in Fig. 1). Similarly to water stressed plants, temperature-limited plants such as trees at the treeline and winter crops are typically limited by sink activity (tissue expansion) earlier than by source activity (C assimilation; Fig. 1; Körner, 2012). Consequently, cold-limited plants show an increase rather than a decrease in NSC with colder temperatures (Körner, 2008; Fajardo et al., 2012; Hoch & Körner, 2012). Temperature influences several metabolic processes (e.g. cell doubling time), determining the potential growth rate of organs in the absence of other growth limiting factors (Pantin et al., 2012). Most temperature-controlled processes of plant growth have been summarized by Boltzmann–Arrhenius type equations, which describe a decrease in growth rates at sub-optimal and supra-optimal temperatures (Parent et al., 2010). Furthermore, a 5–6°C threshold has often been identified to limit growth in cold adapted species, irrespective of photosynthetic activity which typically ceases only at freezing point (Körner, 2008). Nutrient limitation is well known to exert a negative feedback on photosynthesis via the amount of fundamental enzymes needed for C assimilation that can be produced. The amount of synthesized Rubisco, for example, is strongly controlled by nitrogen availability (Kattge et al., 2009). However, nutrients also act as direct plant growth control due to the relatively constant stoichiometry of plant tissue composition (Sterner et al., 2002; Leuzinger & Hättenschwiler, 2013). This has emerged clearly from FACE experiments where progressive nitrogen limitation (Luo et al., 2004) has been demonstrated to limit plant growth (Norby et al., 2010). While plants have the capacity to recruit additional nutrients by expanding their root system and via mycorrhizal symbioses, nutrient limitations are likely to progressively emerge at the landscape scale. Importantly, no study has been able to clearly quantify nutrient limitation acting on sink (tissue growth) vs source activity (C assimilation). Light as well as atmospheric CO2 clearly limit photosynthesis (the source), and unlike the previous factors discussed, they do not affect the C sinks directly. Therefore, the question here is whether (and if yes, when) the effect of CO2 and light is limiting sink activity (growth) via source activity (blue arrows from source to sink activity via the tree in Fig. 1). In other words, is plant growth C limited and under what conditions? Arguments in favor of C limitation of plant growth are either based on young seedlings and saplings in the forest understory or on individual leaves in dense canopies that are almost always operating below light saturation (Turner, 2001; Lloyd & Farquhar, 2008). Accordingly, CO2 was found to have a stimulatory effect on growth of plants in the understory (Würth et al., 1998; Hättenschwiler & Körner, 2000). Lloyd & Farquhar (2008) inferred that growth of tropical forests is C limited using the relationship between growth and photosynthesis: Np = Gp[1 − φ] where Np is net primary production (new growth), Gp is the average rate of photosynthesis, and φ is the proportion of assimilated C lost via total respiration plus volatile organic C emissions and root C exudation. They argue that higher Gp as a consequence of increasing CO2 concentration or incoming light necessarily leads to enhanced growth. However, we propose that this equation should generally read Np = Gp(Np)[1 − φ(Gp(Np))], thus not be interpreted as a direct causal link between photosynthesis and growth, because φ is a function of Gp, and Np can feedback on photosynthesis, that is, Gp = f(Np). Rewritten in these terms the equation is highly nonlinear and an increase in Gp does not imply a proportional increase in growth. Leaf level light responses of seedling and single leaves are difficult to extrapolate to the forest level, because this would imply that a forest stand behaves like a single leaf or shadowed tree. Light and consequently CO2 limitations of individual leaves, saplings or trees are not a demonstration that the entire forest community operates below its CO2 uptake capacity and even less that C acquisition is limiting forest growth (Körner, 2009; Clark et al., 2013). The Leaf Area Index (LAI) in several ecosystems (e.g. tropical forest, alpine grassland) may be higher than needed to sustain maximal productivity (Amiro et al., 2010; Gough et al., 2013; S. Fatichi, M. J. Zeeman, J. Fuhrer & P. Burlando, unpublished). Many studies suggest that partial (moderate) defoliation hardly affects tree growth or forest productivity (Ericsson et al., 1985; Hoogesteger & Karlsson, 1992; Reich et al., 1993; Kaitaniemi et al., 1999; Volin et al., 2002). A larger than necessary LAI typically has evolutionary rather than physiological reasons: to shade competing neighbors and thus limit their performance; as insurance against herbivory and storm damage; and as an additional option to store nutrients (especially in evergreen trees). Therefore, while light and CO2 may limit growth at the leaf or plant level, they unlikely do so at the landscape (whole forest) level and in the longer term (Leuzinger & Hättenschwiler, 2013). Short-term benefits of extra light (Graham et al., 2003) or elevated CO2 (Norby & Zak, 2011) can only be sustained to the extent a higher growth rate is supported by higher nutrient availability. Current atmospheric CO2 concentration (close to 400 ppm) additionally represents a rather exceptional forcing in the evolutionary context, with the current species having evolved in CO2 concentrations between 180 and 290 ppm (Siegenthaler et al., 2005; Lüthi et al., 2008). This suggests that C availability is at least less limiting nowadays (Körner, 2006). Accordingly, CO2 enrichment experiments with closed forest canopies did not show a sustained stimulation of growth by elevated CO2, except under high nutrient availability (Finzi et al., 2007; Norby et al., 2010; Bader et al., 2013; Sigurdsson et al., 2013). The differential sensitivity of C source and sink activities to water, temperature, and nutrient controls could lead to an imbalance between C supplied by photosynthesis and C used for tissue growth and respiratory costs. A mismatch between these two quantities would be sub-optimal and create a long-term surplus of assimilated C. In normal conditions, this situation is avoided through at least three mechanisms. First, in the short term, acclimation of photosynthesis occurs through negative feedback given by accumulation of starch or higher concentration of sucrose at the leaf level (Paul & Foyer, 2001). However, such a strategy would not be very effective to counteract mid/long-term source–sink imbalance. Second, therefore, in the mid-term, plants use sophisticated mechanisms of C storage at the leaf and whole plant level through accumulation and depletion of NSC (Kozlowski, 1992; Hoch et al., 2003; Gough et al., 2009; Richardson et al., 2013). Fluctuations of NSC are expected to buffer the difference between C supply and demand for timescales from hours to a few years. NSC dynamics are likely to be actively controlled by plants rather than a pure passive deposit of C (Sala et al., 2012). Third, in the long-term, evolutionary processes likely fine-tuned the photosynthesis apparatus (C source) to match long-term investment capacity (C sinks), which is the first to be controlled by environmental limitations. This of source–sink can be summarized as controls (Körner, and the between sinks and which is likely for the hierarchy of controls in the enrichment experiments as well as of water or temperature limitations have the possibility to the between C and For an increase of NSC is typically found in CO2 enrichment Furthermore, atmospheric CO2 almost always enhanced photosynthesis with or no et al., 2005; Bader et al., 2010). However, this typically does not into enhanced growth, in the term and for forests (Leuzinger et al., 2011; Norby & Zak, 2011; Bader et al., 2013). Because the C has to be this imbalance has several the of the & 2013). the extra C is and et al., 2006). Therefore, the of the extra C in CO2 experiments is to root exudates and export to et al., 2012). C assimilation respiration because of the larger and and thus transport respiration & 2000). if root is as a et al., a larger concentration in would more exudates due to the concentration the nutrient limitation through under elevated CO2 et al., 1993; Hättenschwiler & Körner, The use of experiments (e.g. with elevated CO2) is to the C source–sink and therefore the drivers of plant growth, under different environmental there is evidence that tissue growth is mostly under direct control of environmental rather than via the of assimilated C (Fig. and arrows in Fig. which for a of the hierarchy of plant growth control in This implies a from the current C source driven to where C sinks are the Because processes shown in Fig. are strongly and by it is to with either in the short For example, production will decrease with whether the is on growth or whether temperature assimilation and thus growth. However, the processes are fundamentally argue that if these processes and the are not it is unlikely DGVMs will simulate future C storage except under when photosynthesis may as shown in a in Fig. Furthermore, forest and composition are likely to feedback on C assimilation, they will also in long-term C the role of temperature and plant water in growth, of the existing DGVMs we are of include such a even in a simplified or et al., et al., 1997; et al., 2001; Bonan et al., 2003; Sitch et al., 2003; Krinner et al., 2005; et al., 2007; et al., 2009; Clark et al., 2011; et al., 2013; et al., 2013). the of the potential role of nutrients in limiting C from ecosystems et al., nitrogen and more have been in DGVMs et al., 2006; & 2008; & 2010; et al., 2012). However, all these models thermal and water limitations only in to C assimilation but not in to cambial or meristematic The of DGVMs also the that C processes such as photosynthesis (e.g. leaf are while processes of plant growth such as the rate of cell cell expansion, transport or cambial growth (C sink are much to quantify at high (Körner, 2013), even and to a source of et al., 2006; et al., 2013; & 2013). The of C fluxes and the between C and water through stomatal mostly to the of models and of and photosynthesis fluxes (Sellers et al., rather than plant growth. models that et al., to up the of DGVMs, and while they C assimilation, they in plant growth control that is based on observations in controlled but supported by observations in a the key of DGVMs and are almost to of the photosynthesis as for by et Fig. see also Bonan et al., 2012). short few from such DGVMs are typically by C fluxes derived from et al., 2006; et al., However, such only C and not plant growth that is they at show a over a given DGVMs are used to future from C pools and in models may lead us to a because of the Fig. that in models allocation can be controlled to extent by nutrients and environmental For water and light availability can control the differential C allocation to and (Friedlingstein et al., 1998; Krinner et al., 2005). However, this is rather different from having environmental directly control growth because the assimilated C is necessarily to C export to symbionts are mostly and mobile C are only in a of models in a simplified et al., 2005; et al., 2008; & 2010; et al., 2012; et al., 2012; et al., 2013). Therefore, C assimilation is typically to growth, which evidence that between assimilation and growth et al., 2006; Gough et al., 2009; Richardson et al., 2013). This also implies that if more C is assimilated in a under of elevated atmospheric CO2) the vegetation will more with positive feedback to C assimilation through which us with the for the way is to to the existing of DGVMs by direct growth control based on environmental drivers (Leuzinger et al., 2013; see also Fig. we tissue is controlled by environmental the amount of C to be to growth at a given should be of the amount of assimilated C. growth is by the limiting the of all other factors water, and nutrient are this with the that is the C source However, we argue that this is and only under such as in a a modeling the of or of species or plant functional type growth responses to environmental controls (water, temperature, This does not to the current of the could be but no longer the amount of C used for growth. The needed for such will a large of experimental A more to DGVMs on a more realistic of C models that simulate C and water fluxes the nutrient allocation to and from nonstructural C storage and to and root (Fig. This in its was in studies and more have been in models that et al., 2005; et al., 2010; et al., 2012) simulate transport et al., 2002; et al., as well as fluxes and cell growth activities & 2010; et al., 2010). This in the most components where C and water fluxes and are the plant between and in the (Fig. modeling of C assimilation and 1) is in most DGVMs et al., 2011). However, in the water and assimilated C are by leaf water and C and are to buffer the of C assimilation, an almost constant of sucrose to the at the & growth and can be explicitly modeled as a function of cell wall and protein and cell the that nutrients and C are is driven by cell turgor a threshold (Lockhart, which for water limitation to growth. cell typically a Boltzmann–Arrhenius function of temperature (Parent et al., with a temperature most for growth, which represents the thermal limitation to growth. When these two controls are plant growth can be A given by the of water potential and pressure that in also on sucrose concentration, is turgor In to for and et al., can be used for and transport and This will create a coupled system where and in and in and tissue (e.g. are The C is modeled as the of carbohydrates in the and by the of storage This C is then for growth, and for root and export to growth control by nutrients can also be in such a because nutrient through root uptake or can be explicitly and are up both via and actively through the of concentration et al., 2003; & 2012). C can be modeled as a et al., while modeling with is more and from understood which a in providing see While the mechanistic of for example, the leaf water and C or transport is relatively and can be into a of for the of C storage and sink as well as with to storage is a function of plant environmental and For at and C is from storage at the of the to support cambial activity and growth. also C their for example, leaves storage the is not and likely to with plant and plant stress (e.g. such of C allocation are not understood and the of Fig. will a spatial of C allocation with the more parts less C. a of the C sink is and the key for such a that a of the in Fig. is not given the limited we argue that current is for modeling most of the also that such components may to be in DGVMs and would a large of However, its can the for of environmental control of growth and of mechanistic C allocation schemes that could be into A where plant transport and tissue expansion are using well and among as was for photosynthesis is likely to way of modeling plant growth. a can also the of on plant C storage and sink which is fundamental for increasing and long-term scenarios for the C The of photosynthetic and the of mechanistic models of C assimilation that simulate observations have the of DGVMs, which have few over the identified 2006; et al., the of models mostly However, current physiological of tissue growth and expansion is in to it is in Current scenarios the between climate and vegetation are likely affected by a of plant growth and are therefore argue that direct environmental controls water and nutrient on tissue expansion and meristematic activity are fundamental than on the of C because they mostly limiting to plant growth photosynthesis Because C can only be to the extent other nutrients as well as water availability and temperature these drivers of growth will be over C assimilation This in of plant growth drivers has for the of terrestrial C fluxes and storage in the The of the in DGVMs will be but fundamental for future of the C In to this we two of different to growth in current DGVMs to growth limiting to mechanistic of plant transport and tissue expansion as was for photosynthesis While additional may be to of the we argue that there is evidence to the of the of current DGVMs, from to a plant growth. The three and the for on an earlier of this with are also