2
$\begingroup$

Consider secure two-party computation against malicious adversaries in the standalone model. I know that the "rewinding" technique can be used to extract the corrupt party's input, e.g., in $\Sigma$-protocol or interactive commitment. I am curious about whether this technique can be generally applied to secure computation for input extraction. For example, can the simulator rewind the internal real-world adversary back to some early "snapshot" after the two parties' outputs in the real-world execution (which is run on the dummy input for the honest party and the real-world adversary's input to be extracted) are settled?

If so, does it imply a possible simulation strategy where the simulator extracts the corrupt party's input by using the dummy input and the honest party's output in the real-world execution?

It would be really appreciated if someone could give me any hint on the restrictions of this technique. Currently, I know from this question how this technique is applied to reactive functionalities. I also know that this technique is not allowed in the UC model.

$\endgroup$

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.