Definition 4. 3.4 The minimum 0-1 distance of a code , denoted by d0→1( ), is defined as the smallest value among the 0-1 distances between any two different codewords in C, i.e., d0→1(C) = min d(ci → cj ), where ci, cj ∈ C. i,j,i j The minimum 0-1 distance of any conventional linear code is 0 since the zero code- word always lies in the code. The following theorem shows how to change a conven- tional linear code of Hamming distance d into a code with 0-1 distance d.
Definition 4. 3.7 The code rate of an authentication scheme, denoted by R, is de- fined as the number of bits that can be authenticated by Xxxxx and Xxx with one bit of their initial, correlated strings. For traditional authentication codes, the code rate R is determined by the length of the source states divided by that of the encoding rules (authentication keys).
Definition 4. 1.1 The grievance shall mean a written complaint by a member of the bargaining unit or the Association that there has been a violation, misinterpretation, or misapplication of any provision(s) of this agreement. The provision(s) grieved shall be so designated.
Definition 4. .1. An encryption scheme is a triple Γ = ( , , ) of probabilis- tic polynomial-time algorithms. takes as input the security parameter 1η and produces a key pair (pk, sk) where pk is the public encryption key and sk is the private decryption key. S takes as input a public key pk and a plaintext m and outputs a ciphertext. Ð takes as input a private key sk and a ciphertext and out- puts a plaintext or ⊥. It is required that P[(pk, sk) → K(1η); c → S (pk, m); m′ → Ð(sk, c) : m = m′] = 1. We write { m }pk to denote S (pk, m).
Definition 4. The free energy of a set of solutions (configurations) is defined as
Definition 4. An MKEM scheme is (t, s)-cpa-secure if for all t-attacker A, cpa AdvMKEM (A) ≤ s (2) Figure 1 shows the flow of a CKA that uses an MKEM (Panel (a)) and also compares (Panel (b)) to a CKA based on a KEM. We require that the MKEM is IND-CPA (similarly to KEM, IND-CCA is not required). Constructing an MKEM scheme is not necessarily simple. Indeed, in Section 4 we show how to transform BIKE1 KEM into BIKE1-MKEM and explain why the same technique cannot be applied to BIKE2/3. Consequently, we work on each case separately, without stating a general security relation between an MKEM and its related KEM (although we believe that equivalence exists).
Definition 4. Operator merge(a, b). The operator constructs a single event from the definitions of events a and b. It is well-defined only when a and b are independent. For some events a and b, a = any p where G(p, d) then S(p, d, wr) end b = any q where H(q, g) then R(q, g, ur) end a merged event takes the following general form: a = any p, q where G(p, v) AH(q, v) then S(p, v, vr) AR(q, v, vr) end Constant c and set s are omitted but implied in guards and before-after predicates. Since only independent events may be merged, the resultant merged event enjoys a number of properties. It is enabled when both its donor events are enabled and simulates the effect of interleaving the merged events. A merged event is feasible as long as its individual donor events are feasible. It is straightforward to see that the state observed after executing a merged event is the same state as one would observe after executing both donor events in any order. Event merging is a special case of event fusion [12].
Definition 4. Given a compression function f : {0, 1}c × {0, 1}c → C and a function split : N≥2 → N, we recursively define the tree hashes TH M : Mn → M, TH C : Cn → C and TH X : Xn → {0, 1}c as n n n TH M (m, ⊥,..., ⊥)= m, TH C(x1,..., xn)= f (TH X (x1,..., xk), TH X (xk+1,..., xn)), n k n n n TH X = TH M H TH C, where k = split (n). n−k Using these functions, we finally define the variable input length function TH : M ≤L → {0, 1}c which hashes variable length trees up to length L. Let U , with a size of K blocks, be the smallest tree of which all trees up to length L dom K area subtree of. TH ≤L maps an input m1,..., mn, to TH X (x1,..., xK), where ⊥ x1,..., xK is the tree Extend[U ](Tn), where Tn is the tree of size n with labels of m1,..., mn. This means that xi is equal to either some mj or . We can apply this mapping non-ambiguously as every tree up to length L is a subtree of U . For example, in the Xxxxxx-Xxxx˚xxx construction every tree of size n is a subtree of the tree of size n′ if n ≤ n′. This means that U is just the normal tree of size L, hence K = L. This is displayed in Fig. 3 for L = 4. Note that this is not the case in general. For example in the construction in Sakura, if L is equal to 2A + 1, then the right branch only contains one leaf, which means that it does not contain the tree for 2A, which is a full binary tree with a right branch of size 2A−1. However, we can still choose the next power of two as a tree that contains the necessary trees, hence K ≤ 2L. This is displayed in Fig. 4 for L = 5. dom We are ready to prove the collapseability of TH ≤L . dom
Definition 4. An agreement problem for a validity function F (for an honesty structure and input and output sets X and Y ) is to devise a protocol consensus[] for parties P1, ..., Pn. In order to start the protocol, a party Pi receives the input (consensus, tid, xi). Here tid is a transaction identifier unique for all executions of consensus[], and xi ∈ X is Pi’s local input. Upon termination, the protocol produces an output (tid, yi) with yi ∈ Y for each Pi. The following requirements must be satisfied for all sets H ∈ 7 of actually honest parties and input vectors x ∈ XH: ∈ ∈ – Agreement: There is a y Y such that yi = y for all Pi H. ∈ ∈ – Validity: yi F (H, x) for all Pi H. – Correct Execution: If all parties are honest, and no party receives any timeout ∈ messages, then for all input vectors x XP with F (P, x) will never agree on y = failed. {failed}, the parties – Termination of consensus[]: Eventually each Pi ∈ H terminates and produces an output yi ∈ Y . Correct Execution excludes protocols that always output failed. We now formalize the verifiability of an agreement.
Definition 4. 3.3 Given a Team Persuasion Game, the set of arguments that are on in round t is Aon := {a ∈ A | St(a) = on} ∪{t}. The induced argument framework is AFon := ⟨Aon, Xxx⟩, where Xxx := R ∩ [Aon × Aon].
