Definition 4. 3.4 The minimum 0-1 distance of a code , denoted by d0→1( ), is defined as the smallest value among the 0-1 distances between any two different codewords in C, i.e., d0→1(C) = min d(ci → cj ), where ci, cj ∈ C. i,j,i j The minimum 0-1 distance of any conventional linear code is 0 since the zero code- word always lies in the code. The following theorem shows how to change a conven- tional linear code of Hamming distance d into a code with 0-1 distance d.
Definition 4. 3.7 The code rate of an authentication scheme, denoted by R, is de- fined as the number of bits that can be authenticated by Xxxxx and Xxx with one bit of their initial, correlated strings. For traditional authentication codes, the code rate R is determined by the length of the source states divided by that of the encoding rules (authentication keys).
Definition 4. 1.1 The grievance shall mean a written complaint by a member of the bargaining unit or the Association that there has been a violation, misinterpretation, or misapplication of any provision(s) of this agreement. The provision(s) grieved shall be so designated.
Definition 4. .1. An encryption scheme is a triple Γ = ( , , ) of probabilis- tic polynomial-time algorithms. takes as input the security parameter 1η and produces a key pair (pk, sk) where pk is the public encryption key and sk is the private decryption key. S takes as input a public key pk and a plaintext m and outputs a ciphertext. Ð takes as input a private key sk and a ciphertext and out- puts a plaintext or ⊥. It is required that P[(pk, sk) → K(1η); c → S (pk, m); m′ → Ð(sk, c) : m = m′] = 1. We write { m }pk to denote S (pk, m).
Definition 4. Operator merge(a, b). The operator constructs a single event from the definitions of events a and b. It is well-defined only when a and b are independent. For some events a and b, a = any p where G(p, d) then S(p, d, wr) end b = any q where H(q, g) then R(q, g, ur) end a merged event takes the following general form: a = any p, q where G(p, v) AH(q, v) then S(p, v, vr) AR(q, v, vr) end Constant c and set s are omitted but implied in guards and before-after predicates. Since only independent events may be merged, the resultant merged event enjoys a number of properties. It is enabled when both its donor events are enabled and simulates the effect of interleaving the merged events. A merged event is feasible as long as its individual donor events are feasible. It is straightforward to see that the state observed after executing a merged event is the same state as one would observe after executing both donor events in any order. Event merging is a special case of event fusion [12].
Definition 4. An agreement problem for a validity function F (for an honesty structure and input and output sets X and Y ) is to devise a protocol consensus[] for parties P1, ..., Pn. In order to start the protocol, a party Pi receives the input (consensus, tid, xi). Here tid is a transaction identifier unique for all executions of consensus[], and xi ∈ X is Pi’s local input. Upon termination, the protocol produces an output (tid, yi) with yi ∈ Y for each Pi. The following requirements must be satisfied for all sets H ∈ 7 of actually honest parties and input vectors x ∈ XH: ∈ ∈ – Agreement: There is a y Y such that yi = y for all Pi H. ∈ ∈ – Validity: yi F (H, x) for all Pi H. – Correct Execution: If all parties are honest, and no party receives any timeout ∈ messages, then for all input vectors x XP with F (P, x) will never agree on y = failed. {failed}, the parties – Termination of consensus[]: Eventually each Pi ∈ H terminates and produces an output yi ∈ Y . Correct Execution excludes protocols that always output failed. We now formalize the verifiability of an agreement.
Definition 4. An MKEM scheme is (t, s)-cpa-secure if for all t-attacker A, cpa AdvMKEM (A) ≤ s (2) Figure 1 shows the flow of a CKA that uses an MKEM (Panel (a)) and also compares (Panel (b)) to a CKA based on a KEM. We require that the MKEM is IND-CPA (similarly to KEM, IND-CCA is not required). Constructing an MKEM scheme is not necessarily simple. Indeed, in Section 4 we show how to transform BIKE1 KEM into BIKE1-MKEM and explain why the same technique cannot be applied to BIKE2/3. Consequently, we work on each case separately, without stating a general security relation between an MKEM and its related KEM (although we believe that equivalence exists).
Definition 4. An agreement problem for a validity function F (for an honesty structure and input and output sets X and Y ) is to devise a protocol consensus[] for parties P1, ...
Definition 4. 1.1 (Random set R and the probability spaces (Ω, S, P) and (ΩA, SA, PA)). Fix 0 ≤ pm ≤ 1 for each m ∈ N. We generate a random set R ⊂ N by adding m to R with probability pm, independently for each m. We let (Ω, S, P) be the probability space of the random sets R. More generally, for A ⊂ N, let (ΩA, SA, PA) be the probability space of the random sets R ∩ A. In general, we shall fix absolute constants α > 0 and 0 < δ ≤ 1, and let pm = min{1, αm—1+δ} for all positive integers m. Note that we restrict our probabilities only to the above probabilities, ignoring the case when, say, pm = m—1/2 log m. Covering the remaining cases would not require a new proof technique, but it would be a bit more cumbersome. Readers interested in the details of the construction of the spaces (Ω, S, P) and (ΩA, SA, PA) are encouraged to consult, for example, Xxxxxxxxxx and Xxxx [21, Theorem 13, page 142]. Using the natural correspondence between subsets of N and 0–1 vectors indexed by N, we may identify (Ω, S, P) with the product of the two-point spaces (Ωm, Sm, Pm) (m ∈ N), where Ωm = {0, 1}, Sm = 2Ωm , and Pm({1}) = pm and Pm({0}) = 1 − pm. Thus, S is the σ-algebra generated by the sets C(m) = {R ⊂ N: m ∈ R} (m ∈ N), (4.1) that is, the smallest family of subsets of N that is closed under complementa- tion, finite intersections, and countable unions that contains the sets in (4.1). Furthermore, P(C(m)) = P(m ∈ R) = pm for all m, and this suffices to define P on every member of S uniquely. Similarly, (ΩA, SA, PA) may be identified with the product of the two-point spaces (Ωm, Sm, Pm) (m ∈ A) above. In what follows, we shall often write P instead of PA, as this will not cause any confusion. We will study how dense Sidon sets are contained in R. We introduce the notion of the growth of a set S ⊂ N. We say that S has lower growth at least h(n) if S[n] ≥ h(n) for every sufficiently large n. We also say that S has upper growth at most h(n) if S[n] ≤ h(n) for every sufficiently large n. Let R be a set of N. We will abbreviate the fact that there exists a Sidon subset S ⊂ R with lower growth at least h(n), by writing lgrIS(R) ≥ h(n). Similarly, ugr∀S(R) ≤ h(n) will mean that all Sidon subsets S ⊂ R have upper growth at most h(n). An abridged version of our results of this paper is the following.
Definition 4. Given a compression function f : {0, 1}c × {0, 1}c → C and a function split : N≥2 → N, we recursively define the tree hashes TH M : Mn → M, TH C : Cn → C and TH X : Xn → {0, 1}c as n n n TH M (m, ⊥,..., ⊥)= m, TH C(x1,..., xn)= f (TH X (x1,..., xk), TH X (xk+1,..., xn)), n k n n n TH X = TH M H TH C, where k = split (n). n−k Using these functions, we finally define the variable input length function TH : M ≤L → {0, 1}c which hashes variable length trees up to length L. Let U , with a size of K blocks, be the smallest tree of which all trees up to length L dom K area subtree of. TH ≤L maps an input m1,..., mn, to TH X (x1,..., xK), where ⊥ x1,..., xK is the tree Extend[U ](Tn), where Tn is the tree of size n with labels of m1,..., mn. This means that xi is equal to either some mj or . We can apply this mapping non-ambiguously as every tree up to length L is a subtree of U . For example, in the Xxxxxx-Xxxx˚xxx construction every tree of size n is a subtree of the tree of size n′ if n ≤ n′. This means that U is just the normal tree of size L, hence K = L. This is displayed in Fig. 3 for L = 4. Note that this is not the case in general. For example in the construction in Sakura, if L is equal to 2A + 1, then the right branch only contains one leaf, which means that it does not contain the tree for 2A, which is a full binary tree with a right branch of size 2A−1. However, we can still choose the next power of two as a tree that contains the necessary trees, hence K ≤ 2L. This is displayed in Fig. 4 for L = 5. dom We are ready to prove the collapseability of TH ≤L . dom
