Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private sets to the server. The server computes the private set intersection and returns it to $B$. $A$ and $B$ are honest but server is malicious. The server learns nothing about the input and output of the computation. Since the server may change the result, $B$ needs to ensure the result is correct. The only thing the server learns is the number of elements in the clients’ set.

What I need to know: 1- In ideal model to simulate a malicious server, do $A$ and $B$ first send their sets to a trusted party (TP) and then TP gives the set size to the simulator? 2- Does the server compute the intersection and return to TP and then TP only checks the correctness of intersection? 3- In general, the responsibilities of each party (e.g. simulator, trusted party) in ideal model are not clear to me.

share|improve this question
What is your end goal? To prove security? If so, what is the high level strategy for this? Typically it is to show indistinguishability between the real world and the ideal world. Is that what you want to do? –  mikeazo May 12 at 12:10
@mikeazo yes, that's right –  user153465 May 12 at 12:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.