Theorem 4. .1. Assume that δ > 0 and γ − r + δ ≥ 0 or δ = 0 and γ − r > σ2 . Define f by (4.11), b by Proposition 4.1 and Proposition 4.2. Then the initial value of stock loan with automatic termination clause is f (S 0).
Theorem 4. 3.5 Every conventional linear code of length n with minimum Ham- ming distance d can be converted to a code of length 2n with minimum 0-1 distance d by replacing every bit in the original codewords by a pair of bits, namely by replacing 0 by 01 and 1 by 10. We omit the proof since it is obvious. The code obtained from the linear code with the method of Theorem 4.3.5 is called a 0-1 code, and its codewords are called 0-1 codewords. Note that the number of 1’s is equal to that of 0’s in any 0-1 codeword. Xxxxx and Xxx can agree on a linear code. For any source state, a corresponding codeword is obtained according to the encoding rule of the linear code. Subsequently, the codeword can be changed into a 0-1 codeword. Then both Xxxxx and Xxx are able to construct the authenticator for the source state by taking together some bits from her or his initial string, where the positions of the bits are determined by the indices of 1-entries of the 0-1 codeword. More precisely, the authentication scheme can be described as follows. Let Xxxxx be the sender and Bob the receiver.
Theorem 4. .5.1 Suppose that an [n, k, d] linear code is employed in Scheme 4.3.6 by Xxxxx and Xxx, and Bob chooses r, r N, as the threshold (he accepts when the number of inconsistent bits between the received and calculated authenticators is less than r and rejects otherwise). Let α = ((1 — ϵAB)r)/(ϵAB(n — r)), a = (n — r)ϵABϵBE, b = nϵAB(1 — ϵBE) — r(ϵAB√+ ϵBE — 2ϵABϵBE) + d(ϵBE — ϵAB), c = r(1 ϵAB)(1 ϵBE), and β = ( b + chosen such that b2 — 4ac)/(2a). If n, k, d, and r are nϵAB + d(ϵBE — ϵAB) ≥ r ≥ nϵAB, then the authentication scheme has a code rate of k , (4.5) R = 2n, Bob’s failure probability satisfies PF ≤ (ϵAB · α + 1 — ϵAB)n αr and Xxx’s deception probability satisfies (ϵAB · β + 1 — ϵAB)n—d (ϵBE · β + 1 — ϵBE)d PD ≤
Theorem 4. In Models aut and sec, neither broadcast with extended validity nor broadcast with extended consistency is achievable among a set of n players P if t > 0 and t + 2t+ n. For every protocol there exists a value x0 0, 1 such that, when the sender holds input x0, the adversary can make the protocol fail • with a probability of at least 1 • with a probability of at least 1 if he is computationally bounded, and if he is computationally unbounded. The proof of this theorem was moved to the appendix.
Theorem 4. Let 0 < ε < 1/4. Assuming a setup for non-interactive zero-knowledge, threshold fully homomorphic encryption, and anonymous public key encryptions, ΠsprABA is an asyn- chronous Byzantine agreement protocol secure up to t ≤ (1 − 3ε)n/3 adaptive corruptions. The communication complexity is O(nl + κ n) for l-bit values. The proof of the following lemma is almost identical to that of Lemma 3.
Theorem 4. (i) For any given k ≥ 1, the sequence {(xkl, ukl, θkl)} of solutions to (Pk′l) ∗ ∗ ∗ 0 k≥1 converges to (xk, uk, θk) ∈ W1,∞ × L∞ × Θ. (ii) The sequence {(xk, uk, θk)} converges to a solution (x , u , θ0) of (P).
Theorem 4. If the CDH assumption holds in G, the protocol EKE2 depicted in Figure 8 securely realizes A-iPAKE in the RO, IC, CRS-hybrid model with respect to static corruptions. F We note that this result is not surprising, given that other variants of EKE2 have already been proven to UC-emulate pwKE. Intuitively, a protocol with only two flows not depending on each other does not leak the outcome to the adversary via the transcript, which explains why EKE2 is implicit-only. Hashing of the transcript keeps the adversary from biasing the key unless he knows the correct pass-string or breaks the ideal cipher. For completeness, we include the full proof in the full version of this paper [28]. A(pw ∈ Fp) B(pwj ∈ Fp) x ← $ FP , A ← L, X ← gx X∗ ← Epw||Æ(X) − −A−j,−Y−∗−→ y ← F , A ← L, Y ← g A, X∗ $ P j y ←− − − − Y ∗ ← Epwt||Æt (Y ) k ← H(X∗, Y ∗, Z) Z ← Dpw||Æt (Y ∗)x Zj ← Dpwt||Æ(X∗)y output (Aj, k) kj ← H(X∗, Y ∗, Zj) output (A, kj) → { } E D × L L Fig. 8. Protocol EKE2, in a group G = (g) of prime order P , with a hash function H : G3 0, 1 k and a symmetric cipher , onto G for keys in Fp , where is the label space.
Theorem 4. 2.1. Define fn, f∞ : Θ → R by (4.2) and (4.3), where Θ ⊂ (Hs)k for s ≥ 1 is given by (4.4), respectively. Under Assumptions 3.1-3.3 any sequence of minimizers µ(n) of fn are, with probability one, weakly compact and any weak limit µ(∞) is a minimizer of f∞. Furthermore if µ(nm) ~ µ(∞) in Hs then µ(nm) → µ(∞) in L2.
Theorem 4. .3.2. Let F be the function field of a p-adic curve with p ƒ= 2 and D a division algebra over F with an involution of the first kind. Let L/F be a quadratic extension.
Theorem 4. Using a coin toss arbiter, the contract has weak game-theoretic security for γ = 1 and λ = x.
