0
$\begingroup$

I am formulating a simulation based proof, but I'm not sure how much power I can give the simulator. For example if a simulator needs to simulate the output of a symmetric key encryption algorithm then it can just pick a random string of the same length and use that to simulate the output. Would it be possible though to give the simulator a random symmetric key encryption (SKE) algorithm with the same sized output and use that to simulate the value too? Surely these outputs would be indistinguishable too? So the simulator essentially sets up a different SKE scheme and uses that to simulate the original SKE scheme. Is this permitted in simulation based proofs?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

Anything is permitted as long as it works. The question you have to ask is what role a symmetric encryption plays in the protocol. If it is decrypted at some stage in the protocol potentially to a corrupted party, then you need to be able to simulate that and have it decrypt to the correct value. If it is never decrypted, then why is it ever used in the protocol?

Sorry for the self-citation, but you can read more about this at: https://eprint.iacr.org/2016/046.pdf.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.