Suppose we have a two-party protocol in the semi-honest model, which is based on an additive homomorphic cryptosystem like Paillier.(P2 will generate the public and private key and publish the public key to P1)

P2 will compute $R_1, ..., R_n$ using some operations and then send the vector $V=(R_1, ..., R_n)$ to P1. Since P1 has access to the private key, it will decrypt $R_1$ up to $R_n$.

In case where P1 is corrupted, to simulate the received message $V=(R_1, ..., R_n)$, is it suffice to just consider $n$ different dummy values and then encrypt them using the public key in order to make indistinguishable values? Or, when we want to prove the security in this case, we should necessarily show the operations P2 performed on its side? (I mean whether it is important to demonstrate how the simulator has reached to these dummy values($R'_1, ..., R'_n$)?

  • 1
    $\begingroup$ If some party knows the decryption key, can't they easily distinguish between meaningful and junk ciphertexts? $\endgroup$ – Mikero Jan 20 '20 at 16:44
  • 1
    $\begingroup$ Like Mikero said, if P1 has the decryption key, then he will trivially distinguish the right ciphertexts from dummy ciphertexts. And this is what you would expect: you do not expect these ciphertexts to hide anything from P1, since he has the decryption key, so you cannot simulate them without knowing the corresponding secret values. $\endgroup$ – Geoffroy Couteau Jan 20 '20 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.