# Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs some computation using client $A$'s and client $B$'s input and returns the result back to client $B$.

Now we want to consider client $B$ is corrupted and construct a simulator for that. I do know that if we use a zero knowledge proof of knowledge the simulator can obtain client $B$'s input. But in the above protocol we do not use a zero knowledge proof.

My question is: In the above protocol, how can a simulator in the ideal world obtain client $B$'s input and send it to the trusted third party (TTP)?

Some more details: consider client $A$ has $S_A=\{a,b\}$ and client $B$ has $S_B=\{c,d\}$. Client $A$ gives its set in clear to the server. Client B does as follows: computes $Enc_{B}(c), Enc_{B}(d)$ and sends them to the server. Then the server computes: $Enc_{B}(r_1\cdot a+r_2 \cdot c), Enc_{B}(r_3\cdot b+ r_4\cdot d)$, where $r_i \leftarrow \mathbb{Z}_p$. And sends the encrypted values back to client $B$. It's clear that the view of client $B$ is indistinguishable in real and ideal world, thus we do not need any zero knowledge proof of knowledge to prevent client $B$ from doing any particular things. Please ignore the fact that the result is nonsense.

The simulator obtains "client $B$'s input" in the same way the simulator obtains $\:\{\hspace{-0.03 in}0,\hspace{-0.04 in}0\hspace{-0.03 in}\}\;$.
Even in the real world, the server computes its response without using any secrets, that response is the only message $B$ receives, and (from your description) no other party gives any output. $\:$ Thus, it doesn't matter what input the simulator sends to the trusted third party.
• Yes. ${}{}{}\;$ – user991 Aug 4 '15 at 15:15