**On Expected Probabilistic Polynomial-Time Adversaries -- A suggestion for restricted definitions and their benefits**

*Oded Goldreich*

**Abstract: **This paper concerns the possibility of developing a coherent
theory of security when feasibility is associated
with expected probabilistic polynomial-time (expected PPT).
The source of difficulty is that
the known definitions of expected PPT strategies
(i.e., expected PPT interactive machines)
do not support natural results of the type presented below.

To overcome this difficulty, we suggest new definitions of expected PPT strategies, which are more restrictive than the known definitions (but nevertheless extend the notion of expected PPT non-interactive algorithms). We advocate the conceptual adequacy of these definitions, and point out their technical advantages. Specifically, identifying a natural subclass of black-box simulators, called normal, we prove the following two results:

(1) Security proofs that refer to all strict PPT adversaries (and are proven via normal black-box simulators), extend to provide security with respect to all adversaries that satisfy the restricted definitions of expected PPT.

(2) Security composition theorems of the type known for strict PPT hold for these restricted definitions of expected PPT, where security means simulation by normal black-box simulators.

Specifically, a normal black-box simulator is required to make an expected polynomial number of steps, when given oracle access to any strategy, where each oracle call is counted as a single step. This natural property is satisfies by most known simulators and is easy to verify.

**Category / Keywords: **foundations / Zero-Knowledge, secure multi-party computation, protocol composition, black-box simulation, reset attacks,

**Publication Info: **Will be posted also on ECCC

**Date: **received 17 Aug 2006

**Contact author: **oded goldreich at weizmann ac il

**Available format(s): **Postscript (PS) | Compressed Postscript (PS.GZ) | BibTeX Citation

**Version: **20060817:085936 (All versions of this report)

**Short URL: **ia.cr/2006/277

[ Cryptology ePrint archive ]