1
$\begingroup$

What is the role for simulation-based proof under the semi-honest model without considering malicious adversaries? I agree with that a view of a some party is important to prove that a protocol is secure under some assumption which is semi-honest or malicious setting. I'm wondering if a proof of simulation-based for a protocol makes sense. I see some papers providing proofs using simulation-based technique under semi-honest adversary. But I don't think it is needed since its semi-honest. Most of cryptographers take care of the information leakage.

In other words, I think a simulation-based proof under the semi-honest adversary is not reliable. Often it's trivial while a proof for malicious adversary is NOT trivial. Moreover, when non-experts read that paper, the proof makes paper difficult to read.

So, is the simulation-based proof under semi-honest model really needed in the literature?

$\endgroup$

closed as off-topic by fkraiem, e-sushi Oct 24 '18 at 22:32

  • This question does not appear to be about cryptography within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

2
$\begingroup$

The essence of semi-honest security is that "the protocol transcript leaks no more than the function output." How do you propose to formally prove this without a simulator? After you become comfortable with simulators, it becomes obvious that they are the correct way to formalize this idea.

Yes, simulators also do a good job of formalizing properties unique to the malicious setting (particularly input extraction). But that is not an argument against simulators for semi-honest definitions. If anything it reinforces the fact that simulators are the correct paradigm to formalize MPC security in all scenarios!

Yes, security proofs are much harder in the malicious setting. This is to be expected since the adversary has much more power.

Overall, it's not really clear what you are suggesting. First you say that a simulator in semi-honest is "often .. trivial" but then you say "the proof makes paper difficult to read". Simulation-based security is there because it is the most elegant way to formalize the relevant security concepts; it's not there to make things difficult for no reason.

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.