Protocol 2.3.2 (A protocol For Binary AND)

According to the above protocol(Efficient Secure Two-Pary Protocols-Hazay-Lindell-page 27), the authors proved the security of this protocol according to the two paragraphs below:

We separately consider the case where P1 is corrupted and the case where P2 is corrupted. If P1 is corrupted, then the simulator S receives from A the bit that it sends to P2 in the protocol. This bit fully determines the input of P1 to the function and so S just sends it to the trusted party, thereby completing the simulation. In the case where P2 is corrupted, S sends input 1 to the trusted party and receives back an output bit b. By the observation above, b is the input of the honest P1 in the ideal model. Thus, the simulator S just hands A the bit x = b as the value that A expects to receive from the honest P1 in a real execution. It is immediate that the simulation here is perfect.

We stress that the above works because P2 is the only party to receive output. If P1 also were to receive output, then S ’s simulation in the case of a corrupted P2 would not work. In order to see this, consider an adversary who corrupts P2, uses input y = 0 and outputs its view in the protocol, including the bit x that it receives from P1. In this case, S cannot send y = 1 to the trusted party because P1’s output would not be correctly distributed. Thus, it must end y = 0, in which case the view that it generates for A cannot always be correct because it does not know the input bit x of P1.

Definition 2.3.1(Security in the malicious model)

According to the above definition, I understand why it is important that the outputs in the real and ideal model should be indistinguishable, but I do not know why it is important that simulator S should know the input bit x of P1!!! As I highlighted in the above authors' proof, why the simulator should know the input bit x; If it should know this, please explain to me how the above definition 2.3.1(in the mentioned book) tells us that the simulator should simulate the inputs of the party(P1 in the above protocol).

To sum up, is it important that the simulator simulates the inputs of the corrupted party? would you please explain it to me, according to the definition 2.3.1?

According to the definition 2.3.1, I know that the outputs pair's distribution of the honest and corrupted party in the ideal and real model should be indistinguishable, but it does not make sense to me that the simulation of parties' inputs is mandatory.

  • 1
    $\begingroup$ Please do not significantly change questions, including titles, especially after they have received answers. If you have a new question, ask a new question. You can also delete old questions if you feel they are no longer relevant, especially those without answers. $\endgroup$
    – fkraiem
    Aug 31, 2018 at 11:05

1 Answer 1


In order for a protocol to be secure, the output of any adversary must be simulatable, including that of an adversary that just outputs its input.

Moreover, note that in this case the protocol instructs that $P_1$ send its input bit $x$ to $P_2$, so in the case where $P_2$ is corrupted, it can output the input of $P_1$, so that must be simulatable as well.

  • $\begingroup$ Fkraiem, would you please tell me what does the REAL view(for the corrupted and honest party) in the malicious model consist of exactly? Thanks for considering my question. $\endgroup$ Aug 30, 2018 at 4:54
  • 2
    $\begingroup$ The view of an interactive algorithm consists of its input, random tape, and all received messages. $\endgroup$
    – fkraiem
    Aug 30, 2018 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.