3
$\begingroup$

Would you please explain to me why in the security definition of ideal/real model paradigm which is described in the efficient secure two-party protocol book(Hazay, Lindell), the simulator tries to simulate inputs and outputs of a party(in the semi-honest model), but the simulator just tries to simulate outputs and not inputs in the malicious model?

Would you please explain the difference between the security definition of idea/real model in the semi-honest and malicious model which is described in that book(page 21 and 25)?

Malicious Adversary

Malicious Model

Semi-Honest Model Semi-honest Model

$\endgroup$
  • 1
    $\begingroup$ Could you provide more details since we may not have a copy of the book? It seems to me the inputs are given to the parties and do not need to be simulated. $\endgroup$ – Shan Chen Aug 30 '18 at 19:08
  • $\begingroup$ Dear Mr. Shan Chen, I attached the references you needed. Hope this helps. $\endgroup$ – AmirHosein Adavoudi Aug 31 '18 at 10:22
  • 1
    $\begingroup$ The simulator in the semi-honest case does not really "simulate" the input of the corresponding party: it is given the party's input, so it just outputs it as is. It is the simulation of the received messages that is tricky. $\endgroup$ – fkraiem Aug 31 '18 at 10:35
1
$\begingroup$

Would you please explain to me why in the security definition of ideal/real model paradigm which is described in the efficient secure two-party protocol book(Hazay, Lindell), the simulator tries to simulate inputs and outputs of a party(in the semi-honest model), but the simulator just tries to simulate outputs and not inputs in the malicious model?

As mentioned in the above comments, the inputs do not need to be simulated because they are given to both the simulator (i.e., the adversary in the ideal world) and the adversary (in the real world).

Would you please explain the difference between the security definition of idea/real model in the semi-honest and malicious model which is described in that book(page 21 and 25)?

In the semi-honest setting, the parties have to follow the exact prespecified protocol in the real world, which implies that they cannot change their inputs or outputs. Therefore, the simulators only need to generate an indistinguishable view for each party, given the semi-honest party's input and output.

In the malicious setting, each corrupted party can deviate from the protocol, e.g., changing the inputs and outputs, aborting the protocol, etc. To define its security, intuitively we also want to simulate the adversary's view, but such a view cannot be defined in the same way as in the semi-honest setting anymore. In particular, the view depends on the real-world adversary which can change the given inputs and generate whatever outputs. Therefore, the secure two-party computation is defined as the indistinguishability between the outputs (which could be anything, like the adversary's view) of the simulator and the adversary.

FYI, I think Lindell's tutorial is very helpful.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.