Cryptography Reference
In-Depth Information
(3) In case the first party is dishonest, it may instruct the trusted
party to halt, otherwise it always instructs the trusted party
to proceed. If instructed to proceed, the trusted party sends
the second output to the second party.
(4) Upon receiving the output-message from the trusted party,
the honest party outputs it locally, whereas the dishonest
party may determine its output based on all it knows (i.e.,
its initial input and its received output).
A
secure two-party computation allowing abort
is required to emulate this
ideal model. That is, as in Definition 7.1, security is defined by requir-
ing that for every feasible real-model adversary
A
,thereexistsafea-
sible ideal-model adversary
A
, controlling the same party, so that the
probability ensembles representing the corresponding (real and ideal)
executions are computationally indistinguishable. This means that each
party's “effective malfunctioning” in a secure protocol is restricted to
supplying an initial input of its choice and aborting the computation
at any point in time. (Needless to say, the choice of the initial input of
each party may
not
depend on the input of the other party.)
We mention that an alternative way of dealing with the problem of
premature suspension of execution (i.e., abort) is to restrict our atten-
tion to
single-output functionalities
; that is, functionalities in which only
one party is supposed to obtain an output. The definition of secure com-
putation of such functionalities can be made identical to Definition 7.1,
with the exception that no restriction is made on the set of dishonest
parties (and in particular one may consider a single dishonest party in
the case of two-party protocols). For further details, see (67, Sec. 7.2.3).
7.2
Some known results
We next list some of the models for which general secure multi-party
computation is known to be attainable (i.e., models in which one can
construct secure multi-party protocols for computing any desired func-
tionality). We mention that the first results of this type were obtained
by Goldreich, Micali, Wigderson and Yao (75; 124; 74).
