Tag Info

New answers tagged

2

There is quite a bit of confusion in your question. First, differentiate between the real and ideal models. The adversary in the ideal model sends the adversary's input and gets its output (and can also sometimes determine if the honest party gets output, depending on the model). We often call the ideal adversary a "simulator" since this is how we build the ...


1

The objective of the simulator is to make the simulated world (often called the ideal world) indistinguishable from the real world (running the actual protocol). See my write-up on the UC framework here for more detail. In the proof setup, the entity attempting to distinguish between the two worlds is often assumed to provide the inputs to the parties. That ...


0

$SIM_s$ can do that, but it doesn't need to. $\:$ The distinguisher chooses the parties' inputs.


1

The simplest example I know of is actually for a pathological case. Namely, it is presented in Chapter 2 of the book of Hazay and Lindell as an example of a two-party MPC protocol which is secure against a malicious adversary but not against a semi-honest one (in the classical sense, for this reason they prefer the notion of augmented semi-honest ...


2

The traditional MPC definition of correctness has no notion of correctness on the inputs. The traditional MPC correctness property deals with the output, i.e., the protocol is correct if $y$ where $y=f(x_1,x_2,\dots,x_n)$ is guaranteed to be output. What the $x_1,\dots,x_n$ values are is completely up to the inputting party. So, if you want to check that ...


2

If the honest parties have commitments to the malicious parties' inputs or [encapsulations generated by honest parties] of those inputs, then the function can be modified to check those. ‚Äč Otherwise, the value computed by the trusted party "taking honest party inputs and modified inputs of corrupted parties" by definition results in a correct output.


4

As the previous answer says, they are certainly NOT the same. However, there is certainly a connection between them. Specifically, the covert model just says that there is a deterrent parameter $\epsilon$ and the guarantee is that if the adversary tries to cheat then it will be caught with probability at least $\epsilon$. The question that arises is how ...



Top 50 recent answers are included