2
$\begingroup$

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs some computation using client $A$'s and client $B$'s input and returns the result back to client $B$.

Now we want to consider client $B$ is corrupted and construct a simulator for that. I do know that if we use a zero knowledge proof of knowledge the simulator can obtain client $B$'s input. But in the above protocol we do not use a zero knowledge proof.

My question is: In the above protocol, how can a simulator in the ideal world obtain client $B$'s input and send it to the trusted third party (TTP)?

Some more details: consider client $A$ has $S_A=\{a,b\}$ and client $B$ has $S_B=\{c,d\}$. Client $A$ gives its set in clear to the server. Client B does as follows: computes $Enc_{B}(c), Enc_{B}(d)$ and sends them to the server. Then the server computes: $Enc_{B}(r_1\cdot a+r_2 \cdot c), Enc_{B}(r_3\cdot b+ r_4\cdot d)$, where $r_i \leftarrow \mathbb{Z}_p$. And sends the encrypted values back to client $B$. It's clear that the view of client $B$ is indistinguishable in real and ideal world, thus we do not need any zero knowledge proof of knowledge to prevent client $B$ from doing any particular things. Please ignore the fact that the result is nonsense.

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
2
$\begingroup$

The simulator obtains "client $B$'s input" in the same way the simulator obtains $\:\{\hspace{-0.03 in}0,\hspace{-0.04 in}0\hspace{-0.03 in}\}\;$.
Even in the real world, the server computes its response without using any secrets, that response is the only message $B$ receives, and (from your description) no other party gives any output. $\:$ Thus, it doesn't matter what input the simulator sends to the trusted third party.

Improve this answer
$\endgroup$
9
  • $\begingroup$ Thank you for the answer. am I right to say that in the above protocol, the simulator in semi honest model is similar (or even identical) to the simulator in malicious model. $\endgroup$
    – user13676
    Aug 4, 2015 at 8:19
  • $\begingroup$ Yes. ${}{}{}\;$ $\endgroup$
    – user991
    Aug 4, 2015 at 15:15
  • 1
    $\begingroup$ @MHSamadani : ​ ​ ​ "we need to extract the input of real world adversary" when we need to do something with it (like send it to something/someone), and we don't when we don't. ​ Yes, but it's not relevant here. ​ That depends on the protocol/scheme. ​ "Using a ZKPOK to prove knowing the secret key" would work. ​ ​ ​ ​ ​ ​ ​ ​ $\endgroup$
    – user991
    Nov 13, 2015 at 21:24
  • 1
    $\begingroup$ @MHSamadani : ​ ​ ​ Yes. ​ Hopefully, you can fit in a ZKPoK of SK. ​ If Bob is only supposed to have computational security, then a CZKAoK would also work. ​ If you can't do either of those, but Bob's security against an honest-but-curious adversary is information-theoretic, then you could probably also get information-theoretic indistinguishability against a malicious Alice with respect to a PSPACE simulator, which is still a non-trivial notion of security. ​ ​ ​ ​ ​ ​ ​ ​ $\endgroup$
    – user991
    Nov 14, 2015 at 5:52
  • 1
    $\begingroup$ That depends on whether your planning on actually implementing it or just giving a theoretical construction. ​ Also, I realize that there was ambiguity in my abbreviations. ​ As I'm using it, the C in CZKAoK stands for Computational. ​ Concurrent ZK is not relevant to your application, since Alice's privacy can be shown by a hybrid argument. ​ ​ ​ ​ $\endgroup$
    – user991
    Nov 14, 2015 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.