Cryptography Reference
In-Depth Information
In the
real model
the adversary controls some of the parties in an exe-
cution of Π and all parties can communicate with an arbitrary
probabilistic polynomial-time process, which is called an
envi-
ronment (
and possibly represents other executions of various
protocols that are taking place concurrently
)
. Honest parties
only communicate with the environment before the execution
starts and when it ends; they merely obtain their inputs from
the environment and pass their outputs to it. In contrast, dis-
honest parties may communicate freely with the environment,
concurrently to the entire execution of Π.
In the
ideal model
the
(simulating)
adversary controls the same par-
ties, which use an ideal
(trusted-party)
that behaves accord-
ing to the functionality
f
(as in Section 7.1.2). All parties
can communicate with the
(same)
environment
(as in the real
model)
. Indeed, the dishonest parties may communicate exten-
sively with the environment before and after their single com-
munication with the trusted party.
We say that Π
is an environmentally-secure protocol for computing
f
if
for every probabilistic polynomial-time adversary
A
in the real model
there exists a probabilistic polynomial-time adversary
A
controlling the
same parties in the ideal model such that no probabilistic polynomial-
time environment can distinguish the case in which it is accessed by
the parties in the real execution from the case it is accessed by parties
in the ideal model.
As hinted above, the environment may account for other executions
of various protocols that are taking place concurrently to the main exe-
cution being considered. The definition requires that such environments
cannot distinguish the real execution from an ideal one. This means
that anything that the real adversary (i.e., operating in the real model)
gains from the execution and some environment, can be also obtained
by an adversary operating in the ideal model and having access to the
same environment. Indeed, Canetti proves that environmentally-secure
protocols are secure with respect to concurrent compositions (34).
It is known is that environmentally-secure protocols for any func-
tionality can be constructed for settings in which more than two-thirds
