Preliminaries and Definitions. ≥ We denote the security parameter by κ, and assume 2κ > n κ. In all our distributed protocols, we implicitly assume parties take 1κ as input; in our definitions, we implicitly allow properties to fail with probability negligible in κ. We let ppt stand for probabilistic polynomial time. We use standard digital signatures, where a signature on a message m using secret key sk is computed as σ ← Signsk(m); a signature is verified relative to public key pk by calling Vrfypk(m, σ). We treat signatures as idealized objects with perfect unforgeability and correctness.
Preliminaries and Definitions. → We denote the security parameter by κ, and assume κ < n = poly(κ). In all our protocols, we implicitly assume parties take 1κ as input; in our definitions, we im- plicitly allow properties to fail with probability negligible in κ. We let ppt stand for probabilistic polynomial time. We use standard digital signatures, where a signature on a message m using secret key sk is computed as σ Signsk(m); a signature is verified relative to public key pk by calling Vrfypk(m, σ). For simplic- ity, we assume in our proofs that the adversary cannot forge valid signatures on behalf of honest parties. When replacing the signatures with real-world instanti- ations, our theorems follow except with an additive negligible failure probability.
