Correctness. If a process with identifier i performs Broadcast(m) in superround r ≥ T , then every cor- rect process performs Accept(m, i) during superround r.
Correctness. If Eve is passive, then Pr[kA = kB]= 1.
Correctness. For all ID, if the leader L is honest and all honest parties are activated on ID, all honest parties would output for ID.
Correctness. If the dealer is honest and inputs secret m in AVSS-Sh, then: • If all honest parties are activated to run AVSS-Sh on ID, all honest parties would output in the AVSS-Sh instance; • The value m∗ reconstructed by any honest party in the corresponding AVSS-Rec instance must be equal to m, for all ID.
Correctness. All the honest parties who terminate the protocol hold identical bit as the output. Moreover, if all the honest parties had the same input bit, say ρ, then all the honest parties output ρ upon termination. The above definition can be easily extended for A bits, where A > 1 and we call such a protocol a multi-bit ABA protocol.
Correctness. For proving the first part, it is clear that (i) the honest dealer must collect at least n f valid digital signature for (C ) from distinct parties to form valid Π and (ii) every honest party can eventually wait the shares of A(x) and B(x) as well as the same C . This implies that all honest parties can eventually broadcast the same Cipher messages, so they would broadcast the same Echo messages and the same Ready messages, thus finally outputting in the AVSS-Sh instance. ⊕ ⊕ For proving the second party, it is easy to see that (i) any honest party must output a ciphertext c same to the ciphertext computed by the honest sender and (ii) all honest parties must receive the same hash h of the commitment C to A(x), where A(x) is a polynomial chosen by the honest deader. Recall that we have proven that all honest parties can reconstruct a message c A(0), which exactly is m because c computed by the honest sender is m A(0).
Correctness. If both players are honest, then the protocol is correct with probability at least −
Correctness. If each Ui computes ski correctly, it implies that all members have security communications in the cloud meeting. Therefore, we trace the process of generating ski, and the resuls are correct: sk = (T (x) mod p)n ×( Taibiai+1 (x) mod p )n−1 × ( Tai+1 bi+1 ai+2 (x) mod p )n−2 i ai−1 bi−1 ai Ta b a (x) mod p Ta b a (x) mod p i−1 i−1 i × . . . × ( Tai+n−1 bi+n−1 ai+n (x) mod p i i i+1 ) Tai+n−2 bi+n−2 ai+n−1 (x) mod p = (Tai−1 bi−1 ai (x) mod p) ×(Taibiai+1 (x) mod p) × (Tai+1 bi+1 ai+2 (x) mod p) × . . . × (Tai+n−1 bi+n−1 ai+n (x) mod p) = (Ta1 b1 a2 (x) mod p) ×(Ta2 b2 a3 (x) mod p) × (Ta3 b3 a4 (x) mod p) × . . . × (Tanbnan+1 (x) mod p).
Correctness. In this section we prove the correctness of transaction execution by proving the following theorem. Theorem 1 Transaction execution preserves Invariant 1. Proof By assumption the invariant held before the execution of a transaction. At all sites where the transaction is not committed, the data values, history log, and reception vectors remain unchanged. Moreover data values, history log, and reception vectors of all objects not written by the transaction remain unchanged. Let us now consider a site p that committed a transaction (either during normal execution or during recovery after commit) and an object o written by the trans- action. Since the object is locked during transaction execution no other action on o besides those in the transaction is executed at site p. Since the entries of the reception vector for sites di erent from the transaction coordinator do not change, we have to prove only the following: ao 2 H , time(ao ) RV o [c], where c is the transaction coordinator.
