Does a simulator in the semi-honest model in IDEAL/REAL model paradigm necessarily make use of the corrupted party's input?

For example, suppose a simulator given an input named $I$ and an output named $O$, tries to simulate the view of the real world. In this case, should the simulator necessarily use the input $I$ for the simulation? Or the simulator can simulate without the use of the input? Does it depend on the scenario? If you need the exact scenario, please refer to the below link:

Exact Scenario


It depends on the scenario. My intuition says that typically it would be used. In particular, the transcript that is generated during simulation includes the randomness of the corrupted party/parties and their incoming messages. Given this, it is possible to compute the outgoing messages sent by the corrupted parties. Since these messages must somehow embed the corrupted parties' inputs in a real execution, they would need to also be embedded in the IDEAL simulated messages.

Having said the above, note that it may be implicit. For example, in the EGL oblivious transfer protocol (see for example, Section 2.1 of this paper by Iftach Haitner), the receiver sends a message to the sender, and the sender replies. If the sender is corrupted, then the simulator only needs to generate the first message, and the second message which embeds the corrupted party's input is implicit (generated from the incoming message, input and randomness). As such, the simulator itself never needs to relate to the message.

  • $\begingroup$ Many thanks for your clear answer. $\endgroup$ – AmirHosein Adavoudi Jan 20 at 10:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.