Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private sets to the server. The server computes the private set intersection and returns it to $B$. $A$ and $B$ are honest but server is malicious. The server learns nothing about the input and output of the computation. Since the server may change the result, $B$ needs to ensure the result is correct. The only thing the server learns is the number of elements in the clients’ set.

What I need to know: 1- In ideal model to simulate a malicious server, do $A$ and $B$ first send their sets to a trusted party (TP) and then TP gives the set size to the simulator? 2- Does the server compute the intersection and return to TP and then TP only checks the correctness of intersection? 3- In general, the responsibilities of each party (e.g. simulator, trusted party) in ideal model are not clear to me.

  • $\begingroup$ What is your end goal? To prove security? If so, what is the high level strategy for this? Typically it is to show indistinguishability between the real world and the ideal world. Is that what you want to do? $\endgroup$ – mikeazo May 12 '15 at 12:10
  • $\begingroup$ @mikeazo yes, that's right $\endgroup$ – user153465 May 12 '15 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.