# A problem exists with the security proof in the secure AND example in the malicious model [closed]

Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ && $y=0$) = $0$. We can conclude that the real view in the real world is as:

Real view: $X, Y = 0$ and $output = 0$

Real World

Now, imagine the simulator wants to simulate the real world’s view in the ideal world. In order to simulate $x$ (honest party’s input), the simulator must send $1$ to the trusted party and then receives $x$ from it. Thus the simulator succeeded to simulate $X$, but now the simulator computes the output as $X$ && $(Y = 1)$ = $X$, which is not the equal of the output in the real view $X$ && $0$ = $0$. Thus the simulator cannot simulate the output in the ideal model.

Ideal World

Definition 2.3.1 in the malicious model

The definition says that for every adversary A for the real model must exist a simulator S for the ideal model. Considering this definition, I could find an adversary (who sends $y = 0$ in the real world) that there is no any simulator for it, so the protocol is not secure in the malicious model. In the Lindell’s book-page 27 (the below proof), it is said that this protocol is secure!!! I am so confused. (I found a scenario where the protocol is not secure).

Proof of the protocol

• You ask quite a few questions in different directions which will likely fend people off from answering because during the time it takes to write a proper answer you could ask more questions, ad infinitum. Please focus here, to get answers. Aug 31 '18 at 11:24
• Additionally to what @fkraiem said (which I re-formulated a bit to sound nicer) remember that it is no problem to split your question up into multiple distinct questions.
– SEJPM
Aug 31 '18 at 12:19
• @SEJPM This reads like "I've detected a problem and here's my blog post". Especially, since I have a hard time identifying a question (not only due to the lack of even a single question mark). Therefore, I'm putting this on-hold for OP to clarify with an edit. Sep 1 '18 at 9:56
• @SEJPM I got my answer. fkraiem answered my question, and I have no problem. Sep 1 '18 at 10:09

If I understand correctly, you consider an adversary $\mathcal A$ corrupting $P_2$ in the real world, and which ignores $P_2$'s input $y$ and just outputs $0$ regardless of the value $x$ sent by $P_1$, is that right? And you claim that this adversary is not simulatable.
Well, of course this adversary is simulatable: the simulator sends whatever to the trusted party, receives whatever, and outputs $0$.
The proof, by the way, shows more: it shows how to construct a simulator for any adversary, as follows. In the real world, the adversary receives $x$, performs whatever computation based on $x$, $y$, and its auxiliary output $z$, and outputs the result. The simulator sends $1$ to the trusted party, receives $x$, performs the same computation as the real-world adversary, and outputs its result.
• @AmirHoseinAdavoudi My simulator does not compute anything; it just outputs $0$, like your real-world adversary does. Aug 31 '18 at 13:18