UC MPC ⇒ MPC

Fully-black-box reduction · standard model · Can01 · security loss: none

Statement

Let a protocol UC-realize the functionality that computes $f$ and lets the adversary withhold any honest party’s output, against static malicious corruption of up to $n-1$ parties (UC MPC). Run in synchronous rounds, it securely computes $f$ in the stand-alone sense with that per-party abort: UC security implies stand-alone security — Can01. Followed by one round in which every party broadcasts whether it received its output, every honest party outputting its value only if all parties announced success, it securely computes $f$ with unanimous abort (MPC) — folklore.

Sketch

For a stand-alone adversary $\mathcal{A}$, the stand-alone simulator is the UC simulator for $\mathcal{A}$: the environment that hands the parties the inputs chosen by a stand-alone distinguisher $\mathcal{D}$, stays silent during the execution, and applies $\mathcal{D}$ to the output of $\mathcal{A}$ and the honest parties’ outputs distinguishes the real UC execution from the ideal one with the advantage of $\mathcal{D}$ — Can01. In the final round the simulator announces success for the honest parties whose outputs the UC simulator releases, sees the corrupted parties’ announcements, and lets the trusted party deliver to all honest parties exactly when every announcement is a success — standard.