1
$\begingroup$

In the paper that introduced Abstract Crypto [MauRen11], the Theorem 2 page 15 states that, basically, if there exists some local simulators that can be pluged on a resource $S$ such that this new ressource looks like a resource $R$ running some protocols, then $R$ securely constructs $S$. But I don't understand, why the simulators must be local, and can't be global? It does not matter for most cases when there is a single malicious adversary, but I'd say that it does make sense when several adversaries are corrupted. And if I'm not wrong in Universal Composability, the simulator is global.

More precisely, this theorem states that if $\langle \Phi,\Sigma, \approx\rangle$ is a cryptographic algebra, and if there exists for all interfaces $i \in \mathcal{I}$ some converters $\phi_i, \psi_i, \pi_i, \sigma_i \in \Sigma$ (where $\pi_i$ is the protocol of honest party $i$, $\sigma_i$ is a simulator connected to interface $i$, and $\phi_i,\psi_i$ are some filters) such that $\forall \mathcal{P} \subseteq I$, $\pi_P \phi_{\bar{P}}R \approx \sigma_{\bar{P}}\psi_P S$, then $R_{\psi} \sqsubseteq^{\pi} S_{\psi}$ (when we write $\sigma_I$, it means that we connect for all interace $i \in I$ the converter $\sigma_i$ to interface $i$).

And I'd expect this theorem to be true also when $\sigma_I$ is not just the parallel execution of all $\sigma_i$ (for $i \in I$), but also for any global simulator $\tilde{\sigma}_I$ having access to all the interfaces in $I$ at the same time.

So why does this theorem restrict the simulators to be local simulators, especially when it's not the case of UC? If I do need to use a global simulator, does that mean that I need to define a "weaker" ideal functionality that will basically create a channel between the two interfaces and allow the simulators to communicate through it?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.