Consider secure two-party computation against malicious adversaries in the standalone model. I know that the "rewinding" technique can be used to extract the corrupt party's input, e.g., in $\Sigma$-protocol or interactive commitment. I am curious about whether this technique can be generally applied to secure computation for input extraction. For example, can the simulator rewind the internal real-world adversary back to some early "snapshot" after the two parties' outputs in the real-world execution (which is run on the dummy input for the honest party and the real-world adversary's input to be extracted) are settled?

If so, does it imply a possible simulation strategy where the simulator extracts the corrupt party's input by using the dummy input and the honest party's output in the real-world execution?

It would be really appreciated if someone could give me any hint on the restrictions of this technique. Currently, I know from this question how this technique is applied to reactive functionalities. I also know that this technique is not allowed in the UC model.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.