Game G2. In that game, we are given a Xxxxxx-Xxxxxxx triple (A = gα, B = gβ, C = gγ) with the values α and β (and thus γ = αβ mod q), and define x α, y A = gα. Furthermore, any random exponent xi is defined by β + δi mod q, and yi Bgδi . As a consequence, αi is set to CAδi . This simulation is still perfect, as soon as a new random δi is drawn for any new xi: Pr[S2] = Pr[S1].
Game G2. In that game, we are given a Di e-Xxxxxxx triple (A = g ;B = g ;C = g ) with the values and (and thus = mod q), and de ne x , y A = g . Furthermore, any random exponent xi is de xxx by + i mod q, and yi Xx x . As a consequence, i is set to CA i . This simulation is still perfect, as soon as a new random i is drawn for any new xi: Pr[S2] = Pr[S1]:
Game G2. Building FM . In this game, we start modeling FM . First, we let c m f F maintain a list of tuples of the form (Pi, pwi). Upon receiving a query of the form (NewSession, sid, pwi, role) from party Pi, if this is the first NewSession- query, or if this is the second NewSession-query and there is a record (P1−i, pw1−i), then F records (Pi, pwi) and marks this record as fresh. In any case the query (NewSession, sid, Pi, pwi, role) is relayed to S. Now that F knows about pass-strings, we can add a TestPwd interface to F as described in Figure 2, using leakage functions LM , LM and LM . We let S parse outputs towards F as (NewKey, sid, Pi, ki) by adding F Z P the NewKey tag and the name of the party who produced the output. Additionally, we let translate this back to (sid, ki), send it to via i and xxxx the corresponding record as completed. None of these modifications changes the output towards compared to the previous game G1. P
Game G2. The adversary simulates 𝑆𝑒𝑛𝑑 and 𝐸𝑥𝑒𝑐𝑢𝑡𝑒 queries in a real attack to obtain <𝑚1 > and <𝑚2> messages, or tries to forge 𝐷𝑒𝑣. Thus, the probability of winning for the adversary is 𝐴𝑑𝑣 𝒜(𝑡) = 𝐴𝑑𝑣 𝒜(𝑡) (4)
