Extract adversary's secret input in simulation based security proofs I am trying to understand the simulation-based security proofs (as well as the UC framework), I find that there is a basic assumption when proving the security, i.e., the simulator could extract the secret input of corrupted parties, even if the corrupted parties' input is encrypted or in secret shared form. I have two questions:


Is there any additional requirement or restriction along with this assumption?
Why can/should we rely on this assumption? Currently, I only focus on the semi-honest setting. 


Any advice and explanation would be highly appreciated. Thanks.
@WYC, I suggest you take a look at the Lindell tutorial on https://eprint.iacr.org/2016/046.pdf 

To answer you #1 question, I'll get from that tutorial the following requirements for the simulator:


It must generate a view for the real adversary that is indistinguishable from its real view;
It must extract the effective inputs used by the adversary in the execution; and
It must make the view generated be consistent with the output that is based on this input.  


To answer your #2 question: the simulator is doing a mimic of the adversary. We can say it is a comparision: whatever the adversary do in the real world the (simulated) adversary must be able to do in the ideal world. Therefore, do not read this as a proof of the protocol's flaw. The point is: do you agree that the adversary chooses its inputs? So how simulate it in an indistinguishable way?