Theorem 3. Suppose Xxxxx and Xxx perform the standard SIDH key-agreement protocol as described §3.2. In the key establishment phase Xxxxx computes a secret isogeny φA : EB → EBA of degree Am (A ∈ {2, 3}) as the composition of m isogenies of degree A, say φA = φm ◦ · · · ◦ φ1. Let φj = φm−1 ◦ · · · ◦ φ1 be the isogeny whose image curve is A isogenous to EAB, say φj : EB → Ej. Xxx also knows the curve EBA by performing his half of the key establishment. If Xxx has access to an efficient, deterministic algorithm which produces Ej from E, EA, EB, EBA and Am, then Xxx can efficiently solve the SSI problem.
Theorem 3. 2.4 Let δ′, 1, and 2 > 0 be constants. Then for all sufficiently large n, a function E : {0, 1}n × {0, 1}d → {0, 1}r, exists with d ≤ Δ1n and r ≥ (δ′ — Δ2)n, such that for all random variables T ∈R T with T ⊆ {0, 1}n and with H∞(T ) > δ′n we have H(E(T, V )|V ) ≥ r — 2—n1/2−o(1) .
Theorem 3. 4.7 Let 0 < δ < 1, 1 < t1 < 1, 0 < t2 < 1, 1, 2 > 0, n1, n2 N and consider the setting of two independent, partially secret strings, say SI of length n1 Ð — and SII of length n2. Then, both strong and weak (n2, n2 ,2,n2 t2 , n2t2 s, 2—s/ ln 2, δ) PA-protocols exist if the following two conditions are met:
Theorem 3. .7.There exists a black-box quantum polynomial-time two-stage quantum algorithm such that for any adaptive Fiat-Shamir adversary , mak- ingqqueries to a uniformly random functionHwith appropriate domain and range, and for anyx ◦ ∈X: Pr x=x ◦ ∧v=accept: (x, v)→ ⟨S A,V⟩ (2q+ 1) 2 H ◦ FS ≥ 1 Pr x=x ∧V H (x,π) : (x,π)→A H . Below, we apply the above general reduction to the respective standard defini- tions forsoundnessandproof of knowledge. Each property comes in the variants computationalandstatistical, for guarantees against computationally bounded or unbounded adversaries respectively, and one may consider the static or the adaptive case.
Theorem 3. .4.1 (Xxxx). Suppose E/Q is an elliptic curve with a Q-rational torsion point P of odd prime order A, and suppose P is not contained in the kernel of reduction modulo A. Suppose SE = ∅. Suppose that D is a negative square-free integer coprime to ANE and satisfies
Theorem 3. 3.8. Algorithm OVERABUNDANTWORDS solves problem ALLOVER- ABUNDANTWORDSCOMPUTATION in time and space O(n), and this is time-optimal. OverabundantWords(x,ρ) ← 1 T(x) BuildSuffixTree(x) ∈ 2 for each node v T(x) do ← 3 D(v) word-depth of v ←
Theorem 3. The ( n + 1)-Provable Broadcast algorithm in Algorithms 2 and 3 satisfies Integrity, Validity, Provability, and Termination. Moreover, the protocol has linear communication complexity with an O(1)-sized proof.
Theorem 3. .4. (seq Event, ^, ()) is a trace algebra. Though simple, we note that the sequence-based trace model has been shown to be suffi- cient to characterise both untimed [40] and discrete time modelling languages [51]. →≥ A more complex model is that of piecewise continuous functions, for which we adopt and refine a model called timed traces (TT) [24]. A timed trace is a partial function of type R 0 Σ, for continuous state type Σ, which represents the system’s continuous evolution with respect to time. → In our model we also require that timed traces be piecewise continuous, to allow both continuous and discrete information. A timed trace is split into a finite sequence of continuous segments, as shown in Figure 4. Each segment accounts for a particular evolution of the state interspersed with discontinuous discrete events. This necessitates that we can describe limits and continuity, and consequently we require that Σ be a topological space, such as Rn , though it can also contain discrete topological information, like events. Continuous variables are projections such as x : Σ R. We give the formal model below. Definition 3.3 (Timed Traces). f : R≥0 → Σ ran(I ) ⊆ [0, t] | ∃ t • dom(f ) = [0, t) TT ¾ ∧ t > 0 ⇒ ∃ I : Roseq ∧ {0, t} ⊆ ran(I ) f (t) exists ∧ f cont-on [In, In+1) ∧ • ∀ n < #I − 1 • lim t→In−+1 ∀ ∈ • Roseq ¾ {x : seq R | ∀ n < #x − 1 • xn < xn+1} f cont-on [m, n) ¾ t [m, n) lim f (x) = f (t)
Theorem 3. 3. Suppose a dividend will be paid during the life of an option. Let D denotes its present value. Then we have for European option S − D − Ee−r(T −t) ≤ c ≤ S (3.5) − S + D + Ee−r(T −t) ≤ p ≤ Ee−r(T −t). (3.6) and the put-call parity: c + Ee−r(T −t) = p + S − D. (3.7) For the American options, we have (i) S − D − E ≤ C − P ≤ S − Ee−r(T −t) (3.8) provided the dividend is paid before exercising the put option, or (ii) S − E ≤ C − P ≤ S − Ee−r(T −t) (3.9) ≥ − − if the put is exercised before the dividend being paid. Proof. 1. Proof of c S Ee−r(T −t) D. We consider two portfolios: I = c + D + Ee−r(T −t), J = S. Then at time T , I(T ) = max{ST − E, 0} + D + E = max{ST , E} + Der(T −t) J(T ) = ST + Der(T −t). Hence I(T ) ≥ J(T ). This yields I(t) ≥ J(t) for all t ≤ T . This proves c ≥ S − D − Ee−r(T −t). In other word, c is reduced by an amount D. 32 CHAPTER 3. BLACK-SCHOLES ANALYSIS ≥ −
Theorem 3. Protocol 1 solves Verifiable Agreement under the condition Q2 in both synchronous and asynchronous networks.
