An ideal functionality considers reliable communication channels, whereas a real functionality must consider unreliable communication channels (e.g., channels controlled by the adversary). Thus, it seems that no real functionality (that is reliant on message delivery over an unreliable channel) can be proven equivalent to its corresponding ideal functionality, because a message can be dropped in a manner that causes a distinction.

This isn't a problem for simulation-based security of cryptographic primitives (e.g., encryption schemes), because the communication channel needn't be considered. But it seems to be a problem for cryptographic protocols (built from such primitives), because interfering with communication (e.g., dropping messages) may be detrimental to security.

This seems rather limiting.

Have I misunderstood simulation-based security? Or is there a workaround to prove simulation-based security with unreliable real-world channels?

  • 2
    $\begingroup$ I think the "weakness" of the unreliable channel must be incorporated into the ideal functionality, thereby allowing interference with communication in both the real and ideal functionality, which permits equivalence. $\endgroup$
    – user2768
    Aug 8, 2018 at 10:10
  • $\begingroup$ @user2768 Is this explained in some lecture notes, tutorial, or some other manuscript? $\endgroup$ Aug 8, 2018 at 15:25


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.