, Un. Oracle Πs represents the actions of principal U in the protocol run indexed by integer s. The number of principals n is polynomial in the security parameter k. Each user has a long-lived key, obtained at the start of the protocol using a key distribution algorithm L. Interactions with the adversary are called oracle queries and the list of allowed queries is summarised in Table 1. We now describe each one informally. Send(U, s, m) This query allows the adversary to make the principal U run the U protocol normally. The oracle Πs will return to the adversary the same U next message that an honest principal U would if sent message m according to the conversation so far. (This includes the possibility that m not be of U the expected format in which case Πs may simply halt.) If Πs accepts the session key or halts this is included in the response. The adversary can use this query to initiate a new protocol instance by sending a flag message m = Initiator or m = Responder indicating the role that the principal plays. Reveal(U, s) This query models the adversary’s ability to find session keys. If U a session key Ks has previously been accepted by Πs then it is returned to the adversary. An oracle can only accept a key once (of course a principal can accept many keys modelled in different oracles). An oracle is called opened if it has been the object of a Reveal query. Corrupt(U, K) This query models insider attacks by the adversary. The query returns the oracle’s internal state and sets the long-term key of U to be the value K chosen by the adversary. The adversary can then control the behaviour of U with Send queries. A principal is called corrupted if it has been the object of a Corrupt query. U Test(U, s) Once the oracle Πs has accepted a session key Ks the adversary can attempt to distinguish it from a random key as the basis of determining security of the protocol. Arandom bit b is chosen; if b = 0 then Ks is returned while if b = 1 a random string is returned from the same distribution as session keys. This query is only asked once by the adversary.
, Un. The protocol has associated a secure public key encryption scheme = ( , , ), where is the key generation algorithm, and G ← K ← K G S V K S V K E D , are the encryption and decryption algorithms, respectively. The protocol also uses a secure signature scheme Σ = ( , , ), with the key generation algorithm, the signing algorithm and the verification algorithm. The key distribution algorithm L assigns to each user Ui an encryption/decryption key pair (ei, di) (1k) and a signing/verification key pair (ei, di) (1k). The key distribution algorithm L also provides each user with an authentic copy of the public keys of all other users. Each user, Ui, chooses a nonce (a random value, Ni, of size k bits). One user, say U1, will be distinguished and will send its value N1 to each other user in an authenticated and confidential way. We call this distinguished user the initiator of the protocol and the other users the responders. In an implementation there is no need for the messages of U1 to be sent before the other messages, so it is perfectly possible for all messages to be sent together in one round. U The responders only have to broadcast their nonces so that all users in receive all the Ni values. U1 will encrypt N1 for each other user Ui using Ui’s
, Un. In time t1, the group be U0. In the case of where t0 ti and U 6= U0 conditions present, the group can be considered as dynamic group [11]. The list of dynamic group key agreement functions are defined as below:
, Un insurable Risks; If during the Concession Period, any risk which has been previously insured becomes un-‐insurable due to the fact that the insurers have ceased to insure such a risk and therefore insurance cannot be maintained / re-‐ instated in respect of such risk, the Concessionaire shall not be deemed to be in breach of its obligations regarding insurance under this Agreement.
, Un. The join operations operate as follows:
, Un. The initiator U1, who knows all the identities of the other members, initiates a new session for starting the GKA protocol. The other members do not know the identities of the group members before the session starts. The protocol uses the public system parameter set param.
, Un. UN % ACAP ACAP Budget (Equation 1) where: UN % is the calculated UN Scale of Assessment for a Party outlined in the United Nations Scale of Assessment for payment of annual contributions to the UN Budget (currently Resolution 58/1 B, March 2004); UN % ACAP is the sum of the UN Scale of Assessment for all ACAP Parties outlined in UN Resolution 58/1 B; and ACAPBudget is the annual budget approved by the Meeting of the Parties.
