1
$\begingroup$

In the MPC protocol based on the common reference string (CRS) model, the CRS can be generated by the simulator, and the simulator can obtain the backdoor information in the CRS (such as the private key $sk$ corresponding to the public key $pk$), thus simulating correctly. One measure I can take if I want to build a protocol in the plain model is to generate the CRS by running an MPC protocol. My question is whether the backdoor information corresponding to the CRS is allowed to be obtained by the simulator in the simulation proof in the subsequent main protocol executed using CRS?

$\endgroup$
1
  • $\begingroup$ Please expand acronyms such as CRS to improve readability $\endgroup$
    – kodlu
    Commented Jan 24 at 11:58

1 Answer 1

1
$\begingroup$

You are describing some kind of protocol:

  1. Parties run a 2PC coin tossing protocol to agree on random coins $r$.
  2. They use $r$ as the CRS in a subprotocol.

In the UC model, you wouldn't describe the protocol, instead you would describe it as:

  1. Parties invoke an ideal coin-tossing functionality, which gives them random coins $r$.
  2. They use $r$ as the CRS in a subprotocol.

The simulator for this protocol gets to play the role of the honest parties and the setup functionalities --- in this case, the coin-tossing functionality. The simulator can sample $r$ so that it knows a trapdoor, then give $r$ to the adversary on behalf of the coin-tossing functionality.

(But you'll notice that a coin-tossing ideal functionality is not much different from a CRS functionality.)

$\endgroup$
2
  • $\begingroup$ Mike, thanks a lot for your answer! It's very inspiring to me. You say that the simulator plays both the role of honest party and the sub-functionality $f$ ( the setup functionality or the coin-tossing functionality). Let's suppose $f$ receives some $pp$ from both parties then return a $pk$ it generates to both parties. If I prove that a protocol in the $f$-hybrid model securely computes another functionality let's say $F$, $\endgroup$
    – amyyy
    Commented Jan 27 at 13:35
  • $\begingroup$ what I will do is just let the simulator send $pp$ to $f$ then receives $pk$ back and the simulator with only the $pk$ (without the knowledge of the backdoor information of $pk$, namely $sk$) cannot simulate the view of the malicious party successfully (although with the help of $F$)...It's very my first fime to realise that the simulator can just generate $pk$ here by itself... $\endgroup$
    – amyyy
    Commented Jan 27 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.