Ideal World. In the ideal world, a simulator interacts with an ideal functionality that executes the smart contract function f . All parties send their inputs to , then the function f is computed and the result returned to . The goal of simulation in the ideal world is for to simulate the adversary’s view in the real world i.e. it must produce a Init: Idealized Entity M : Inputs ← {} Input: Upon receiving (input, F, P, x) from P: Assert P ∈ P Remove (F, P, P, ·) from Inputs if it exists Inputs ← Inputs ∪ (F, P, P, x) If (Fj, Pj, Pj, xj ) ∈ Inputs ∧ y ← F (x1, . . . , xnt ) where nj = |P| Fj = F ∧ Pj = P for all Pj ∈ P : Send (output, F, P, y) to Pj for all Pj ∈ P designated function on inputs supplied by a set of parties, which are kept private.
Ideal World. In the ideal world P = ((π˜j)μ , P±), the view ν = (νc, νp, νk) consists of three lists of independent tuples: νc defines exactly q input-output ˜j $ pairs for π , νp defines exactly p input-output pairs for P, and νk consists of 1 μ μ random tuples (K ,L ),..., (K μ ,L ) ←— {0, 1}k × {0, 1}n. For counting, it is convenient to group the tuples in νc depending on the user index j and tweak value a¯. For J ∈ {1,..., μ} and T ∈7 , define qJ,T = |{(j, a¯, M, C) ∈ νc | j = J ∧ a¯ = T }| , where Σ(J,T )∈{1,...,μ}×T qJ,T = q. We obtain: $ Pr (D = ν)= Pr K′ ,...,K′ ←— {0, 1}k : K′ = K ∧ ··· ∧ K′ = K · 1 μ 1 μ Pr L′ ,..., L′ ←— 1 1 $ 1 μ
