A problem exists with the security proof in the secure AND example in the malicious model Imagine that the malicious adversary in the real world uses $Y = 0$ as its input, therefore he computes the output as ($X$ &amp;&amp; $y=0$) = $0$. We can conclude that the real view in the real world is as:

Real view: $X, Y = 0$ and $output = 0$ 

Real World

 

Now, imagine the simulator wants to simulate the real world’s view in the ideal world. In order to simulate $x$ (honest party’s input), the simulator must send $1$ to the trusted party and then receives $x$ from it. Thus the simulator succeeded to simulate $X$, but now the simulator computes the output as
 $X$ &amp;&amp; $(Y = 1)$ = $X$, which is not the equal of the output in the real view $X$ &amp;&amp; $0$ = $0$. Thus the simulator cannot simulate the output in the ideal model.

Ideal World



Definition 2.3.1 in the malicious model



The definition says that for every adversary A for the real model must exist a simulator S for the ideal model. Considering this definition, I could find an adversary (who sends $y = 0$ in the real world) that there is no any simulator for it, so the protocol is not secure in the malicious model. In the Lindell’s book-page 27 (the below proof), it is said that this protocol is secure!!! I am so confused. (I found a scenario where the protocol is not secure).

Proof of the protocol
If I understand correctly, you consider an adversary $\mathcal A$ corrupting $P_2$ in the real world, and which ignores $P_2$'s input $y$ and just outputs $0$ regardless of the value $x$ sent by $P_1$, is that right? And you claim that this adversary is not simulatable.

Well, of course this adversary is simulatable: the simulator sends whatever to the trusted party, receives whatever, and outputs $0$.

The proof, by the way, shows more: it shows how to construct a simulator for any adversary, as follows. In the real world, the adversary receives $x$, performs whatever computation based on $x$, $y$, and its auxiliary output $z$, and outputs the result. The simulator sends $1$ to the trusted party, receives $x$, performs the same computation as the real-world adversary, and outputs its result.