# Simulation-based proof of IKNP protocol(OT extension) for malicious adversary

I'm reading the well-known IKNP protocol for OT extension. In section 3.1, they give proofs for malicious Sender and semi-honest Receiver. I'm very confused about the proof for malicious Sender($$S^*$$). They say:

It is easy to verify that the joint distribution of $$(\rho; s^*;Q)$$, the values $$(y_{j,0}; y_{j,1})$$ and all values of $$H$$ queried by $$S^*$$ in the ideal process is identical to the corresponding distribution in the real process.

I have no idea why it's identical. So in my opinion, what they do in Simulator is choosing some random $$(\rho; s^*;Q)$$ and just feeding them to $$S^*$$. But I think malicious $$S^*$$ may ignore the messages fed, and arbitrarily give some.

So can I think that the distribution is identical just because $$S^*$$ is always arbitrarily give messages both in the real and ideal world. But I think it is not so simple.

The concrete construction of Simulator is as follows:

In this case, the Sender is malicious and the Receiver is honest. So we argue that the Sender can't learn anything about $$r$$. The crucial observation is that in IKNP protocol the Sender's $$Q$$'s column is like one-time pad. The $$Q$$'s column is like $$\mathbf q^i \oplus \mathbf r$$. Every $$\mathbf q^i$$ is independently randomness, so Q is random.
By this observation, we can choose a random $$Q$$ to feed the Sender. So both in real and ideal world the Sender get a random $$Q$$.
As for $$\mathbf s$$, which confused me. The security definition said $$\forall \mathcal A, \exists \mathcal S$$. So when we construct $$\mathcal S$$, we know $$\mathcal A$$'s code. So we know what messages the Sender send first.
• And at last I want to ask if the last step (call the Trusted party, and output what $S^*$ output) can be omitted, because in the real protocol the $S^*$ has no output and this contribute nothing to its transcripts. I think it can be omitted. Am I right?