0
$\begingroup$

In a paper that I have been reading (https://cs.nyu.edu/~ganesh/zk.pdf), in one of the proofs, this has been said:

The simulator works as follows: It uses the OT simulator to extract the prover’s input $x_0$ to the OT.

How exactly does this work? There's nothing defined in the paper itself, and I couldn't find anything related to an extractor for an oblivious transfer protocol. (The paper also uses extractors for ZKPOK, but that has been defined)

$\endgroup$
0
$\begingroup$

The paper is about garbled-circuit-based ZK protocol, in which the verifier generates the garbled circuit, and the prover obtains the wire labels corresponding to his private input $x_0$ through COT (committed OT).

The simulation in your problem works by letting the simulator simulate the ideal functionality of COT, which is defined in Fig. 1 on page 4. Here the receiver is the prover. Now the prover needs to invoke the COT ideal functionality by sending $(choose,b_i)$ to the ideal functionality where $b_i\in \{0,1\}$ is the $i$-th bit in the prover's input $x_0$. Since this ideal functionality is simulated by the simulator, the simulator gets all $b_i$ thus "extracts" the prover's input $x_0$.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.