In Sect Clause Samples

In Sect. 2.1 we have seen that the order on a poset X forms a non-symmetric comparison relation : X X 2 in PoSets, where ( ) is order-reversal. Now assume that X is an orthomodular lattice (see [18] for details), with orthocomplement ( )⊥ : X X. It satisfies, among other things, x⊥⊥ = x and: x⊥ y iff y⊥ x. When x y⊥ one calls x, y orthogonal, which is also written as x y. We obtain a comparison relation cp : X X 2 in PoSets (with identity involution), via cp (x, y) = 1 iff x⊥ y. By using orthocom- plement in the first coordinate the contravariance disappears. This relation is the same as (x, y) x⊥ ⊥ y⊥, that is, as orthogonality of orthocomplements. It forms a symmetric comparison relation, since orthogonality is symmetric. The resulting category of tame relations is known from [6, 13]. ⊥symmetric comparison cluster X×X Proposition 4.1. The category of tame relations TRel(PoSets, cp⊥) for the ity of orthocomplements, is the categor—y—→ X∈OrthMod Proof. A tame relations r : X → Y , for X, Y orthomodular lattices is deter- mined by monotone functions r∗ : X → Y and r∗ : Y → X satisfying: r∗(x)⊥ ≤ y ⇐⇒ cp⊥(r∗(x), y)= 1 ⇐⇒ r(x, y)=1 ⇐⇒ cp⊥(x, r∗(y)) ⇐⇒ x⊥ ≤ r∗(y). These r∗ and r∗ are completely determined by monotone functions r# = r∗ ◦ (—)⊥ : X → Y and r# = r∗ ◦ (—)⊥ : Y → X satisfying: x = x⊥⊥ ≤ r#(y)= r∗(y⊥) ⇐⇒ r∗(x⊥)⊥ ≤ y⊥⇐⇒y ≤ r∗(x⊥)= r#(x). This precisely says that r#, r# form an antitone Galois connection—or an adjunction r# ≥ r#. In [13] it is shown that OMLatGal is a dagger kernel category with (dagger) biproducts, and that every dagger kernel category maps into it.

In Sect. 4.3, we reflect on the differences between Elephant v2 and v1 [8], and explain how the security bound has improved. 4.1 Specification of Elephant v2‌ Let k, m, n, t N with k, m, t n. Let P : 0, 1 n 0, 1 n be an n-bit permutation, and ϕ1 : 0, 1 n 0, 1 n be an LFSR. Define ϕ2 = ϕ1 id, where id is the identity function. Define the function mask : 0, 1 k N2 0, 1 n as follows: 1 maska,b = mask(K, a, b)= ϕb ◦ ϕa ◦ P(K 0n−k). (8) We next describe the authenticated encryption mode of Elephant v2. 4.1.1 Encryption

In Sect. 2, we focus on the clauses about “Right of persons”. If we consider the Right of rectification or cancellation: The controller is obliged to implement the right of rectification/cancellation of the data subject within a period of ten days. [. . . ], this can be expressed in CNL4DSA as follows: if hasRole (User, DataController) and if hasDate (RectifyRequest, Date) and if timeLessThen (CurrentDate, Date+tenDays) then after DataSubject send RectifyRequest then User must rectify Data Quite obviously, if the data subject would like to cancel, the rule is similar.

In Sect. 5.5, namely the case where ti1 = ti3 and ti2 = ti4 . For upper bounding the number of choices for

In Sect we revisit the state of the art on Trunc and re-derive the best security bound;

In Sect. 3 we define what we consider a reduction and what we mean with optimal security. This section also includes a formalization of the generic standard-to- ideal reduction. We derive a lower bound on the strong related-key PRP security in Sect.

In Sect the iocoF relation was defined as a relation between an implemen- tation, modelled as an IOTS, and a specification, given as an LTS. We lift this definition to the level of STSs by appealing to their semantics. Definition 12. Let S be an STS and P a physical system, modelled as an IOTS. Then P iocoF S iff P iocoF [S ]. Table 4. Deduction rule for transitions ' l −−−→ l type(λ) = ⟨ν1, . . . , νn⟩ ς∈U type(λ) ϑ ∪ ς |= ϕ ϑ' = (ϑ ∪ ς)eval ◦ ρ (λ, (ς(ν1 ),...,ς(νn)⟩) ' ' (l, ϑ) −−−−−−−−−−−−−→ (l , ϑ ) 5 On-the-Fly Testing

In Sect. 3.2, we derive a multi-user security bound on the SiM mode and explain how it differs from the single-user analysis of [9]. 3.1 Specification‌ Let k, n, z ∈ N. Let P ∈ perm(n) be an n-bit permutation, and let ϕ1,..., ϕz : {0, 1}n → {0, 1}n be z LFSRs. Let T ⊆ Nz be a finite tweak space. Define the function mask : {0, 1}k ×T → {0, 1}n as follows: maska1 ,...,az = mask(K, a1,..., az)= ϕaz ◦ ··· ◦ ϕa1 ◦ P(K 0n−k). (6) Define the tweakable block cipher SiM : {0, 1}k ×T × {0, 1}n → {0, 1}n as SiM(K, (a1,..., az),M )= P(M ⊕ maska1 ,...,az ) ⊕ maska1 ,...,az . (7) 3.2 Multi-user Security of SiM‌