2
$\begingroup$

Please, consider two honest parties $A$ and $B$ outsourced their private data to a malicious server $S$. So the parties store their data in the server. Then at a later point in time they want to ask the server to run some computation on both parties data and return a private result back to a party.

In order to prove the security of the scheme,in the ideal world, we construct a simulator $SIM_s$ simulating malicious server, $A_s$.

Question: Does $SIM_s$, pick two random datasets, make them private and send to $A_s$?

What is not clear in this case is that whether the parties (or simulator) have input or the server has input. Because the parties have already outsourced their dataset.

Improve this question
$\endgroup$

2 Answers 2

Reset to default
2
$\begingroup$

The objective of the simulator is to make the simulated world (often called the ideal world) indistinguishable from the real world (running the actual protocol). See my write-up on the UC framework here for more detail.

In the proof setup, the entity attempting to distinguish between the two worlds is often assumed to provide the inputs to the parties. That keeps things as generic as possible.

So, what should be done is have $\mathcal{Z}$ pick the inputs for the parties.

Improve this answer
$\endgroup$
10
  • $\begingroup$ Why sometime simulator in the ideal world has more power than the adversary in the real world. For instance, the simulator can extract the secret value used by the other party (in particular in zero knowledge prof of knowledge) where the real world adversary has not such capability. Or the simulator can receive the other party input to the zero knowledge ideal call. see "Efficient two party protocols" page 190, full simulation oblivious transfer. $\endgroup$
    – user13676
    Commented Jul 26, 2015 at 13:25
  • $\begingroup$ The simulator in the example can even make the adversary believe that the zero knowledge proof is verified where it is not. $\endgroup$
    – user13676
    Commented Jul 26, 2015 at 13:27
  • $\begingroup$ @user13676 you should ask that as a separate question, instead of in the comments. $\endgroup$
    – mikeazo
    Commented Jul 26, 2015 at 14:20
  • $\begingroup$ In the ideal model where simulator deals with the adversary, can we allow the adversary to cheat the simulator with the same probability (that is negligible) as in real world? or in the ideal model the simulator must detect all misbehavior of adversary? $\endgroup$
    – user13676
    Commented Jul 29, 2015 at 13:58
  • $\begingroup$ @user13676 The simulator does not detect anything. The simulators goal is to make the two worlds indistinguishable. In particular, a quote from an answer on your other question is important to remember "the simulator typically works by running the real-world adversary". So the simulator actually acts as the adversary in some sense. $\endgroup$
    – mikeazo
    Commented Jul 29, 2015 at 14:04
0
$\begingroup$

$SIM_s$ can do that, but it doesn't need to. $\:$ The distinguisher chooses the parties' inputs.

Improve this answer
$\endgroup$
1
  • $\begingroup$ It'd be nice if you put some more explanations. $\endgroup$
    – user13676
    Commented Jul 25, 2015 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.