Pk RecVCORE Sample Clauses

Pk RecVCORE. In this case, ƒ k(x) is the out- put of the instance DeComk. If Pk is honest then clearly ƒ k(x) = ƒk(x), as the (correctness) prop- erty of DeCom ensures that if Committer is honest, then the polynomial (of degree at most t) committed by him during the Com protocol, will be obtained as the output during DeCom. On the other hand, if Pk is corrupted, then also ƒ k = ƒk(x), except with prob- ability ϵ′; this is because the (correctness) property of DeCom ensures that if Committer is corrupted and the output of DeCom is a polynomial of degree at most t, then except with probability ϵ′, the same polynomial was committed during the Com protocol. Moreover, as discussed above the polynomial com- mitted by a corrupted Pk ShVCORE during Comk is the same as ƒk(x).

Pk RecVCORE. In this case, ƒ k(x) is computed by interpolating the points (j, ƒk(j)) , where Pj RecVCORE, Pj WCOREk and Pj has (correctly) revealed the secondary signature ICSig(Pk, Pj, , ƒk(j)) on the AWC-share ƒk(j), which was given to Pj by Pk during the instance Comk. Moreover the revealed ƒk(j) lies on the share ƒ j(x), where ƒ j(x) is computed as the share on the behalf of Pj dur- ing Rec; i.e. ƒk(j) = ƒ j(k). We first notice that there will be at least t + 1 such interpolating points (j, ƒk(j)) . This follows from the fact that Pk ShVCORE implies that during Sh, ShVCORE WCO REk 2t + 1 and at least t + 1 of these common parties (which were present in ShVCORE as well as in WCOREk) will be present in RecVCORE. Now we have already shown in the previous case that the share ƒ j(x) computed on the behalf of each Pj RecVCORE is the same as the original share ƒj(x) except with probability ϵ′; i.e. ƒ j(x) = ƒj(x) = F (x, j). Now the fact that for each interpolating point (j, ƒk(j)) used to interpolate ƒ k(x) the relation ƒk(j) bits and broadcast of O(n3 log 1 ) bits. Protocol Rec re- quires a broadcast of O(n3 log 1 ) bits. є є PROOF: During the protocol Sh, D distributes n univari- ate polynomials of degree at most t as shares and n in- stances of Com are executed. During the protocol Rec, at most n instances of DeCom and at most n2 instances of RevealPublic are executed. The proof now follows from The- orem 2 by substituting l = 1, Theorem 3 and from Lemma 8-10. 2