3

Lindell's "How to Simulate It" tutorial uses what is known as the standalone security model. See Section 10.1 for a discussion. The standalone model analyzes the security of a protocol instance, in isolation. The UC model analyzes security in the presence of arbitrary "other things going on in the world" concurrent with the protocol ...


1

This really depends on which garbling scheme is used. Using the state-of-the-art half-gate scheme (here), your question has been the subject of a paper by Dupin, Pointcheval, and Bidan, which can be found here. The bottom line is: any such attack amounts to adding or removing NOT gates arbitrarily in the original circuit. Whether this can be used to leak the ...


Only top voted, non community-wiki answers of a minimum length are eligible