Proof of Theorem 2. 5. The analysis is performed on a generic component c, and the final result is a consequence of the properties holding on every component.
Proof of Theorem 2. The security difference between Protocol 1 and 2 is that the latter provides full WFS, i.e. in addition to the adversarial capabilities considered in the proof of Theorem 1, we now allow the adversary to corrupt both parties to the test session. It is natural then to consider the proof of Theorem 2 in two parts: the first part where the adversary does not corrupt both parties to the test session, and the second part where it does. Then, the first part is essentially identical to the proof of Theorem 1. The only difference is that in the analysis of Game 3 (in both Case 1 and 2) A needs to simulate the extra Xxxxxx-Xxxxxxx values, which A can easily do for all sessions, including the test session. (Note that A will always choose at least are activated, uses its inputs fa and fb instead of the values YT and YT ∗ when it generates the outputs of these sessions. Apart from this change, all session inputs and outputs are generated according to the protocol specification. A A When the test session query is made, uses Exct(h) in place of KT′′T ∗ when calculating the real test session key. n2 A A A B is able to answer all other queries correctly since it knows all of the system parameters and all of the session states. outputs 1 if is correct, 0 otherwise. The probability that will not have to abort the protocol as described in Game 1 is 1 . Hence, by orac the game hopping technique from Dent (2006) and using a similar logic to that shown in (26) to (29) we one of YA or YB, hence it can always compute KA′′B ). have that: orac We deal now with the second part of the proof, where the adversary corrupts the two partners to the test session. Note however that the adversary is re- τ0 ≤ 2n2 Advddh ( ) + (36) k τ1 F,o stricted to being passive during the protocol run cor- responding to the test session – a consequence of only being able to achieve weak forward secrecy in one round. As we will see below this allows us to inject a challenge Decisional Xxxxxx-Xxxxxxx triplet into the test session. The second part of the proof allows any party to be corrupted. It considers the following four games with X. Game 0. This game is the same as a real interaction with the protocol. A random bit b is chosen, and when b = 0, the real key is returned in answer to the test session query, otherwise a random key from U2 is returned.
Proof of Theorem 2. 2.1 We derive Theorem 2.2.1 from the following lemma.
Proof of Theorem 2. 2.2 We derive Theorem 2.2.2 from the following more general but technical estimate.
Proof of Theorem 2. 1 f Let χ be a multiplicative character of F×q of order m. There is a unique a such that 0 ≤ a < q − 1 and χ = ω−a. Since g(χ) ∈ Q(ζp, ζq−1), ε(χ) is a root of unity if and only if g(χ)2p(q−1) = qp(q−1). The Xxxxx-Xxxxxxx formula (2.5) yields that g(χ)2p(q−1) = p2p(q−1)S(a)/(p−1) f −1 Y Γp j=0 apj q − 1 !2p(q−1) , (2.6) 2 and by comparing the p-adic valuation of both sides, we see that a necessary condition for ε(χ) to be a root of unity is S(a) = f(p−1). In fact, if χr is another character of Fq× of order m, then there is an element of Gal(Q(ζp, ζm)) taking g(χ) to g(χr). Hence, ε(χ) is a root of unity if and only if ε(χr) is. Thus, if ε(χ) is a root of unity, for all t coprime to m we have that S(ta(q−1)) = f (p − 1) , (2.7) where ta(q−1) is the canonical reduction of ta modulo q − 1. This condition will prove to be sufficient to guarantee that ε(χ) is a root of unity. To see this, we begin by reinterpreting the sum of digits function S(a).
Proof of Theorem 2. 2.1. The proof is straightforward. The upper bound e(X) ≤ 4g(g − 1)h(b) is well-known; see [24, Theorem 5]. Let us prove the lower bound for δFal(X). If g ≥ 2, the lower bound for δFal(X) can be de- duced from the second inequality of Proposition 2.2.8 and the upper bound e(X) ≤ 4g(g−1)h(b). When g = 1, we can easily compute an explicit lower bound for δFal(X). For instance, it not hard to show that δFal(X) ≥ −8 log(2π) (using the explicit description of δFal(X) as in Remark 1.7.1). From now on, we suppose that b is a non-Xxxxxxxxxxx point. The upper bound hFal(X) ≤ 2 g(g + 1)h(b) + log Wr Ar(b)
Proof of Theorem 2
