Questions tagged [simulation]
The simulation tag has no summary.
35 questions
1
vote
2
answers
85
views
Why does the zero-knowledge property only require distribution of transcripts to be indistinguishable rather than requiring the order of messages?
I still do not understand the security model when proving the zero-knowledge property.
Take the Sigma protocol as an example:
In the book Proofs, Arguments, and Zero-Knowledge (Section 12.2.1), the ...
- 65
5
votes
1
answer
144
views
A lifestyle-based example of simulation-based security
The intuition behind simulation-based security proofs comes from the following idea — if any party participating in a protocol or system can fully simulate the entire interaction process without ...
- 321
1
vote
0
answers
47
views
Simulation proofs of symmetric key encryption
Suppose in a protocol a client sends an encrypted message to a server using their common secret key. Now to simulate a malicious server's view, how can the simulator do this for this ciphertext for an ...
- 311
2
votes
0
answers
40
views
Can the discrepancy of compute time to simulate a system and to observe it be used to verify the actual state of the system?
Lets say I have a self driving taxi company. I need to prove to the law enforcement that my cars do not break any traffic rules.
The cars ride on urban streets where lots of things going on. I imagine ...
1
vote
0
answers
53
views
Simulation Based Proofs in 2-Party Computation
I was reading the paper How to simute it - A Tutorial on the Simulation Proof Technique by Yehuda Lindell, where he considers the Oblivious Transfer problem. (page 11)
Basically, Oblivious Transfer is ...
- 11
1
vote
3
answers
129
views
In the simulation based proof, why we don't consider the order of the transcript?
I'm currently learning the simulation-based proof. A lot of tutorials say a protocol is secure if the distinguisher cannot distinguish between the real view and the simulated view. And the view is the ...
- 65
1
vote
0
answers
22
views
extracting malicious input when secret sharing in MPC
I am trying to learn simulation-based proof in malicious mode
Suppose there are three parties. When a malicious party $P_2 $secret shares its input x, to the other two. $P_2$ sends $x_0$ to $P_0$ and ...
- 381
1
vote
2
answers
211
views
Is the sum of indistinguishable independent variables indistinguishable?
Suppose a key $K$, two messages $X,Y \in \{0,1\}^n$ and a encryption function $\text{Enc}_K(\cdot)$ that produces independent indistinguishable from uniform cyphertexts in $\{0,1\}^m$. Is $\text{Enc}...
- 35
0
votes
1
answer
129
views
Can Zero-Knowledge proofs leak information that does not break simulatability?
I currently do not understand the definition of Zero-Knowledge proofs.
When one initially starts reading about ZKPs, one learns that "no additional knowledge should be transmitted" other ...
- 23
2
votes
1
answer
101
views
'Callbacks' in UC?
In UC, consider the protocol ρ^φ, which uses the protocol φ 'as a subroutine'. If I understand correctly, ρ would call φ with arguments, which would then perform computations, perhaps even calling its ...
- 232
2
votes
1
answer
130
views
Parallel Composition in UC / CC?
I was learning about composable security frameworks, and I was wondering about the following when I was learning about Constructive Cryptography here (https://youtu.be/l7vyzRtLQCM?feature=shared&t=...
- 232
4
votes
1
answer
122
views
Visibility of oracle queries in the Indifferentiability model
I have a construction $C$ which internally uses idealized primitive $\mathcal{P}$ (a random permutation) where the goal is that $C$ is indifferentiable from a random oracle $\mathcal{F}$. That is, $C$...
- 83
3
votes
0
answers
132
views
A highly space-efficient embedding of prime factorization problem using the Ising model
I hope this is not off-topic for this SE, as it directly relates to the RSA problem. My background is in quantum information and computation, so please excuse me if my notation doesn't match your ...
1
vote
0
answers
99
views
Why the intuition simulation is wrong in "How to Simulate It" - section 8 extract input OT？
I'm reading "How to Simulate It" section 8 'Extracting Inputs – Oblivious Transfer'. It makes me confused about the security proof when $P_1$ is corrupt. I wonder when the adversary $\...
- 119
0
votes
1
answer
127
views
Question about Environment Set in Universally Composable Security Proof
I have read into many papers and tutorials regarding "Universally Composable Security Proofs." I still have one confusion about the initial setup by the environment. On one hand, I got that ...
- 101