2

In my understanding, the main difference in the proof between UC and standalone model is the ability to "rewind", which appears to related to malicious security only.

So if we are only interested in semi-honest security models, do we have to distinguish UC and standalone models?

vince.h
  • 132
  • 5

1 Answers1

1

By standalone security, I assume you mean something along the lines of "the view of Alice when Bob has input $y$ is indistinguishable from her view when he has input $y'\neq y$ ", i.e. that her view depends only on her input $x$ and the output $f(x,y)$. Goldreich's Foundations of Cryptography (volume 2) gives a constructive definition (7.2.1 in the book) where a simulator is given $x$ and $f(x,y)$ and must produce something indistinguishable from Alice's view (without knowing $y$). When the input of the semi-honest adversary is well-defined and given to us, then this is equivalent to a real-ideal "UC-style" definition of semi-honest security (def 7.2.2). Goldreich proves the equivalence in Proposition 7.2.3.

The crux of proving security in the UC framework is extracting an input for malicious parties (they may not have a well-defined input) to provide to the ideal functionality. Rewinding is a technique for extracting this input that can be used in the standalone model, but not the UC model. The input is given "for free" in semi-honest security: a semi-honest adversary must have a well-defined input, otherwise how could it honestly follow the instructions of the protocol.

lamontap
  • 833
  • 5
  • 12