Moreover - does the exam style will be similar to moed a?

Thanks!

I think there is a mistake in the second term, and it should be $f_n(m')$ instead of $f_n(m)$. ]]>

I was wondering if the material from HW6 (FHE, FE, and IO) will be on the test. The previous tests didn't touch on this material, and the solutions for Homework 6 won't be published until after the exam. ]]>

My question is: assuming S' learns a witness, isn't it sufficient to claim the following general claim (not speicific to 3COL or the GMW protocol):

S' can output a view which is identically distributed as V*'s view, because it can run a full simulation of the protocol, i.e. simulate <P(w),V*>(x).

]]>Why is this difference?

]]>I think that I'm missing something in the definition of non-malleability— we require that for every message $m$ the adversary will succeed with negligible probability.

A silly example— fix any PKE that is CCA secure and define $f_n(x)$ to be 1 if $x=0^n$ and 0 otherwise. Then by defining $\cA$ on input $(pk, ct)$ to return the encryption of 1 under the public key, don't we actually succeed on every message which is not $0^n$ with very high probability? In fact it seems that for every function and any message we can construct an adversary which succeeds on the message.

What am I missing?

Thanks,

Eliran

The ref solution you published doesn't have it.

Thanks. ]]>

For example, if we encrypt message m=1 using sample e=0, when decrypting we get:

m' = -m mod q mod 2 = -1 mod q mod 2 = q-1 mod q mod 2 = q-1 mod 2 = 0

=> m' != m

What am I missing?

]]>If we assume that the parties are using a "good" MPC protocol, then $A^*$'s view should be computationally indistinguishable to that of the ideal world, right? In that ideal world both sections are easy, so what exactly do we need to prove? ]]>

1)In section a, can we assume a semi-honest protocol for any two-party **randomized** function?

2)In both sections, do we need to formaly prove the security of our scheme?

Thanks,

]]>Just for clarification, can you specify what happens in a case of a tie in the bids?

Also, can we assume that each of (A, B, C) gets back as output it's own bid? namely that

y

I don't understand what it means for $G_i$ to occur. ]]>

I don't understand what it means for $G_i$ to occur. ]]>

Thanks! ]]>