0
$\begingroup$

I have a question in the context of two-party computation and the proof of the security of an MPC. I have looked at some of the beginning parts of this, this chapter 7, and
this But I couldn't achieve my answer.

I want to understand the difference of a malicious adversary with an honest-but-curious one, and to get what does it imply.

Does the security against malicious adversary exactly means that if the adversary changes any part of the data that he must send to the other party, he still can't achieve any information about the input of the other party to the protocol (except the information he already has)? Does it imply anything else?

$\endgroup$

2 Answers 2

0
$\begingroup$

A malicious adversary has full freedom to mess with the protocol given the information available to it. Examples of possible behavior are sending erroneous information or send nothing at all.

An honest-but-curious adversary is one that attempts to infer all information it can from the data it receives but behaves correctly otherwise.

An example of an attack that a malicious adversary could make is send a circuit that exposes the inputs of the honest party instead of a circuit that computed the intended objective.

$\endgroup$
4
$\begingroup$

I think your question is not well formulated. There are two orthogonal parts in a security definition: the security goal and the threat model. The security goal is what security you want to achieve (privacy? correctness? something else?) while the threat model is who do you want security to hold against. The difference between malicious and semi-honest adversary concerns the threat model you are considering. Other aspects of the threat model include how many parties are corrupted by the adversary.

So "security" against a malicious adversary means that whatever properties you specified when defining what "security" means should also hold when the adversary can misbehave arbitrarily.

$\endgroup$
2
  • $\begingroup$ Yes. You are right. I was confused in this context. And additionally, my main problem was the meaning of arbitrary misbehaviors. Does the 'correctness' goal against 'malicious' adversary, implies that he cannot stablish his own two- party computation with the trusted party? Is it like security against man-in-the-middle attack? I mean, if the protocol lets the final result be f(Alice, adversary) instead of f(Alice, Bob), while adversary cannot infer anything about Alice' private data, is it still considered secure? $\endgroup$
    – m123
    Commented Oct 20, 2022 at 10:11
  • $\begingroup$ :(when having 'privacy' and 'correctness' as security goals). Does such a protocol achieve 'correctness'? $\endgroup$
    – m123
    Commented Oct 20, 2022 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.