3

I am new to the simulated proof and am a little bit confused about the abort in the simulation.

When the real-time protocol abort, I assume that the ideal process should also abort? Does this mean that the simulator would first observe the result of real-time protocol, then decides what to run to reach abortion?

Sorry, it may be a little bit vague in my description; here is a example:

When the simulator first waits the real-time protocol to finish and generate the result, if the result is aborted, then the simulator prepares its message sending to the ideal function, letting the ideal function abort.

Is it something like this way, or I got it wrong?

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
js wang
  • 381
  • 1
  • 10

1 Answers1

1

When the simulator is running, we are in the ideal interaction, and there is no real-world interaction. There are messages that look like protocol messages, but these exist only in the combined "imagination" of the simulator+adversary.

The real-world adversary thinks that it is running an instance of the real-world protocol. The simulator sends fake protocol messages to the adversary, and also observes the protocol messages sent by the adversary. The simulator watches what the adversary sends, and must "explain" what effect these messages would have had on an honest party.

Suppose the adversary sends some protocol message, and the simulator deduces "no matter what input $x$ the real-world honest party had, at this point in the protocol they would output $f(x,y)$". Then the simulator should send $y$ to the ideal functionality, so that the functionality delivers $f(x,y)$ to the ideal-world honest party. I.e., the real and ideal world match. If the simulator deduces "at this point in the protocol the real-world honest party would abort", then the simulator should instruct the ideal functionality to abort.

Mikero
  • 14,908
  • 2
  • 35
  • 58