Corruption is not an interface that real protocols realize (what would a real protocol do when “instructed” to get corrupted?), but it must exist for emulation. We can assume real protocols always reject corruptions, but then they are never registered as corrupted.
We model corruptions as a global functionality \(\Corr \). Several machines have their full interfaces given outright rather than obtained from cores — the environment, the adversary, and the leakage operation of Section 3.2 — but \(\Corr \) is the only one that uses neither \(\opl {Silence}\) nor \(\opl {Mediate}\), and the status report is why: that wrapper reads the corruption status on every call, which is what this interface implements, so wrapping it would be circular. Each interface below therefore carries by hand only the checks it needs, and \(\fopl {Status}\) in particular always returns the corrupted set without first asking whether the party is corrupt.
Corruption register \(\Corr \)
\(\PID := C\), \(\Ps := \bits \cup \{A,Z\}\), \(\admits := \Stdpid \cup \Apid \cup \Zpid \), \(\uses := \emptyset \), \(\pars := \none \)
\(\op {Initialize}()\):
\(\id .\fopdef {Corrupt}()\) from \(\id '\)
\(\id .\fopdef {Status}()\) from \(\id '\)
\(\id .\fopl {Leak}()\) from \(\id '\)
\(\Corr \)’s own leakage is constant, so the corruption test that Section 3.2 imposes on every other leakage operation would have nothing to protect; the guard is kept all the same, so the adversary reads the register at the party it is acting for and at no other.
Reading the register. \(\Cs \) is \(\Corr \)’s own state, so no other machine holds a copy. Wherever \(\Cs \) appears in the code of a functionality other than \(\Corr \) itself, the understanding is that it was fetched first, by
and we suppress that line when it would only repeat what the surrounding code makes plain. Inside \(\Corr \) there is nothing to fetch: \(\Cs \) is read and written directly, and \(\op {Corrupt}\) updates it in place.
Remark 3.1 (Why \(\fopl {Status}\) is not mediated). Wrapped like the other operations, \(\fopl {Status}\) would be useless exactly when it matters. Suppose \(\Zenv \) reaches out as \(\id '\) to ask the corruption status of \(\id '.P\). If \(\id '.P\) is corrupt, the gate lets the call through and \(\opl {Mediate}\) hands it to the adversary — so the answer to “is \(\id '.P\) corrupt?” is whatever the adversary says, and it may say no. Since every caller reads the register to decide how to treat a corrupt party, an adversary-controlled answer would switch the mediation machinery off at will.
\(\fopl {Status}\) therefore mediates and silences nothing: past the guard it returns \(\Cs \), the register’s own state. It is the one operation whose answer must come from the register, and being read-only it gives the adversary nothing it could not already infer. The core \(\op {Status}\) of earlier drafts goes with it, there being no wrapper left to keep out of.
Corruption is the outside’s to do. Line 3 admits \(\id '.F \in \{A,Z\}\), so the adversary and the environment may each put a party into \(\Cs \) and no standard functionality may put anything there at all. The guard above it binds the corrupting interface to the party it corrupts, asking \(\id '.P = \id .P\): to corrupt \(P\) the adversary must run at \((A,P)\), and the environment must claim \((Z,P)\), which line 3 lets its root do for any party. Both may read as well: \(\Apid \cup \Zpid \subseteq \Corr .\admits \), and \(\fopl {Status}\) returns all of \(\Cs \), so either may ask at any point and always learns the full set. And only genuine parties can be corrupted: \(\fopl {Corrupt}\) asks \(\id .P \in \bits \), so the reserved names stay honest by construction.
Commensurateness comes out right, and it is the reading that secures it rather than any division of who may write. The machine at \((A,P)\) is \(\Adv \) in one execution of an emulation experiment and \(\Sim \) in the other, and nothing forces the two to corrupt the same parties. But \(\Zenv \) is the same machine on both sides and reads \(\Cs \) on both, so an occupant of the slot corrupting a different set is caught by an environment that simply asks. Commensurateness is thus a consequence, not an assumption: no admissible environment tells the two corruption sets apart with advantage beyond what Definition 4.11 allows the simulator. That the environment may corrupt for itself only sharpens this, the corruptions it makes being its own on both sides; what is left to catch is the occupant’s own initiative.
Corruption is indexed by party name alone, so \(P\) cannot be corrupt at one process id and honest at another.1