In the realm of secure Multi-Party Computation (MPC) schemes, there exist two fundamental concepts known as the covert adversary model and security with abort. From what I understand, both of these concepts involve situations where if a corrupted party engages in dishonest behavior, the honest parties have a reasonable chance of detecting this misconduct. However, I am having difficulty grasping the precise distinction between these two concepts. It would be greatly appreciated if someone could provide a comprehensive explanation highlighting the differences between them.
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Let's recap covert security. It is parameterized by a "deterrence parameter" $\epsilon$. If the adversary decides to cheat:
with probability $1-\epsilon$, the cheating attempt "succeeds", and the adversary is allowed to learn all honest parties' inputs and set all honest parties' outputs.
with probability $\epsilon$, the cheating attempt "fails," and the honest parties abort.
Covert security, where $1-\epsilon$ is negligible, is equivalent to standard security-with-abort. If $1-\epsilon$ is negligible, then you might as well set $\epsilon=1$, so that "deciding to cheat" becomes "decide to make honest parties abort." I am glossing over distinctions about which honest parties abort and whether honest parties know who to "blame" -- the two models can be made to agree on these issues.
This is proven formally as Proposition 3.10 of the original covert security paper by Aumann & Lindell.
The important distinction between covert & standard malicious security is that $\epsilon$ can be anything; e.g., $\epsilon = 1/2$. With $\epsilon = 1/2$, covert security gives a guarantee which is incomparable to the "standard" security definitions (semi-honest & malicious).
