Is the Simplest OT universally composable against a semi-honest adversary?

I started learning about cryptography very recently, and I got interested in the Simplest-OT protocol of Chou and Orlandi. However (as the authors themselves noted) the protocol is not UC-secure against a corrupt sender. My question is: if both sender and receiver are semihonest, is Simplest-OT still not UC-secure?

The paper mentions that the issue is with one of the parties delaying an action that makes simulation impossible. So if they are semi-honest and follow the protocol, it should fix that issue. There seems to be other problems with the original proof, but maybe they
don't apply to the semi-honest case.

Here is a rough argument of why it's plausibly UC-secure against semi-honest adversaries in the random oracle model. I leave it to you to fill the gaps.

The semi-honest receiver will make a single query to the random oracle as $$k_R= H(A^b)$$. Let $$x$$ be the input to $$H$$ that is observed by the simulator. Since it knows $$a$$, when it receives $$B$$ from the receiver, it can guess $$c=0$$ if $$B^a=x=g^{ab}$$ and $$c=1$$ if $$B^a\neq x$$.

Extracting the sender's input

The semi-honest sender makes exactly two random oracle queries and uses the outputs $$k_0,k_1$$ to encrypt its two messages. The simulator can record the outputs of these two queries and decrypt both $$e_0$$ and $$e_1$$ to recover both messages.

• Simulator doesn't need to extract in the semi-honest model (semi-honest adversaries have inputs provided by the environment). Apr 4 at 2:22
• Thanks @Mikero, I did not know that. So in semi-honest UC, the simulator only needs to recreate the views of the semi-honest adversary by interacting with its interface of the ideal primitive? Apr 4 at 15:23