<p>To prove a protocol secure in the computational model, one can use game-based approach or the simulation approach (I just assume these two models for simplicity).  </p>

<ul>
<li><p>In the game based approach, the security of the mentioned protocol is verified through some games between parties or between parties and algorithms (oracles). This approach usually gives us a lower bound on the communication effort for the protocol.</p></li>
<li><p>The second approach is through an ideal functionality or a trusted third party which acts as a paradigm for what we seek from meaning of security when running that protocol. This is usually called 'the Ideal/Real Paradigm'. In this approach a $\mathcal{PPT}$ (probabilistic polynomial time) machine which we call it 'the simulator' is responsible for generating the interaction between parties while running the protocol such that no other $\mathcal{PPT}$ machine (called distinguisher) can have any advantage greater than 0.5 to distinguish between the real interaction and the simulator made interaction. In this way we have proven the protocol secure by just comparing it to what is ideal when defining security of that protocol.  </p></li>
</ul>

<p>In the Ideal/Real paradigm, when proving a protocol secure some times the simulator must use some special  types of primitives. For example, when facing an adaptive adversary (fully capable adversary), we may use <a href="http://www.wisdom.weizmann.ac.il/~naor/PAPERS/nce_abs.html" rel="nofollow">non-committing encryption</a> or <a href="http://www.google.com/url?sa=t&amp;source=web&amp;cd=2&amp;sqi=2&amp;ved=0CBkQFjAB&amp;url=http%3A%2F%2Fwww.cs.umd.edu%2F~jkatz%2Fgradcrypto2%2FNOTES%2Flecture1.pdf&amp;ei=wyP6TInAGcWhOp6itf8P&amp;usg=AFQjCNFoNyC3tffRR_JzBn1sa2kfwY0PtA" rel="nofollow">trapdoor permutation</a> or some other forms of equivocal primitives to provide the same view as the real world.  </p>

<blockquote>
  <p>Question: What does it mean to use a equivocal primitive? What is the practical point of that? Do we use these primitives in practice?  can you name some?</p>
</blockquote>

<p>As a side note, I found some good issues on this in the <a href="http://www.google.com/url?sa=t&amp;source=web&amp;cd=2&amp;ved=0CBkQFjAB&amp;url=http%3A%2F%2Fwww.daimi.au.dk%2F~ivan%2Fpositionpaper.pdf&amp;ei=QDX6TKnAKZGx8QOe_YzyCw&amp;usg=AFQjCNHZjG-T7Ntpcas9YnWb3PUDV3zbTg" rel="nofollow">response of Damgard to Koblitz Controversy</a>. [I just noticed that this forum is <strong>Theoretical</strong> Computer Science, but I have asked something practical]</p>

<p><strong>Edit:</strong> I may explain more on the non-committing encryption here to clarify my question. Let start an example; In a secure multi-party computation, the best way of communication is through secure channels. A secure channel by definition is the one in which the full-fledged adversary which controls the whole communications cannot see the messages. What does is it mean not to see the communication where all communications are visible to adversary and actually if she decides to put an end to a conversation, she can do it easily by dropping messages. The point is, informally when a non-committing encryption is used over a channel it makes the channel a secure channel because every permutation of an encrypted message is possible now. Remember that a non-committing encryption is the one in which a receiver can open a ciphertext bit to "0" or "1" as he wishes. As a naive example, consider one-time-pad and suppose your ciphertext is, say, 111; One can open it to every permutation of 3 bits length. So when this kind of ciphertext is at hand, the adversary can infer nothing out of it and it is equivalent to not receiving such a ciphertext at all.</p>

CC BY-SA 2.5
2010-12-04T12:51:16.147Z
Yaser, I think it would be nice if you add some motivation part to your questions and tell us why you are interested in them, that would make them more interesting to us also. Please read [How to ask a good question?](http://meta.cstheory.stackexchange.com/questions/300/how-to-ask-a-good-question).
Kaveh
CC BY-SA 2.5
2010-12-04T15:34:46.663Z
@Kaveh: it is edited now. Most of these comments are some ordinary definitions that every one that has studied computational models know them. Since my question is not an easy one, I assumed that the one who can answer it must know these basics. But you are right. Please let me know if it is not enough.
Yasser Sobhdel
CC BY-SA 2.5
2010-12-05T14:59:24.717Z
Thanks Yaser for reading the meta post I have linked to, but I think you misunderstood me, I was talking about why *you* are *personally* interested in the question, e.g. are you working on a problem which is related to this question? I think providing some information on why you are asking a question helps in getting others spend time on it since they will know that the question is important for you and not just another question, specially when the question is not easy to understand/answer.
Kaveh
<cr.crypto-security>
Equivocal primitives in practice
Yasser Sobhdel
# Equivocal primitives in practice

(Asked by: username_0 on 2010-12-04)

To prove a protocol secure in the computational model, one can use game-based approach or the simulation approach (I just assume these two models for simplicity).

* In the game based approach, the security of the mentioned protocol is verified through some games between parties or between parties and algorithms (oracles). This approach usually gives us a lower bound on the communication effort for the protocol.
* The second approach is through an ideal functionality or a trusted third party which acts as a paradigm for what we seek from meaning of security when running that protocol. This is usually called 'the Ideal/Real Paradigm'. In this approach a $\mathcal{PPT}$ (probabilistic polynomial time) machine which we call it 'the simulator' is responsible for generating the interaction between parties while running the protocol such that no other $\mathcal{PPT}$ machine (called distinguisher) can have any advantage greater than 0.5 to distinguish between the real interaction and the simulator made interaction. In this way we have proven the protocol secure by just comparing it to what is ideal when defining security of that protocol.

In the Ideal/Real paradigm, when proving a protocol secure some times the simulator must use some special types of primitives. For example, when facing an adaptive adversary (fully capable adversary), we may use [non-committing encryption](http://www.wisdom.weizmann.ac.il/~naor/PAPERS/nce_abs.html) or [trapdoor permutation](http://www.google.com/url?sa=t&source=web&cd=2&sqi=2&ved=0CBkQFjAB&url=http%3A%2F%2Fwww.cs.umd.edu%2F~jkatz%2Fgradcrypto2%2FNOTES%2Flecture1.pdf&ei=wyP6TInAGcWhOp6itf8P&usg=AFQjCNFoNyC3tffRR_JzBn1sa2kfwY0PtA) or some other forms of equivocal primitives to provide the same view as the real world.

> Question: What does it mean to use a equivocal primitive? What is the practical point of that? Do we use these primitives in practice? can you name some?

As a side note, I found some good issues on this in the [response of Damgard to Koblitz Controversy](http://www.google.com/url?sa=t&source=web&cd=2&ved=0CBkQFjAB&url=http%3A%2F%2Fwww.daimi.au.dk%2F~ivan%2Fpositionpaper.pdf&ei=QDX6TKnAKZGx8QOe_YzyCw&usg=AFQjCNHZjG-T7Ntpcas9YnWb3PUDV3zbTg). [I just noticed that this forum is **Theoretical** Computer Science, but I have asked something practical]

**Edit:** I may explain more on the non-committing encryption here to clarify my question. Let start an example; In a secure multi-party computation, the best way of communication is through secure channels. A secure channel by definition is the one in which the full-fledged adversary which controls the whole communications cannot see the messages. What does is it mean not to see the communication where all communications are visible to adversary and actually if she decides to put an end to a conversation, she can do it easily by dropping messages. The point is, informally when a non-committing encryption is used over a channel it makes the channel a secure channel because every permutation of an encrypted message is possible now. Remember that a non-committing encryption is the one in which a receiver can open a ciphertext bit to "0" or "1" as he wishes. As a naive example, consider one-time-pad and suppose your ciphertext is, say, 111; One can open it to every permutation of 3 bits length. So when this kind of ciphertext is at hand, the adversary can infer nothing out of it and it is equivalent to not receiving such a ciphertext at all.

**Tags:** cr.crypto-security
> **Comments:**
> **username_1**: Yaser, I think it would be nice if you add some motivation part to your questions and tell us why you are interested in them, that would make them more interesting to us also. Please read [How to ask a good question?](http://meta.cstheory.stackexchange.com/questions/300/how-to-ask-a-good-question).  
> **username_0**: @Kaveh: it is edited now. Most of these comments are some ordinary definitions that every one that has studied computational models know them. Since my question is not an easy one, I assumed that the one who can answer it must know these basics. But you are right. Please let me know if it is not enough.  
> **username_1**: Thanks Yaser for reading the meta post I have linked to, but I think you misunderstood me, I was talking about why *you* are *personally* interested in the question, e.g. are you working on a problem which is related to this question? I think providing some information on why you are asking a question helps in getting others spend time on it since they will know that the question is important for you and not just another question, specially when the question is not easy to understand/answer.  

---

## 0 answers

