3
$\begingroup$

On the page 31 of the Book "Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay", while defining the notion of security in case of covert adversaries, it is mentioned:

Define an adversary to be covert if the distribution over the messages that it sends during an execution is computationally indistinguishable from the distribution over the messages that an honest party would send. Then, quantify over all covert adversaries A for the real world (rather than all adversaries).

What do we mean exactly by quantifying covert adversaries? Moreover, it says:

Another problem is that adversaries may be willing to risk being caught with more than negligible probability, say $10^{-6}$. With such an adver- sary, the proposed definition would provide no security guarantee.

While quantifying the covert adversaries, how did we make it so that the probability of catching the "non-covert" adversaries is equal to statistical distance from the honest party's distribution?

Moreover, on page 32, why did we decide to quantify over all adversaries (including malicious), and how did that fix the problem we were dealing with?

$\endgroup$
1
$\begingroup$

What do we mean exactly by quantifying covert adversaries?

This means in the security definition (e.g., Definition 2.4.1 in that book), we say something like this "...for every non-uniform probabilistic polynomial-time (PPT) covert adversary, there exists...".

While quantifying the covert adversaries, how did we make it so that the probability of catching the "non-covert" adversaries is equal to statistical distance from the honest party's distribution?

No, we didn't. The probability $10^{-6}$ is not a statistical distance, but just a non-negligible risk that a "non-covert" adversary has to take.

Moreover, on page 32, why did we decide to quantify over all adversaries (including malicious), and how did that fix the problem we were dealing with?

If we quantify only covert adversaries, then the resulting security definition tells nothing about "non-covert" ones. That is, for a protocol that is secure in this sense, we are only guaranteed that no covert adversary can reveal additional information about the honest parties' inputs (except that implied by the function's output) by executing the protocol, but a "non-covert" adversary could still break this security. By quantifying all adversaries, the final definition (about secure computation in the presence of covert adversaries with $\epsilon$-deterrent) guarantees that every non-uniform PPT adversary $A$ can be caught with probability at least $\epsilon$ if $A$ chooses to cheat.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.