Proof of Lemma 4 Sample Clauses

Proof of Lemma 4. 15. We prove this for a fixed value of h (say, h = 1), and the overall bound will follow via a union bound, via an additional multiplicative factor of n. Recall that Agree is the event that the union set S := QC ∪ QEnc ∪i/=1 QGeni agrees with g' , where QEnc, QC and QGeni 14Since g is chosen at random and has a sparse range, there will exist at most one pre-image, with all but negligible probability. are defined in Notation 4.12. First, notice that g' always agrees with QEnc, because the former has only g-type queries, while the latter has e-type queries. Thus, we need to bound the probability ' ' that for any (x →−g y) ∈ QC ∪i/=1 QGeni, either (x →−g ∗) ∈/ g or (x →−g y) ∈ g . We break up the event Agree into Agree1 and Agree2. We let Agree1 be the event QC agrees with g' , and let Agree2 be the event S' := ∪i=1QGeni agrees with g' . ˜ We first bound the probability of Agree1. Let P be the process performed in each itera- ˜ ' tion of Line 3 of Brk, namely the process of sampling a fresh (PK, ∗) and running (SK, g') →$ ConsOrc(PK, Freq, Forbid), and updating Forbid accordingly. Notice that (SK1, g ) of Line 4a of Brk is sampled according to the same process. We say an iteration of the process P is Good if either ˜ ˜

Proof of Lemma 4. 2.1 1 α δ First, we prove (a) and (b) of Lemma 4.2.1. Fix 0 < δ ≤ 1/3 and 0 < α ≤ 1. Inequality (4.8), with a = 0 and b = 1, gives that |R[n]| ≤ (1 + ) n , with log n δ probability 1 − O(1/n2), and hence, with probability 1 − O(1/n2), nδ log n δ

Proof of Lemma 4. 4.1 It suffices to show that there exists a positive constant c = c(b) such that for every sufficiently large n, S[n] ≤ cnν(log n)ρ. (4.12) To this end, we will consider the following steps:

Proof of Lemma 4. 2.2 (a) and (b)

Proof of Lemma 4. We use the auxiliary function in (4.4) to expand the following two parts, given by =¨λ⊤∇g (x) − λ′⊤∇g (x′)¨ ¨∇x At(x, λ) − ∇ ′ A (x′, λ′)¨2 t x t t 2 (a) 2 =¨A⊤(λ − λ′)¨ (M + N + 2MN )¨λ − λ′¨ , (4.30) ¨ ¨ ≤ t λ where (a) uses the Lemma 3. =¨g (x) − δαλ − g (x′) + δαλ′¨2 ¨∇λ t At(x, λ) − ∇ ′ A (x′, λ′)¨2 t =¨A(x − x′) − δα(λ − λ′)¨2 (b) ≤2 ¨A(x − x′)¨ + 2δ2 α2¨ λ − λ′ (c) ¨ ≤2(M + N + 2MN ) ¨x − x ′¨2 + 2δ2 α2¨ λ − λ′ , (4.31) ¨ 2 where (b) uses (a + b)2 ≤ 2(a2 + b2), (c) also uses the Lemma 3. Adding (4.30) and (4.31), we have (4.30) + (4.31) ¨ ¨ ¨ ¨ ≤2(M + N + 2MN ) x − x′ 2 + (M + N + 2MN + 2δ2α2) λ − λ′ 2

Proof of Lemma 4. Part (i): Let us focus on a single country which for the purpose of this proof I will call Home. The objective is to show that when other countries set import tariffs non-cooperatively, irrespectively of whether they use export subsidies or not, Home’s welfare is lower when it is using both tariffs and subsidies compared to when it is using tariffs only: WN (t,·) ≤ WN (t,·) . Assume that there are k other countries that have both import tariffs and export subsidies and (n − k − 1) other countries that only have import tariffs. (Notice that the case k = 0 corresponds to all other countries having import tariffs only. When k = n− 1, all other countries have both instruments.) First, I need to determine the equilibrium trade instruments for the two cases, then evaluate the welfare of the deviator. Each country maximizes its welfare taking the instruments of other countries as given and so we can use the first-order conditions (32) and (33). A country that has (not) an export subsidy is indicated by the subscript s (0).

Proof of Lemma 4. 16. We prove it for i = 1. The proof works exactly as that of bounding Pr[Agree1] in Lemma 4.15. So, we repeat the argument with the necessary modifications. Let P be the process performed in each iteration of Line 3 of Brk, namely the process of sampling a fresh (PK, ) and running (SK, gj) $ ConsOrc(PK, Freq, Forbid), and updating Forbid accordingly. Notice that (SK1, g1j ) of Line 4a of Brk is sampled according to the same process. We say an iteration of the process P is Good if either (a) the sampled gj in that iteration is empty; or (b) there does not exist a query/answer pair (∗ −→g pk) ∈ gj such that (∗ −→g pk) ∈ QA \ Freq. Otherwise, we say that iteration of P is Bad. The event Surprise1 is the event that the iteration corresponding to (SK1, g1j ) in Line 4a is Bad. Also, notice that since QC = λ, we have at most λ Bad processes. The reason for this is that if for some iteration the event Bad happens, then the particular public key pk of QC which caused Bad is added to Forbid, and so the same pk cannot make Bad happen in jη a future iteration. Now since the iteration for (SK1, gj) is the (γ + 1)’s iteration, where γ $ [ηj], the probability that that iteration is Bad is at most λ . Proof of Lemma 4.17. We show whenever the event Spoof holds, we can forge a public key pk in the sense of Lemma A.8, implying the bound of 1 . We build an adversary A in the sense of Lemma A.8, as follows. The adversary A 22λ PK PK ), which are the input to will generate all ( 1, . . . , n Brk, by running CRS ←$ CRSGeng(1λ) and (PKi, ∗) ←$ Initg(CRS). Then A performs the steps of Brk up until producing g1j , . . . , gnj – while populating Freq as in Brk’s procedure. At this point ∪ ∪ · · · ∪ notice that all queries made to g by A thus far are either contained in QA QGen1 QGenn or in Freq. Thus, if the event Spoof holds, then A has indeed forged a pk. ∧ ∧ ∧ ≤ Proof of Lemma 4.19. We claim Pr[Evnt2 Surprise Spoof Intersect] negl(λ). Assuming this, by Xxxxxx 4.16, 4.17, 4.14, 4.18 Pr[Surprise Spoof Intersect] nλ + 1 + 2n2λ1.1 + n2

Proof of Lemma 4. 8. In order to bound f for x1+s < |y| ≤ π, note that |Θ(w, z)| ≤ Θ(ρ, x) by (4.14), which also yields that log |H(w, z)| = R{log H(w, z)} ≤ log H(ρ, x) + R .w Σ e−nzΣ − ρ Σ e−nx. On the other hand, we have that R .w Σ e−nz Σ − ρ Σ e−nx n≥1 n≥1 n≥1 n≥1 . Σ ≤ −ρx2s−1 .β1−2se−β Σ To see this, note that 1 − e−β 1 − √1 − 2e−β cos β1+s + e−2β . R .w Σ e−nz Σ − ρ Σ e−nx n≥1 n≥1. Σ ≤ −ρe−x 1 − e−x 1 − √1 − 2e−x cos x1+s + e−2x . This then gives