# Simulation-Based Proof: When a Secret Key is Involved

Assume we have a protocol in which a party receives an encrypted random polynomial. The polynomial is encrypted using his public key.

We want to construct a simulator for this party (so this party is corrupted). We want to show that in both models (i.e. real and ideal) it receives the random polynomial so they are indistinguishable.

Question:

When we construct the simulator for the party, do we need to pass the secret key of the party to the adversary? (so the adversary in the ideal model can decrypt the message and retrieve the random polynomial)

Or

We can ignore encryption and only pass the random polynomial to the adversary.

• When does the party receive the encrypted message? As input or during the execution of the protocol? The private key is a priori information, it can be passed using the auxiliary input. – fkraiem May 10 '16 at 10:10
• @fkraiem The party receives the encrypted message as a result of "some computation" (at the end of the protocol). Thank you for the comment. – user153465 May 10 '16 at 10:12
• Remember that the adversary in the ideal model (the simulator) receives only the corrupted party's input and output (as specified by the functionality), and nothing else. Indeed, the execution in the ideal world is independent of the protocol, it depends only on the functionality. – fkraiem May 10 '16 at 10:20
• @fkraiem So, the secret key would be part of its input? or the input is the functionality's input? – user153465 May 10 '16 at 10:23
• Sorry, it also receives an auxiliary input, of course. What I meant to say was that it is not clear from your question whether the ideal-world adversary should receive the encrypted mesage at all. If the encrypted message is part of the protocol, and not part of the functionality, then the ideal world adversary does not receive it. – fkraiem May 10 '16 at 10:24