1
$\begingroup$

I was reading this paper, where I came across the following statement:

We consider the problem of unbounded MPC with security against semi-malicious adversaries in the dishonest majority setting. In our communication model, parties publish their first message through a broadcast channel which is immediately delivered to all participants. At any point in time, any subset S of participants (with a dishonest majority) can gather together and evaluate a circuit C over their inputs (x_1, . . . , x _|S|) in a single round of broadcast.

Is semi-malicious similar to the augmented semi-honest model where the adversary can change inputs of the corrupted parties?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

My recollection is that semi-malicious means (informally) that the protocol is semi-honest secure, and additionally, a malicious adversary can only break correctness, but not security. That is, the adversary can cause the honest parties to get wrong outputs, but it cannot learn any private information.

One standard reason to use this model is that it is much easier to compile into a maliciously secure protocol: it allows to defer "checking honest behavior" to the end of the protocol. You can do the entire protocol without being afraid of leaking information, then add some step at the very end to prove the correctness of the entire computation. In contrast, to compile a standard semi-honest protocol into a malicious one, you really need checking honest behavior after each message sent, which can be significantly more costly.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Note that the formal definition is given in Section 3.4, page 9 of the paper you cite (though it's perhaps not easy to extract the intuition from the formal definition). $\endgroup$
    – Geoffroy Couteau
    Commented Mar 10, 2023 at 13:44
  • 2
    $\begingroup$ There may be multiple definitions in the literature, but I think of a semi-malicious adversary as one who can choose bad randomness, but will otherwise follow the protocol. This seems different to the "only breaking correctness" notion. $\endgroup$
    – pscholl
    Commented Mar 10, 2023 at 14:03
  • $\begingroup$ But then how is it different from the augmented semi-honest model where the adversary can control inputs of the corrupted parties? $\endgroup$
    – Paritosh007
    Commented Mar 10, 2023 at 15:46
  • $\begingroup$ @GeoffroyCouteau, so, checking after each message sent is the thing we have in "covert adversary model; Is it? $\endgroup$
    – Crypto Learner
    Commented Mar 11, 2023 at 15:05
  • $\begingroup$ @pscholl: that's indeed a different definition. I don't remember exactly where I encountered my version (I referred to this as "half-malicious" in a 2019 paper and had seen it before, but I don't have a pointer on top of my head), but after a quick eprint check, your definition seems currently the most commonly used. Is it the one used in the paper OP is asking about? If yes, I should edit my incorrect answer. $\endgroup$
    – Geoffroy Couteau
    Commented Mar 14, 2023 at 9:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.