P P P Sample Clauses

P P P. In other words, F now generates a random session key upon a first NewKey query for an honest party i with fresh record ( i, pwi) where 1−i is also honest, if (at least) one of the following events happen:

P P P. These vectors determine a generalized measurement with positive operators Oz = jzihzj. Since z Oz P 0 = z jz; 0ihz; 0j = z 11HE P 0 j zih zj11HE P 0 = 11HE P 0 , the Oz satisfy z Oz = 11HE , as they should in order to de- ne a generalized measurement [24]. Note that the rst case (nz dim HE ) is a special case of the second one, with j zi = jz; 0i. If Xxx now performs the measurement, then we have PXY Z(x; y; z) = jhx; y; zj ij2 = jhx; y; zj ; 0ij2, PXY jZ(x; y; z) = jhx; yj z; zij2 = jhxj zij2 jhyj zij2 = PXjZ (x; z)PY jZ(y; z) holds for all jzi and for all jx; yi 2 HA HB. Consequently, I(X; Y jZ) = 0. 2 Theorem 2 states that if AB is entangled, then Xxx cannot force the intrinsic information to be zero: Whatever she does (i.e., whatever generalized measure- ments she carries out), there is something Xxxxx and Xxx can do such that the intrinsic information is positive. Note that this does not, a priori, imply that secret-key agreement is possible in every case. Indeed, we will provide evidence for the fact that this implication does generally not hold.

P P P. G G P G G P

P P P. As usual in security notions for key exchange, the adversary also sets the session keys for corrupted players. In the definition of Xxxxxxx et al. [CHK+05], the adversary additionally sets Pi’s key if P1−i is corrupted. However, contrary to the original definition, we do not allow the adversary to set i’s key if 1−i is corrupted but did not guess i’s pass-string. We make this change in order to protect an honest i from, for instance, revealing sensitive information to an adversary who did not successfully guess her pass- string, but did corrupt her partner. Roles There are two categories of fPAKE protocols: symmetric protocols in which the two parties execute the same code, and asymmetric protocols in which the two parties execute different code. Frequently in asymmetric protocols, one party can be seen as the “sender” who initiates the protocol, and the other can be seen as the “receiver” who responds.2 In our ideal functionality, each party includes a role tag in her NewSession query; one party should identify herself as the sender (denoted as role = sender), while the other should identify herself as the receiver (role = receiver). The functionality simply forwards these role tags to the simulator; the roles do not affect any of the functinality’s decisions. In the case of symmetric protocols, the role tags are unnecessary, since a sender and a receiver execute the same code. In the case of asymmetric protocols, the simulator needs the role tags in order to determine which code to execute. It might look strange that the functionality ignores these role tags once it forwards them to the simulator; it might seem that, in the case of an asymmetric protocol, the functionality should only proceed if one of the roles provided is sender and the other receiver. However, in such a situation, the simulator can trigger the desired behavior — an abort — simply by never issuing a NewKey query.3 2 To reflect the fact that, even in symmetric protocols, one party likely requests that the other engage in key exchange with her, such a request message can be pre-pended to any symmetric protocol.‌

P P P. It remains to show that (6) implies ai si and xi 0. We show that whenever i ai = i si = 1 and ai 6 si, then i ai =si > 1 : First, note that Pi ai =si = Pi ai = 1 for ai si. Let now si1 ai1 and si2 ai2 . i1 i2 i1 i2 We show that a2 =si + a2 =si < a2 =(si ") + a =(si + ") holds for every i1 i2 that this is equivalent to a2 si (si + ") > a2 si (si

P P P. We denote the input of party Pi by mi 0, 1 A, which is divided into t blocks, with αth block being denoted by miα, for α = 1, . . . , t. At the beginning of our protocol, we initialize two dynamic variables n′ = n and t′ = t and one dynamic set ′ = . ′ denotes the set of non-eliminated parties and contains n′ parties, out of which at most t′ can be corrupted. In every segment α the computation is structured into three main phases: (a) Checking Phase, (b) Expansion Phase and (c)

P P P. SIG G1 As a consequence, we can reach the following security result Theorem 1. Our proposed pairing-based two-party authenticated key agreement protocol is secure, given the CDH assumption and the hash functions are assumed random oracles.