a590003

Sim(y A , s A ) = (y ′ A , r A):
r A [a] = s a [A] (a ∈ A)
r A [h] = y A (h ∈ H)
y ′ A = y A
Sim’(x ′ , w, y A , s A ) = (x, r A , y
A ′ ):
u h = (x ′ ∧ w[h]) ∨ t 1 (s A [h], u H ) (h ∈ H)
x = t 2 (s A [h], u H ) (h = min H)
y a ′ = x ′ ∧ w[a] (a ∈ A)
r a [A] = s A [a] (a ∈ A)
r a [H] = u H (a ∈ A)
Figure 12: Simulators for the broadcast protocol when the dealer is honest (left) or dishonest (right)
x ′ , w
y ′ A
y H
s H
r H
Player[H]
r A
s A
x ′ , w
s A
y A
y H
r A y
A
′
y ′ H
WCast
Net
Sim
x
BCast
Figure 13: Security of broadcast protocol when the dealer is corrupted.
must output (y ′ A , r A) such that (Sim| BCast) is equivalent to the system (Dealer| Player[H] |
WCast| Net) specified by the last set of equations. The simulator is given in Figure 12 (left). It
is immediate to verify that combining the equations of the simulator Sim with the equations y i = x
of the ideal broadcast functionality, and eliminating local variables, yields a system of equations
identical to (2).
Dishonest dealer. We now consider the case where both the dealer and a subset of players
A are corrupted. As before, let H = {1, . . . , n} \ A be the set of honest players. The system
corresponding to a real execution of the protocol when Dealer and Player[A] are corrupted is
(Player[H] | WCast| Net), mapping (x ′ , w, s A ) to (y H , r A , y
A ′ ). (See Figure 13 (left).) Using
the defining equations of Player[H], WCast and Net, and introducing auxiliary variables u h =
y
h ′ ∨ t 1(r h [1], . . . , r h [n]) for h ∈ H, we get the following set of equations:
y h = t 2 (r h [A], r h [H]) = t 2 (s A [h], u H ) (h ∈ H)
y a ′ = x ′ ∧ w[a] (a ∈ A)
r a [A] = s A [a] (a ∈ A)
r a [H] = u H
u h = (x ′ ∧ w[h]) ∨ t 1 (s A [h], u H ) (h ∈ H)
(3)
This time the simulator Sim’ takes input (x ′ , w, y A , s A ) and outputs (x, r A , y
A ′ ). (See Figure 13
(right).) With these inputs and outputs, the simulator can directly set all variables except y h just
as in the real system (3). The simulator can also compute the value y h , but it cannot set y h directly
because this variable is defined by the ideal functionality as y h = x. We will prove that all variables
y h defined by (3) take the same value. It follows that the simulator can set x = y h for any h ∈ H,
18
12. An Equational Approach to Secure Multi-party Computation