0
$\begingroup$

I have read some oblivious transfer protocols, and I am confused about why they do not mention the malicious behavior that the corrupted sender may encrypt the wrong message $x_0'$ and $x_1'$ so that the honest receiver will receive the wrong result $x_\sigma'$. I think this totally breaks the correctness of OT and I don't know why the malicious secure OT protocol did not mention it. I know that the committed OT can prevent this behavior, but is this not a malicious behavior that one malicous-secure OT should consider?

$\endgroup$
2
$\begingroup$

In MPC we judge security by comparing to the "ideal world" where a trusted third party does the entire computation. In the ideal world, an adversary can send anything it wants as input to the trusted third party. In the ideal world, when it comes to malicious adversaries, there really is no valid sense of a "correct/incorrect input" for the adversary. (For semi-honest adversaries, their input is supplied by the external environment and they are bound to use it in the ideal world.) Since "using whatever input you like" is possible on the ideal world, it is not considered an attack against the protocol.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Tldr MPC protocols tries to protect integrity of eventual outputs and secrecy of inputs, but can't guarantee availability of correct outputs, so it doesn't try to guarantee availability. If a required input is withheld, that's a DoS attack that no protocol can circumvent $\endgroup$ – Natanael Dec 25 '19 at 13:29
  • $\begingroup$ Thanks for your answers. I think I get your point: The input substitution is unavoidable in the MPC, thus in the MPC malicious model, the ideal world is constructed to permit this behavior, which means that we don’t need to consider it as a malicious behavior in MPC malicious model. $\endgroup$ – Eileen Dec 27 '19 at 0:57
1
$\begingroup$

When we are analyzing the security of MPC protocols, we have to be aware that the judgment of some behavior as malicious depends on the enviroment. Another aspect is to consider if there a defense against this (supposably) malicious behavior.

Let me explain: if the receiver of an OT Bob refuses to open it, is he acting maliciusly? That is, if he decided to abort the protocol, is this absolutely an attack? Anyway, is there a defense against abort attacks? How could we force a receiver to open the OT message? In some sense, when a sender Alice encrypted wrong messages, she is aborting the protocol. Analyzing the protocol in its context, if abortion is an attack, you have a problem. Otherwise, this must not be considered in the adversarial model.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks for the answer. It becomes easy to understand when reducing this behavior to a special case of “abort” operation. But I realize that the first step is to figure out whether this behavior is unavoidable. If not, this must be a malicious behavior, otherwise we need to find the solution to against it. Also, the context is important, as not all the sub-protocols are stand-alone ones that can be used in a black-box way. $\endgroup$ – Eileen Dec 27 '19 at 1:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.