# Does simulation extractability require that the protocol have a backdoor in it?

As I understand it, one of the properties required to prove UC-security is simulation extractability. One example is the paper by Kosba et al adapting NIZKs to the UC model, but in their construction the witness is encrypted and the ciphertext appended to the proof, and whoever holds the private key can extract the (confidential) witness. (There's also a separate trapdoor that can forge proofs, but for the forged proofs the extractor is not required to work.)

Is this property required for simulation extractability? Would any UC-secure NIZK system also have a backdoor in it? Or am I misinterpreting what simulation extractability means?

Link to the Kosba et al preprint: http://eprint.iacr.org/2015/1093

• You may also be interested to have a look at ePrint 2012/704 which proves certain properties for $\Sigma$ protocols turned into non-interactive proof systems (also simulation extractability). – dade Jan 29 '18 at 8:24