Semantic security · the simulation paradigm

What the Simulator Knows

A simulator is a forger who has never seen the messages. Give it a short list of facts and let it invent the ciphertexts. The leftmost setting where nobody can tell its output from the real thing is exactly what the encryption leaks — and everything to the right of that point is information the scheme never revealed.

The encryption scheme

Slide right: what the simulator is allowed to know

Two worlds, same messages

the simulator never sees the left column

Message sent	Real · Enc(m)	Simulated · S(L)

Can an observer tell which world she is in?

0% · perfectly hidden100% · always caught

The implication

If such a simulator exists, then everything an observer could possibly extract from a real ciphertext, she could equally have extracted from a transcript produced without the message — from the list of facts alone. So no other information was ever there to extract.

a scheme leaks nothing beyond L if, for every efficient observer A,
there is an efficient simulator S with, for all messages m,

{ A sees Enc_k(m) } ≈_c { A sees S( L(m) ) }

semantic security is the case L(m) = |m|

The slider is that L. Finding where indistinguishability begins is not a proof technique — it is the definition of how much leaks.

Ciphertexts, simulator and observer on this page are real and run in your browser: the gauge is measured over 240 fresh trials each time you move the slider, not asserted.