Chapter 15 needs a promise the framework has so far had no way to write down. When \(\op {Sign}\) asks the adversary for a signature it must get one back, and get it back now: were the adversary free to go off and drive the rest of the execution before answering, the party would be left suspended mid-signature and locality lost — the same immediacy synchronous UC asks of a responsive environment [11]. The text there settles for restricting the simulator class. This chapter says the thing in code instead.
What has to be forbidden. Not that the adversary answer helpfully — it may return anything, and Chapter 12 deals with a bad answer. What has to be forbidden is the token leaving: between receiving the call and returning, the responder must place no call at all. That is a restriction on the calls a machine makes, and the paper already has a wrapper for exactly that.
Definition 9.1 (Responsive answering). \(\opl {Respond}\) is \(\opl {Silence}\) at its maximum: with \(\Ids _{\op {all}}\) the set of all identities,
Every claim lies in \(\Ids _{\op {all}}\), so by Chapter 2 every call the wrapped programme issues is refused with \(\rej \) without ever being placed. The programme may compute as long as it likes and must still return a value; what it cannot do is hand the token on.
Wrapper \(\opdef {Respond}\)
programme \(\id .\Op (in)\) from \(\id '\)
\(\opl {Respond}\bigl (\id .\Op (in) \text { from } \id ' \bigr )\):
Read as a handler. Written out, \(\opl {Respond}\) is \(\opl {Silence}\) with its last clause deleted. The wrapper \(\opl {Silence}\) forwards a call whose claim it permits, so its operation clause is partly a re-raise; \(\opl {Respond}\) has no re-raise, only a constant. In the vocabulary of Chapter 2 it discharges the ambient call effect rather than forwarding it: inside its scope the effect is handled locally and completely, so the wrapped programme is pure with respect to it. It is also the definition of locality, the property Chapter 15 wanted: a call on the slot is served within the responder’s own activation, the token never leaving it. That is the crisp statement of responsiveness — a responsive core is one whose call effect does not escape to \(\opl {Exec}\) — and the operational reading follows, since \(\opl {Exec}\) dispatches exactly the calls that do escape. A responsive call is one activation of the responder and no more.
Definition 9.2 (Responsive interface, responsive call). The adversary carries, beside \(\fopl {A}\), a second interface \(\fopl {A}^{!}\) with the same guard and the same core but \(\opl {Respond}\) in place of \(\opl {Silence}\):
A responsive call is a call on \(\fopl {A}^{!}\). Inside an interface with identity \(\id \) we write \(\Adv ^{!}(in)\) for \((A,\id .P).\fopl {A}^{!}(in)\) as \(\id \), as \(\Adv (in)\) abbreviates the ordinary one.
Three things follow, and they are the price.
The responder cannot read the register. The set \(\Cs \) is reached by calling \(\fopl {Status}\), and that call is refused, so a responsive answer is computed from what the responder already knows. It cannot delegate: no subroutine, no other party, no environment. And it cannot corrupt, \(\op {Corrupt}\) being a call like any other. The last deserves stating on its own, because Section 3.5 reads the register twice and the gap between the two reads is exactly where a corruption can slip in.
Proof. By Section 3.1, \(\Cs \) changes only on line 5 of \(\fopl {Corrupt}\), and only when that interface is reached by a call. Between the placing and the return of a responsive call the responder holds the token throughout, and by Definition 9.1 every call it issues is refused before being placed, so \(\fopl {Corrupt}\) is not reached. No other machine holds the token in that interval, so none can reach it either. □
So if a core reaches the adversary only through \(\Adv ^{!}\), the party it serves is corrupt at line 7 exactly when it was corrupt at line 3, and the second mediation hook cannot fire on account of that call. Remark 3.2 describes what happens when it does; responsiveness is the condition under which it does not.
This is what Chapter 15 wanted. Writing \(\Adv ^{!}\) in place of \(\Adv \) in \(\op {Gen}\), \(\op {Sign}\) and \(\op {Verify}\) makes locality a property of the code rather than a condition on the simulator class, and the wrapper enforces it, so it holds of every occupant of the adversary slot — the simulator included, Definition 4.7 giving a simulator the adversary’s interfaces, \(\fopl {A}^{!}\) among them. What it does not do is make the answer good: a responsive adversary may still return \(\none \), and \(\San \) repairs that. Responsiveness buys the token back; sanitization buys the value.
Remark 9.4 (Responsiveness and the dummy). The two chapters pull against each other, and it is worth being explicit about where. The dummy of Section 4.4 answers a call from a functionality by relaying it to the environment on line 5 — and that is a call, which \(\opl {Respond}\) refuses. So \(\Dum \) cannot serve a responsive call: the relay is refused, and the rule of Section 3.6 delivers its answer as \(\none \) where a real adversary would answer with substance. The regrouping (R1) would therefore fail for a system whose cores use \(\Adv ^{!}\), at the first responsive call — which is why Theorem 4.29 hypothesises systems whose cores place none. Recovering completeness for responsive systems needs a matching notion on the environment’s side, so that the relayed question can be answered without the token moving on; we leave that open.