0
$\begingroup$

I was reading the book Efficient Secure Two-Party Protocols by Y. Lindell and C. Hazay. Page 92 of the book says

This check is crucial and thus the order of first running the oblivious transfer and then sending the circuits and commitments is not at all arbitrary

I don't understand what difference would it make in the security if OTs are done after the commitments.

$\endgroup$
2
$\begingroup$

In the simulation, the output of the corrupted party is needed by the ideal adversary/simulator BEFORE the commitments and circuits are sent. Otherwise, the simulator is unable to generate values that will be indistinguishable from those in a real execution. In order to obtain this output, the simulator must send the corrupted party's input to the trusted third party (ideal functionality) and then get back the output. Since the corrupted party's input is extracted by the simulator in the OT phase, the OTs must be run first.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.