I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the secret input of corrupted parties, even if the corrupted parties' input is encrypted or in secret shared form. I have two questions:
- Is there any additional requirement or restriction along with this assumption?
- Why can/should we rely on this assumption? Currently, I only focus on the semi-honest setting.
Any advice and explanation would be highly appreciated. Thanks.