Proof of Proposition 4. 5.5. Let B > 0 be a bound to be tuned later. Consider the sets of prime numbers P1 = {ℓ | ℓ is an odd prime factor of Disc(O) and ℓ ≤ B}, and P2 = {ℓ | ℓ is an odd prime factor of Disc(O) and ℓ > B}. O ∈ O ≤ ∈ ℓi | ℓi ≤ 2ω(D)−i For each ℓ P1, compute χℓ([c]) in time ℓO(1) using Theorem 4.4.1 and the fact that (E′, ι′) = [c](E, ι). Now, with [3], one can compute square roots in Cl( ) in polynomial time, so we get an ideal a such that [a] and [c] differ by a two-torsion factor. From [3], one also gets a basis of Cl(O)[2], so we can ensure that χℓ([a]) = χℓ([c]) for each ℓ ∈ P1. The solution is now of the form [c] = [a][b] where [b] is in the subgroup G of Cl(O)[2] of classes such that χℓ([b]) = 1 for all ℓ P1. Therefore, the number of remaining candidates for the class [c] is #G 2#P2+1. These can be enumerated (from the basis of Cl( )[2], deduce a basis of the subgroup G) and checked for correctness in polynomial time using Proposition 4.5.6 and the provided basis of End(E). Overall, the running time is polynomia l in log p, log | Disc(O)|, B, an d 2#P2 . The running time follows by choosing B = min 2ω(D), maxi . ω(D) i ω(D) i Let us prove the last inequality. First, 2ω(D) ≪ #(Cl(O)[2]), so B ≪ #(Cl(O)[2]). Second, if {ℓi | ℓi ≤ 2ω(D)−i} is empty, then 2ω(D)−1 < ℓ1 ≤ ℓω(D) so 2ω(D) ≪ ℓω(D). If it is not empty, clearly maxi ℓi | ℓi ≤ 2 − ≪ ℓω(D). In both cases, we deduce B ≪ ℓω(D). Lastly, it remains to see that B ≪ LD(1/2). Suppose there exists j such that xx = maxi ℓi | ℓi ≤ 2 − . We have log2(xx) ≤ ω(D) − j, and ω(D) log2(D) ≥ i=Σj+1 log2(ℓi) ≥ (ω(D) − j) log2(xx) ≥ log2(xx)2. 8With the convention that max(∅) = +∞. Reductions to endomorphism ring computation
Proof of Proposition 4. It is immediate from the definition of SMQV that if two honest parties complete matching sessions, they compute the same session key. Suppose an attacker A, which succeeds with probability significantly greater than 1/2 in distinguishing a fresh session key from a random value chosen under the distribution of session keys. Distinguishing a fresh session key from a random value can be performed only in one of the following ways. Guessing attack: A guesses correctly the test session key. Key replication attack: A succeeds in making two non–matching sessions yield the same session key, it then issues a session key reveal query on one of the sessions, and uses the other as test session. Forging attack: A computes the session signature σ, and issues a digest query to get the session key. Under the RO model, guessing and key replications attacks cannot succeed, except with negligible probability. Key replication attacks cannot succeed, as if X X′, or Y /= Y ′, or Aˆ Aˆ′, or Bˆ Bˆ′, and no substring of Aˆ equals Bˆ (and conversely) the probability that H(σ, Aˆ, Bˆ, X, Y ) equals H(σ′, Aˆ′, Bˆ′, X′, Y ′) is negligible. We thus suppose that A suc- ceeds with non–negligible probability in forging attack. Let E be the event “A succeeds in forging the signature of some fresh session (that we designate by sid0 = (Aˆ, Xˆ, X0, X0, ς)).” The event E divides in E.1: “A succeeds in forging the signature of a fresh with match- ing session,” and E.2: “A succeeds in forging the signature of a fresh without matching session.” It suffices to show that neither E.1 nor E.2 can happen with non–negligible11 probability.
Proof of Proposition 4. 15. If the Fourier expansion of f (z) at the cusp ρ is given by f (z) = n −∞ then the principal part of f (z) at ρ is fρ−(z) = Σ aρ(n)qn+κρ, ρ ρ aρ(n)qn+κρ. n+κρ<0 Following either the classical work of Xxxxxxxxxx and Xxxxxxxxx ([66], [67], [82], [83]) or the recent work of Bringmann and Ono [14], we can write f (z) = f−(z)+fhol(z), where f−(z) is a linear combination of so-called Xxxxx- Xxxxxxxx series which matches the principal part of f (z) at each cusp and fhol(z) is a holomorphic modular form. Since the coefficients of the Xxxxx- Xxxxxxxx series grow superpolynomially along certain arithmetic progressions modulo N and the coefficients of fhol(z) are polynomially bounded (see the above discussion), in order for f (z)|Up to be 0, we must have that f−(z) = 0 and f (z) = fhol(z). In the case that k < 0, we are now done, as there are no holomorphic modular forms of negative weight. If k = 0, the only holomorphic modular forms are constant and are preserved under Up. Hence, in this case too, we must have that f (z) = 0. If k = 1/2, a deep theorem of Serre and Xxxxx [71] states that f (z) must Σ be a linear combination of weight 1/2 theta functions θχ(z) of level dividing N and their dilates θχ(tz), with t · cond(χ) | N . Thus, if (n, N ) = 1, we have that 0 = af (p2n2) = cχχ(p)χ(n), where the sum runs over the characters of conductor dividing N , and each cχ is a constant. But by the linear independence of characters, we must have that each cχχ(p) = 0, whence cχ = 0 since (p, cond(χ)) = 1. Considering iteratively af (tp2n2) in the same way, the result follows if k = 1/2. We may now suppose that k ≥ 1. In the case that k is an integer, following [21], a basis for the Xxxxxxxxxx space of Mk(Γ1(N )) is given by ε,ψ,t {Ek (z) : (ε, ψ, t) ∈ Ak,N }, k where we define Eε,ψ,t(z) using the series k Eε,ψ(z) = c k,ε,ψ ∞ Σ + n=1 ε(n/d)ψ(d)dk−1 qn (4.61) Σ d|n x x by Eε,ψ,t(z) = Eε,ψ(tz) for k 2 or (ε, ψ) =ƒ (1, 1), and E1,1,t(z) = E1,1(z) − k tE1,1(tz) for t ƒ= 1. In the above, ck,ε,ψ is a constant and Ak,N is the set of triples (ε, ψ, t) where ε and ψ are primitive Dirichlet characters of conductor u and v, respectively, with (εψ)(−1) = (−1)k, and t is a positive integer such that tuv | N . In the case k = 2 we exclude the triple (1, 1, 1), and in the case k = 1, we require the first two elements of a triple to be unordered. We note that the Fourier coefficients of the Xxxxxxxxxx series Eε,ψ(z) are multiplicative; we denote these coefficients by σε,ψ (n).
Proof of Proposition 4. When one member fails to repay, the chance of game continuation and the expected repayment for the line, the star, and the ring networks, respectively, are Q l = 2αn—1 (1 — α) 1σβn—3 + 2αn—1 (1 — α) 12σβn—4 + (n — 4) αn—1 (1 — α) 12σ2βn—5 , Q r = nαn—1 (1 — α) 12σ2βn—5 , Q s = (n — 1) αn—1 (1 — α) 1σn—2 + αn—1 (1 — α) 1n—1 , and Kl = 2 αn—1 (1 — α) ✓1+ 1 +1 + σ + (n — 3) + (n — 3) β ◆ — —
Proof of Proposition 4. When one member fails to repay, the chance of game continuation and the expected repayment for the line, the star, and the ring networks, respectively, are Q l = 2↵n—1 (1 — ↵) .1aØn—3Σ + 2↵n—1 (1 — ↵) .12aØn—4Σ + (n — 4) ↵n—1 (1 — ↵) .12a2Øn—5Σ , Q r = n↵n—1 (1 — ↵) .12a2Øn—5Σ , Q s = (n — 1) ↵n—1 (1 — ↵) .1an—2Σ + ↵n—1 (1 — ↵) .1n—1Σ , and Kl = 2 ↵n—1 (1 — ↵) ✓1+ 1 +1 + a + (n — 3) + (n — 3) Ø ◆ — —
Proof of Proposition 4. 3.3 for K = Fp((t)). Denote by wn the base-change of wn along XOL
