Lemma 3. (Termination) For each run, every process pi ∈ Correct of the sys- tem HASf [L, ∅, n] eventually decides some value. ∈
Lemma 3. 5.3. Let C/Q be a hyperelliptic curve of genus g ≥ 4, with a rational Weierstrass point, geometrically simple Jacobian with r ≤ 1, good reduction at 3, which satisfies condition (†). Let P1, P2 ∈ C(Q) be conjugate quadratic points, with P1, P2 ∈ CF3 (F9) \ CF3 (F3), and P3 ∈ C(Q) a rational point. If n(ΛC, P1) = 1, there are at most 26 ordered triples (Q1, Q2, Q3) of conjugate cubic points in DP1 × DP2 × DP3 . If n(ΛC, P1) = 0, there are no such triples.
Lemma 3. 8. The series L(s, ψ) converges to a positive real number at s = 1.
Lemma 3. 2.11. The number of ρ-overabundant words in a word x of length n over a binary alphabet (e.g. Σ = {a, b}) is no more than 2n− 4.
Lemma 3. 5 For a tripartite 3-uniform hypergraph H the following state- ments are equivalent:
Lemma 3. 2.1. Suppose that A is a C∗-algebra of real rank zero, and let U, V ∈ A be unitary elements such that —1 ∈/ σ(U ), —1 ∈/ σ(V ). Then for any ε > 0 there exists a unitary element Wε such that UV — Wε ≤ ε and —1 ∈/ σ(Wε).
Lemma 3. For the MAC construction above, the success probability of the ad- versary in forging a tagged message (mj, tj) that pass MAC verification is no more than A . The proof is a direct extension of the proof in [22]. Algebraic Manipulation Detection Code Algebraic manipulation detection code (AMD code) [8] can be used to encode a source into a value stored on Σ(G) so that any tampering by an adversary will be detected, except with a small error probability δ.
Lemma 3. For any environment A, there exist adversaries У1, У2, У3, such that Pr Hyb3 Ffr-cgka,S ( ) 1 Pr Hyb2 Ffr-cgka,S 2 (A) ⇒ 1i ≤ OW-PPRF PPRF,qe,qm q · Adve mmOW-RCCA mmPKE,qe log(qn),qn (У1)+ (У2)+ q · AdvmmOW-RCCA(У ) + s · qe · qh , e mmPKE,1,qn 3 2κ where HKDF.Exp and HKDF.Ext are modeled as random oracles and qe, qm, qn and qh, are as in the main theorem. The probability runs over the randomness used by the experiments and the random oracle. Proof. First we define a predicate and events that will assist our proof. The original conf predicate states that the environment cannot reach a configuration in which the set of it’s keys contains U , i.e., adv can compute the key of epoch U . Simpler predicate. For simplicity, we first consider a slightly weaker confidentiality predicate : conf '(U ) is true if ∄(MovenA, , ) : (MoveA, KeyA, VisitedA) ▶∗ (MovenA, , ) ∧ Iid(id, U ) ∈ MoveAn . A We observe that conf ' implies conf : if conf = false, then by definition, can reach a configura- tion in which it can compute they key of U , but this wouldn’t be possible without knowing the state of U , which implies a move pebble on U , thus conf ' = false. Furthermore, the only case for which conf does not imply conf ' (w.r.t. epoch U ), i.e., the case in which the environment can’t compute the key of U but there is a move pebble on U , are those where a) all parties have been corrupted after computing/deleting the key of U (via GetKey) and b) the environment cannot derive the key indirectly. Security of FREEK in these epochs is trivial, therefore for the rest of the proof we prove indistinguishability between the current hybrid and previous one by considering conf ' in the place of conf .
Lemma 3. 3.8. Let d > 1 be a positive integer and let C/Q be a hyperelliptic curve of genus g > d, with a rational Weierstrass point, geometrically simple Jacobian with r ≤ 1, good reduction at a prime p > d2 + 3, and which satisfies condition (†). Let P1, · · · , Pd ∈ Cd(Q) be a conjugate d-tuple with well-behaved uniformizers
Lemma 3. 4.1. Let C/Q be a hyperelliptic curve of genus g ≥ 3, with a rational Weierstrass point, geometrically simple Jacobian with r ≤ 1, and let p be an odd prime of good reduction for C. Let P1, P2 ∈ C(Q) be either two rational points or a pair of conjugate quadratic points, with well-behaved uniformizers zP1 , zP2 . Let (Q1, Q2) be a pair of unexpected conjugate quadratic points with the same reduction as (P1, P2). Then {(Q1, Q2)} is a zero-dimensional component of (C2)ΛC ∩ (B1 (P1, zP ) × X0 (X0, zP )).
