Proof of Lemma 2. We now prove Lemma 2. To do so, we first argue that all parties associated to leaves in the challenge graph belong to the group as viewed by the party generating the challenge key.
Proof of Lemma 2. We need to show that, for p ≥ n—3/4+δ, where δ > 0 is fixed, we have X4 = n3p4(1/12 + o(1)) w.o.p. We first estimate the expecta- tion µ(X4) of X4. Suppose {i, j, k, l} ∈ S4 with 0 ≤ i < j < k < l ≤ n − 1. Note that i+l = j +k. Let us fix 0 ≤ i ≤ n−1. If j ≥ (n+i)/2, then l = j +k−i > 2j−i ≥ n + i − i = n, which contradicts l ≤ n − 1. Hence we have i < j < (n + i)/2. For fixed i and j, if k > n + i − j − 1, then l = j + k − i > n − 1, which contradicts l ≤ n − 1. Therefore we have j < k ≤ n + i − j − 1. Once i, j and k are chosen, the value of l is determined by the condition i + l = j + k. Consequently, Σ Σ n—1 (n+i)/2 n+i—j—1 n—1 (n+i)/2 |S4| = Σj=i Σk=j 1 = Σj=i (n + i − 2j) ∫ 1 ∫ (1+x)/2 1 3 0 x n (1 + x − 2y)dydx ∼ 12 n , where for the first identity we ignore the floors or ceilings. Hence 12 µ(X ) = |S |p4 = 1 + o(1) n3p4. (2.53) Next we apply Theorem 2.5.5 to prove that X4 is concentrated around its ex- pectation µ(X4). To this end, we compute the quantities Ei (1 ≤ i ≤ 4) and Er and E defined in (2.52). We first estimate E1. For a ∈ [n], consider the quantity E{a}. The number of hyperedges in S4 containing a is O(n2) and the probability that one such hyperedge is in [n]p, conditioned on a ∈ [n]p, is p3. We conclude that, for any a ∈ [n], we have E{a} = O(n2p3). Con- sequently, E1 = max{EA : |A| = 1} = O(n2p3). A similar argument gives that Ei = max{EA : |A| = i} = O(n3—ip4—i) for all 1 ≤ i < 4. There- fore, since np 1, we have Ei = O(n2p3) for all 1 ≤ i < 4. Also, clearly, E4 = max{EA : |A| = 4} = 1. Thus Er = max{Ei : 1 ≤ i ≤ 4} = O(max{n2p3, 1}), (2.54) and E = max{Er, µ(X4)} = O(max{n2p3, 1, n3p4}). Since p ≥ n—3/4+δ > n—3/4, we have E = O(n3p4). (2.55) In view of (2.54) and (2.55), a simple computation implies the following: (Case I) If n—3/4+δ ≤ p ≤ n—2/3, then Er = O(1) and E = O(n3p4). (2.56) (Case II) If p ≥ n—2/3, then Er = O(n2p3) and E = O(n3p4). (2.57) We now estimate X4 for each case separately. (Case I) Suppose n—3/4+δ ≤ p ≤ n—2/3. In this case, (2.56) implies that (EEr)1/2 = O(n3p4 · 1)1/2 = O(n3p4)1/2. (2.58) Set λ = (n3p4)1/12. By the assumption p ≥ n—3/4+δ, we have λ = (n3p4)1/12 ≥ nδ/3. (2.59) Also n3p4 ≥ n4δ 1, and hence combining (2.58) and λ = (n3p4)1/12 implies that
Proof of Lemma 2. Part 1. In a star polyad, if a member fails to repay, the chance that his peers pay for him depends on whether he is the core member or one of the n— 1 periphery members. Thus, the chance of game continuation for a star polyad can be written as follows. +✓n — 1◆αn—2 (1 — α)2 σ2 n—3 + ✓n — 1◆αn—2 (1 — α)2 β1 n—2 Qs = αn + ✓n — 1◆αn—1 (1 — α) σ1 n—2 + αn—1 (1 — α) (1)n—1
Proof of Lemma 2. When A makes a SendUser( ∏s , Start) query, if the query is asked in the l-th session, B chooses a random number r and computes X = tP, Y = rP and returns <IDU, (X, Y)>. Otherwise, B finds <IDα, qα> in LH, chooses random num- Proof. To compute z = H (t ||X ||X ||Y ||SID ) bers a, h1, vU, and computes QS = sP + q0P, X = S 1 U U S U US ( + ) 1 a to pass the verification, A has to ask the H1 hash query oracle for (tU||XU||X S||YU||SIDUS ) , and hence aQS, Y = a s + qα P , tα = e(P, P) . Then B A needs to compute tU first. Then we can construct an attacker B to breaks the k-mBIDH problem by using A with non-negligible probability. B is given an instance of the k-mBIDH problem ( eˆ , G1, G2, P, adds (tα, h1) and (h1, vα) to LH1 and returns <IDα, X, Y, vα>. – When A makes a SendServer( ∏s , (IDβ, X, Y, vβ)) query, B chooses random numbers z and Xα, 1 P , 1 returns <z,Xα> and adds <(tβ|| X|| Xα|| Y||SIDβα), s + q1 s + q2 z> to LH1 .
