7.7 Concepto de socioafectividad
7.7.1 Estrategias de manejo emocional
We can extend the previous construction to the semi-malicious case similarly as what we did in Section8. More precisely, we can construct a semi-maliciousk-round MPC from a semi-malicious
inner MPC (with an arbitrary number of rounds) and a semi-maliciousk-round OT.
Contrary to the 2-round case, the unique-answer distribution wD={wDλ,id}λ,iddoes not contain a single element for each (λ,id). Actually, we even need the index idto also contain a non-uniform poly-time interactive Turing machine A corresponding to the semi-malicious adversary playing
the role of the sender in the commitment (i.e., the receiver in the OT protocol). Apart from this subtlety, the construction is essentially a merge of the constructions in Sections8 and 9.1.
Let us give more details. Instead of using a k-round interactive functional commitment scheme,
we use ak-round semi-malicious equivocable interactive functional commitment scheme
Definition 9.3 (k-Round Semi-Malicious Equivocable Interactive Functional Commitment). Let
G={Gλ}λ∈Nbe a poly-size circuit class. Ak-round semi-malicious equivocable interactive functional
commitment (eiFC) scheme eiFC for G is a tuple of three polynomial-time interactive Turing machines and three polynomial-time algorithms eiFC = (eiFC.S,eiFC.R,eiFC.SimC,eiFC.FOpen,
eiFC.FVer,eiFC.SimD):
Commitment is performed via a (k−1)-round interaction between a sender eiFC.Son input the message to be committed v and with a random tape ρ ∈ {0,1}τ and a receiver eiFC.R on random tape ρ0 ∈ {0,1}τ0. The resulting commitmentc=heiFC.S(1λ, v;ρ),eiFC.R(1λ;ρ0)i is
the transcript of the interaction;
Functional Opening: d=eiFC.FOpen(c, G, y, ρ) is defined as FC.FOpenin Definition5.1;
Functional Verification: b=eiFC.FVer(c, G, y, d) is defined asFC.FVer in Definition5.1;
Commitment Simulation is performed via a (k−1)-round interaction between a simulated
sender eiFC.SimC and a non-uniform poly-time interactive Turing machine A: (c,trap) R
← heiFC.SimC(1λ), A(1λ)i where cis the transcript of the interaction and trapis an additional
output ofeiFC.SimC;
Commitment Equivocation: d ←R eiFC.SimD(c,trap, G, y) equivocates the commitment c and
output a functional decommitmentdof c toy forG∈ Gλ;
satisfying the following properties:
Correctness: For any security parameter λ∈N, for any v∈ {0,1}n, for any circuit G∈ Gλ, for
any ρ ∈ {0,1}τ, for any ρ0 ∈ {0,1}τ0, it holds that, if c ← hR eiFC.S(1λ, v;ρ),eiFC.R(1λ;ρ0)i,
then:
eiFC.FVer(c, G, G(v),eiFC.FOpen(1λ, G, v, ρ)) = 1 ;
Semi-Malicious Functional Binding: For any non-uniform poly-time interactive Turing ma-
chineAwith the semi-malicious property defined below, there exists a negligible function negl,
such that for anyλ∈N:
Prh
eiFC.FVer(c, G, y, d) = 1 and y6=G(v) : ρ0 R
← {0,1}τ0; (c,(v, ρ)) =hA(1λ),eiFC.R(1λ;ρ0)i; (G, y, d) R
The adversary Ais allowed to keep a state between the interaction with eiFC.Rand the guess stage. Furthermore it is supposed to be semi-malicious, namely, after each message sent to eiFC.R, it also outputs a valid witness (v, ρ) explaining all the previous messages. As with
semi-malicious adversaries for MPC, witnesses at each round do not need to be consistent. The last round witness is the second output ofhA(1λ),eiFC.R(1λ;ρ0)i.
Semi-Malicious Simulatability: For any non-interactive poly-time interactive Turing machine A, there exists a negligible function negl, such that for anyλ∈N:
PrA(d) = 1 : ρ R ← {0,1}τ; c R ← heiFC.S(1λ, v;ρ), A(1λ)i; G R ←A(1λ); d=eiFC.FOpen(c, G, v, ρ) − PrA(d) = 1 : (c,trap) R ← heFC.SimC(1λ), A(1λ)i; G R ←A(1λ); d R
←eFC.SimD(c,trap, G, G(v))
≤negl(λ) .
We then define the non-deterministic oracle familyOeiFCassociated toeiFCasOFCtoFC. Finally, we need to define the unique-answer distribution wDeiFC = {wDeFC
λ,A}, where λ ∈ N and A is a
non-uniform poly-time interactive Turing machine (as in the semi-malicious functional binding property), by defining wDeFC
λ,A to be:12 ((c, G), (y, d), aux=ρ, denc=ρ0) : ρ0 R ← {0,1}τ0; (c,(v, ρ)) =hA(1λ),eiFC.R(1λ;ρ0)i; G R ←A(1λ); y=G(v); d=FC.FOpen(c, G, v, ρ) .
Furthermore, we definek-round semi-malicious OT schemes similarly as in Definition9.2, except
that semi-honest receiver privacy and semi-honest sender privacy are replaced by the following properties:
Semi-Malicious Receiver Privacy: The following two distributions are computationally indis-
tinguishable: st : ρ0← {0R ,1}τ0; (t, x,st) =hA(1λ),OT.R(1λ,0;ρ0)i λ,A , st : ρ0 R ← {0,1}τ0; (t, x,st) =hA(1λ),OT.R(1λ,1;ρ0) i λ,A ;
where Ais a semi-malicious adversary playing the role of the sender (and outputting a state
st), i.e., Aoutputs a witness (x0, x1, ρ) after each message it sends to the receiver (as usual,
witnesses need to explain all the previous messages but do not need to be consistent with each other);
Semi-Malicious Sender Privacy: The following two distributions are computationally indistin-
guishable: st : ρ← {0R ,1}τ; (t, x,st) =hOT.S(1λ, x0, x1;ρ), A(1λ)i λ,x0,x1 , st : ρ← {0R ,1}τ; (t, x,st) =hOT.S0(1λ, x0, x1;ρ), A(1λ)i λ,x0,x1 ;
12For the security definitions to make sense, we suppose that the polynomial bounding the time ofA is fixed.
Another way to look at it would be to consider that the index contains a circuit Aλ, which can interact like an interactive Turing machine.
where Ais a semi-malicious adversary playing the role of the receiver and OT.S0 acts as OT.S except that before the last round it reads the witness tape (σ, ρ0) of the adversary and uses
as OT messages (xσ, xσ) instead of (σ0, σ1). We recall that we assume w.l.o.g. that the OT
messages are only used to generate the last round of the OT protocol and thusOT.S0 does not need to know them before.
A k-round semi-malicious eiFC with a WS can be constructed from ak-round semi-malicious
OT. The construction is a straightforward merge of the ones in Section 8.2 and in Section 9.1.3. A k-round semi-malicious OT is defined similarly as a k-round OT (Definition 9.2) except that
semi-honest receiver privacy and semi-honest sender privacy are replaced by semi-malicious ones: a semi-malicious adversary plays the role of the sender and of the receiver (respectively). In the case of sender privacy, the adversary playing the receiver can choosex0 and x1 after the last flow of the
receiver (i.e., the (k−1)-th flow). We recall that without loss of generality, we suppose that the
inputsx0 and x1 of the sender are only used in the last flow.
Then from a k-round semi-malicious eiFC with WS, we can construct GIC (with designated-
encrypted information) as in Section 9.1.2. And from this, following Section9.1.4, we can construct a k-round semi-malicious MPC (if we start from a semi-malicious inner MPC, instead of just a
semi-honest one). The security proof is very similar.