# A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world is as:

Real view: $X, Y = 0$ and $output = 0$

Real World

Now, imagine the simulator wants to simulate the real world’s view in the ideal world. In order to simulate $x$ (honest party’s input), the simulator must send $1$ to the trusted party and then receives $x$ from it. Thus the simulator succeeded to simulate $X$, but now the simulator computes the output as $X$ && $(Y = 1)$ = $X$, which is not the equal of the output in the real view $X$ && $0$ = $0$. Thus the simulator cannot simulate the output in the ideal model.

Ideal World Definition 2.3.1 in the malicious model The definition says that for every adversary A for the real model must exist a simulator S for the ideal model. Considering this definition, I could find an adversary (who sends $y = 0$ in the real world) that there is no any simulator for it, so the protocol is not secure in the malicious model. In the Lindell’s book-page 27 (the below proof), it is said that this protocol is secure!!! I am so confused. (I found a scenario where the protocol is not secure).

Proof of the protocol ## closed as unclear what you're asking by e-sushiSep 1 '18 at 9:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

• You ask quite a few questions in different directions which will likely fend people off from answering because during the time it takes to write a proper answer you could ask more questions, ad infinitum. Please focus here, to get answers. – fkraiem Aug 31 '18 at 11:24
• Additionally to what @fkraiem said (which I re-formulated a bit to sound nicer) remember that it is no problem to split your question up into multiple distinct questions. – SEJPM Aug 31 '18 at 12:19
• @SEJPM This reads like "I've detected a problem and here's my blog post". Especially, since I have a hard time identifying a question (not only due to the lack of even a single question mark). Therefore, I'm putting this on-hold for OP to clarify with an edit. – e-sushi Sep 1 '18 at 9:56
• @SEJPM I got my answer. fkraiem answered my question, and I have no problem. – AmirHosein Adavoudi Sep 1 '18 at 10:09

If I understand correctly, you consider an adversary $\mathcal A$ corrupting $P_2$ in the real world, and which ignores $P_2$'s input $y$ and just outputs $0$ regardless of the value $x$ sent by $P_1$, is that right? And you claim that this adversary is not simulatable.
Well, of course this adversary is simulatable: the simulator sends whatever to the trusted party, receives whatever, and outputs $0$.
The proof, by the way, shows more: it shows how to construct a simulator for any adversary, as follows. In the real world, the adversary receives $x$, performs whatever computation based on $x$, $y$, and its auxiliary output $z$, and outputs the result. The simulator sends $1$ to the trusted party, receives $x$, performs the same computation as the real-world adversary, and outputs its result.
• @AmirHoseinAdavoudi My simulator does not compute anything; it just outputs $0$, like your real-world adversary does. – fkraiem Aug 31 '18 at 13:18