0
$\begingroup$

enter image description here Based on the question proposed on page 27, we propose a modified question as follows:

Suppose the protocol is based on Paillier cryptosystem and $P_2$ has generated related public and private keys ($P_2$ publishes its pub key). Then, $P_1$ will encrypt $x$ using the public key and send it to $P_2$.

Considering this scenario, is it secure in the semi-honest model?

$\endgroup$
  • 1
    $\begingroup$ Encryption hides information from someone who doesn't know the decryption key, but $P_2$ knows the key in this case. $P_2$ can obtain $x$ even when its input $y=0$, so the protocol is not semi-honest secure. $\endgroup$ – Mikero Jan 20 at 16:40
  • 1
    $\begingroup$ @Mikero Isn't that an answer? $\endgroup$ – Maarten Bodewes Jan 20 at 17:09
3
$\begingroup$

Promoting my comment to an answer: Encryption hides information from someone who doesn't know the decryption key. In your case, $P_2$ knows the decryption key, and can therefore learn $x$. This is really no different than sending $x$ in the clear to $P_2$.

Note that this is the strange example from the book that is secure in the malicious setting but not in the semi-honest setting. Adding the encryption step doesn't change that. Your modified protocol leaks $x$ to a semi-honest $P_2$ even when its input is $y=0$, so the protocol is not semi-honest secure. But your modified protocol is secure against malicious $P_2$ since malicious $P_2$ always learns $x$ in the ideal world without loss of generality.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.