1
$\begingroup$

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world is as:

Real view: $X, Y = 0$ and $output = 0$

Real World

Real model

Now, imagine the simulator wants to simulate the real world’s view in the ideal world. In order to simulate $x$ (honest party’s input), the simulator must send $1$ to the trusted party and then receives $x$ from it. Thus the simulator succeeded to simulate $X$, but now the simulator computes the output as $X$ && $(Y = 1)$ = $X$, which is not the equal of the output in the real view $X$ && $0$ = $0$. Thus the simulator cannot simulate the output in the ideal model.

Ideal World

Ideal World

Definition 2.3.1 in the malicious model

Definition 2.3.1

The definition says that for every adversary A for the real model must exist a simulator S for the ideal model. Considering this definition, I could find an adversary (who sends $y = 0$ in the real world) that there is no any simulator for it, so the protocol is not secure in the malicious model. In the Lindell’s book-page 27 (the below proof), it is said that this protocol is secure!!! I am so confused. (I found a scenario where the protocol is not secure).

Proof of the protocol

Proof of the protocol

$\endgroup$

closed as unclear what you're asking by e-sushi Sep 1 '18 at 9:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    $\begingroup$ You ask quite a few questions in different directions which will likely fend people off from answering because during the time it takes to write a proper answer you could ask more questions, ad infinitum. Please focus here, to get answers. $\endgroup$ – fkraiem Aug 31 '18 at 11:24
  • 1
    $\begingroup$ Additionally to what @fkraiem said (which I re-formulated a bit to sound nicer) remember that it is no problem to split your question up into multiple distinct questions. $\endgroup$ – SEJPM Aug 31 '18 at 12:19
  • 1
    $\begingroup$ @SEJPM This reads like "I've detected a problem and here's my blog post". Especially, since I have a hard time identifying a question (not only due to the lack of even a single question mark). Therefore, I'm putting this on-hold for OP to clarify with an edit. $\endgroup$ – e-sushi Sep 1 '18 at 9:56
  • $\begingroup$ @SEJPM I got my answer. fkraiem answered my question, and I have no problem. $\endgroup$ – AmirHosein Adavoudi Sep 1 '18 at 10:09
1
$\begingroup$

If I understand correctly, you consider an adversary $\mathcal A$ corrupting $P_2$ in the real world, and which ignores $P_2$'s input $y$ and just outputs $0$ regardless of the value $x$ sent by $P_1$, is that right? And you claim that this adversary is not simulatable.

Well, of course this adversary is simulatable: the simulator sends whatever to the trusted party, receives whatever, and outputs $0$.

The proof, by the way, shows more: it shows how to construct a simulator for any adversary, as follows. In the real world, the adversary receives $x$, performs whatever computation based on $x$, $y$, and its auxiliary output $z$, and outputs the result. The simulator sends $1$ to the trusted party, receives $x$, performs the same computation as the real-world adversary, and outputs its result.

$\endgroup$
  • 1
    $\begingroup$ @AmirHoseinAdavoudi A malicious adversary is not required to perform the operations prescribed by the protocol, and can do whatever it wants. That's the whole point! We want to show that even such an adversary cannot breach the privacy of computation. $\endgroup$ – fkraiem Aug 31 '18 at 12:59
  • 1
    $\begingroup$ @AmirHoseinAdavoudi Your simulator doesn't work, but mine does, so there is a simulator that works. :) $\endgroup$ – fkraiem Aug 31 '18 at 13:14
  • 1
    $\begingroup$ @AmirHoseinAdavoudi My simulator does not compute anything; it just outputs $0$, like your real-world adversary does. $\endgroup$ – fkraiem Aug 31 '18 at 13:18
  • 1
    $\begingroup$ @AmirHoseinAdavoudi Where in the definition of security in the malicious model does it say anything about how the simulator must compute its output? $\endgroup$ – fkraiem Aug 31 '18 at 13:26
  • 1
    $\begingroup$ Let us continue this discussion in chat. $\endgroup$ – fkraiem Aug 31 '18 at 13:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.