# Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs some computation using client $A$'s and client $B$'s input and returns the result back to client $B$.

Now we want to consider client $B$ is corrupted and construct a simulator for that. I do know that if we use a zero knowledge proof of knowledge the simulator can obtain client $B$'s input. But in the above protocol we do not use a zero knowledge proof.

My question is: In the above protocol, how can a simulator in the ideal world obtain client $B$'s input and send it to the trusted third party (TTP)?

Some more details: consider client $A$ has $S_A=\{a,b\}$ and client $B$ has $S_B=\{c,d\}$. Client $A$ gives its set in clear to the server. Client B does as follows: computes $Enc_{B}(c), Enc_{B}(d)$ and sends them to the server. Then the server computes: $Enc_{B}(r_1\cdot a+r_2 \cdot c), Enc_{B}(r_3\cdot b+ r_4\cdot d)$, where $r_i \leftarrow \mathbb{Z}_p$. And sends the encrypted values back to client $B$. It's clear that the view of client $B$ is indistinguishable in real and ideal world, thus we do not need any zero knowledge proof of knowledge to prevent client $B$ from doing any particular things. Please ignore the fact that the result is nonsense.

The simulator obtains "client $B$'s input" in the same way the simulator obtains $\:\{\hspace{-0.03 in}0,\hspace{-0.04 in}0\hspace{-0.03 in}\}\;$.
Even in the real world, the server computes its response without using any secrets, that response is the only message $B$ receives, and (from your description) no other party gives any output. $\:$ Thus, it doesn't matter what input the simulator sends to the trusted third party.

• Thank you for the answer. am I right to say that in the above protocol, the simulator in semi honest model is similar (or even identical) to the simulator in malicious model. Aug 4, 2015 at 8:19
• Yes. ${}{}{}\;$
– user991
Aug 4, 2015 at 15:15
• @MHSamadani : ​ ​ ​ "we need to extract the input of real world adversary" when we need to do something with it (like send it to something/someone), and we don't when we don't. ​ Yes, but it's not relevant here. ​ That depends on the protocol/scheme. ​ "Using a ZKPOK to prove knowing the secret key" would work. ​ ​ ​ ​ ​ ​ ​ ​
– user991
Nov 13, 2015 at 21:24
• @MHSamadani : ​ ​ ​ Yes. ​ Hopefully, you can fit in a ZKPoK of SK. ​ If Bob is only supposed to have computational security, then a CZKAoK would also work. ​ If you can't do either of those, but Bob's security against an honest-but-curious adversary is information-theoretic, then you could probably also get information-theoretic indistinguishability against a malicious Alice with respect to a PSPACE simulator, which is still a non-trivial notion of security. ​ ​ ​ ​ ​ ​ ​ ​
– user991
Nov 14, 2015 at 5:52
• That depends on whether your planning on actually implementing it or just giving a theoretical construction. ​ Also, I realize that there was ambiguity in my abbreviations. ​ As I'm using it, the C in CZKAoK stands for Computational. ​ Concurrent ZK is not relevant to your application, since Alice's privacy can be shown by a hybrid argument. ​ ​ ​ ​
– user991
Nov 14, 2015 at 6:52