UC-framework: Simulating specific cases (proof in PVW)

Question

I am struggling to understand the proof of security in the UC-framework of the OT by PVW.

The cases I don't understand are the cases where:

i) Both parties are corrupted. In this case, they say that the simulator just lets the adversary generate and exchange all the messages. But isn't the simulator supposed to extract their inputs? What does the simulator sends to the ideal functionality in this case? How is this case indistinguishable from the ideal-world execution?

ii) Both parties are honest. In this case, they say that the simulator just simulates internally the protocol between the parties and delivers the exchanged messages to the adversary in the real-world. I don't quite understand how this simulation is indistinguishable from the ideal-world execution because the simulator does not have access to the inputs of the parties in the ideal world. So, it is unlikely that the parties in the simulated protocol end up with the same inputs and outputs. What am I missing in this case?

Thanks!

Answer 1

These two cases are trivial cases, usually don't need to argue about because they are definitely simulatable.

In the first case, both parties are controlled by the adversary. In the simulation, the simulator simulates both the corrupted sender and the corrupted receiver. The simulator can simply use the adversary as a subroutine to simulate each party, generates the messages to be relayed by environments. There is no need for the simulator to extract the adversary's input when all parties are corrupted by the adversary. The view will be indistinguishable from a real view because the adversary is the same in the simulation and in the real execution. Note that in this case simulation can be done but no security can be achieved, as the adversary has already corrupted all parties (nothing is left to be secured).

In the second case, both parties are honest, thus they will follow the protocol (which means they will use whatever input they have). The simulator is given their inputs at the beginnning at the simulation and can just follow the protocol to generate the messages. The view will be identically distributed as in a real execution where the two parties are honest. This case is trivially secure because there is no adversary at all.