HAL Id: inria-00071357

HAL Id: inria-00071357

https://hal.inria.fr/inria-00071357

Submitted on 23 May 2006

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub-

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non,

Relating two Standard Notions of Secrecy

Eugen Zalinescu, Véronique Cortier, Michaël Rusinowitch

To cite this version:

Eugen Zalinescu, Véronique Cortier, Michaël Rusinowitch. Relating two Standard Notions of Secrecy.

[Research Report] RR-5908, INRIA. 2006, pp.32. �inria-00071357�

ISRN INRIA/RR--5908--FR+ENG

a p p o r t

d e r e c h e r c h e

Thèmes COM et SYM

INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE

Relating two Standard Notions of Secrecy

Eugen Z˘alinescu, Véronique Cortier, Michaël Rusinowitch

N° 5908

Avril 2006

Unité de recherche INRIA Lorraine

)*+-,/.103254768.',:9<;/*3='>@?/A<B-.'67CD*,FEGB-AIHJ67,/A:=LKM68;ONP5Q:4RS*'9<67.'BUTV68H<;ON

W3XUYIZ\[<]_^`bac[dfe:gaihjelkm]ndoYIZ\[p]qIrsZ\ZtUuUvwqIxsu/dy]3[dfelkm]zd{YpZG[<]]{klZ|5rs}~v~:tU[<]

€‚{rOƒn[db^„xs]o]{v~]

…†xs‡U‡5rs{d†ˆm[o[pqyXU[IyqyXU[‰u5ŠŒ‹O/ŽsFh’‘l{v~}’“sŽsŽ/”h•/“‡xO–s[<]

—S˜'™pšI›œUžsšsŸ

W &r¡]zd¢kl}~[p]SrO£ˆm[I¤¥uUv¦d{v~rsu¥]xs{[§t¥]{t¥xO}~}~k¨qIrsu¥]{v~ˆU[Io[pˆ©dorª[I«m‡U{[<]{]$d{X¥xOdxª]{[pqItU{v¦dnk

‡UorOdormqr/}Œ‡Uo[p]{[Io‘s[p]d{XU[qr/um¤ˆm[pu/dov~xs}¦v¦d¢k¬rO£†x§ˆUxOdox

s

­

…[<xsqyX¥xO|¥v¦}~v®dnk:¯7|xs]{[pˆ¬]{[pqI{[<qk°Z\[pxsu¥]d{Xxd

s

]{XUrst¥}~ˆuU[p‘s[I†|5[ˆmvw]oq}~r/]{[pˆ XUv~}¦[[p:tUv~‘xs}¦[pu¥q[¯±|¥x/]z[<ˆ]z[pqI{[<qkS]zdoxOd{[<]3d{X¥xOddn &r$[«m[<qtmdov¦r/u¥]rO£Œx

‡UorOdormqr/}² v¦d{X§ˆmvw]zd{v~u¥q³dfv¦u¥]zdyxOu¥q[<]3£´r/

s

]{XUrstU}wˆ|5[v~u¥ˆmvw]ndov¦u¥–stUvw]zXxO|U}~[dorVxsuµxOdzdox/qo¶s[p

­

†}¦d{XUr/tU–sX

doXU[¬]z[<qrsuˆ¨£´r/{ZtU}wxdov¦r/u·[pu¥]zt¥{[p]xªXUv~–sX¥[I}¦[p‘s[I}brO£]{[pqt¥{v¦d¢k·xOu¥ˆ·vw]qI}¦r:]z[pVd{r¨qok:‡Ud{rs–/oxO‡¥XUv~q

uUrsd{v~rsu¥]3rO£']{[pqI{[<qk/¸lˆm[<qvwˆUxO|¥v¦}~v®dnkVo[p]{tU}¦do]3xsu¥ˆxstmd{r/Z\xOd{vwq_d{rlr/}~]„Xx<‘s[bZ$xsv¦uU}~k$£´rmqt]z[<ˆSrsuSdoXU[b¤¥y]zd

ˆm[I¤¥uUv¦d{v~rsuµ]zrG£¹xO

­

W3XUv~]_‡¥xO‡5[p†v~uUv¦d{vwxdo[p]fx$]{km]ndo[IZ$xdov~qv~u:‘s[p]zd{v~–:xd{v~rsu@rs£Œ]{v¦d{t¥xOd{v~rsu¥]† XU[p{[]{k:u:dox/q³d{vwq]z[<qo[pqIkS[Ium¯

dyxOv~}~]]ndo{r/uU–]z[<qo[pqk

­º

[$]{XUr »doX¥xdv~u°doXU[\‡¥x/]{]{v¦‘s[\qIxs]{[s¸²o[px/qoXxO|Uv~}¦v¦dnk:¯7|¥x/]z[pˆ°]z[<qo[pqk§xsqd{t¥xs}¦}~k

v~Z\‡U}¦v~[p]Œ[<:tUv¦‘OxO}~[Iu¥qI[¯±|¥xs]{[pˆ]{[pqI{[<qk£´rsL]{v¦–/u¥xdotUo[p]p¸O]zklZ\Z\[do{vwq3xOuˆGxs]{klZGZ\[doov~q„[Iu¥qI{kl‡mdov¦r/u‡UorO¯

‘lvwˆm[pˆ@d{X¥xOd†doXU[‡Uov¦Z\v¦d{v~‘s[p]fxOo[‡Uors|¥xs|Uv¦}~vw]ndov~q

­3¼

rsfx/q³d{v~‘s[xsˆU‘s[Iy]{xs{v¦[<]3v¦uµd{X¥[qpxs]{[rs£L]zklZ\Z\[do{vwq

[pu¥qok:‡Ud{v~rsuD¸- &[‡UorJ‘lvwˆm[]{tm½Vqv~[Iu/d$¾¹xsu¥ˆ§yxd{X¥[I_d{v~–sX:dy¿fqr/u¥ˆmv¦d{v~rsu¥]frsu§d{XU[G‡UorOdormqr/}D£´rsfd{X¥v~]bv¦ZG¯

‡U}~vwqIxdov¦r/ud{r\X¥rs}wˆ

­

ÀµÁ:Â-Ã{ÄÅ ›JÆ'™/Ÿ ‘s[Iov®¤5qIxdov¦r/uD¸m]{[pqItU{v¦dnkV‡UorOdormqr/}~]p¸l]{[pqI{[<qks¸UxO‡U‡¥}¦v~[pˆ‡¥v®¯¢qIxs}~qItU}¦t¥]

™ Ÿ [ItU« ˆ¤uUv®dov¦r/u¥]]zr/u/dX¥xs|Uv¦d{tU[I}~}~[IZ\[Iu:d[IZ\‡U}~rJkp[p]‡5rstU[I«l‡¥{v~Z\[I:ttUuª‡UorOd{rs¯

qIrs}~[ˆm[µ]<qtUov¦d‡U<]z[p{‘s[}~x¬qIrsum¤ˆU[Iu/dov~xs}¦v¦d@ˆtUuU[µˆmrsuUuI[

­

[@]{[pqo[d$]{k:u:doxO«lvw:tU[[<]nd$tUuU[

‡Uors‡Uovdˆx/qIq[<]{]{v~|Uv¦}~v¦d

s

uU[ˆmrsv¦dŒƒzxsZ\xsv~]doo[I‘p}/¸ldyxOu¥ˆmvw]†:tU[}¦[]{[pqI{[Id3£´r/zd†[p]zd†tUu¥[‡UorO¯

‡Uovd$ˆp:tUv~‘xO}~[Iuq[ˆU[Itm«°[I«pqtUd{v~rsu¥]ˆtUu ‡U{rsd{rmqIrs}~[Gx<‘s[<qGˆm[p]v~u¥]ndyxOu¥qI[p]ˆUv~]zd{v~u¥q³do[p]‡5rstU

s

ˆmr/v¦‘s[pu/dd{o[†v~u¥ˆmvw]oq[Iou¥xO|¥}¦[<]Œ‡5r/tU‚tUuSxsˆm‘s[po]oxOv~{[

­

Wxsu¥ˆmvw]‚:tU[_}~x]{[pqIrsu¥ˆU[3£´r/{Zt¥}~xOd{v~rsuVxs]o]ztUo[tUu

uUv~‘s[pxstˆm[b]pqItUov®d_‡¥}¦t¥]„–/oxsu¥ˆ²¸:}¦[<]&p]{tU}¦doxdy]„ˆm[bˆpqvwˆUxO|¥v¦}~v¦db[d3}¦[<]&r/tmd{v~}w]„xOtmdorsZ$xOd{vw/t¥[p]„]z[b]{rsu:d

‡Uov~u¥qv~‡¥xO}~[IZ\[Iu:d3£´rmqpxO}~v~]p]]ztU†}~xG‡Uo[IZ\v~YIo[ˆI¤¥uUv¦d{v~rsu

­

^&[‡¥xO‡Uv~[Ifv¦u¥v®dov~xs}¦vw]{[t¥uU[xsu¥xO}~km]z[]zkm]zdpZ\xOd{vw:tU[ˆm[<]f]zv¦d{txd{v~rsu]†r! µ}~[]{[pqo[db]zklu/dyx«mvw:tU[v¦ZG¯

‡U}~vw/t¥[‚}~[&]{[pqo[d’£´rs{d

­"

r/t¥]’‡UorstU‘sr/u¥]’:tU[&ˆUxsu¥]’}~[&qIx/]’ˆtUux/ˆm‘s[Iy]{xsv¦{[Œ‡xs]o]zv¦£m}~[&]{[pqI{[Id]{rst¥]D£´rsoZ\[

ˆxsqpq[p]o]{v¦|Uv~}~v®dbv¦Z\‡U}~vw/t¥[[$#-[pq³dov~‘s[IZ\[Iu/d†}~[]z[<qo[d]{rst¥]&£´rsoZ\[ˆp:tUv~‘xs}¦[pu¥q[b‡5rst¥ˆm[p]]{v¦–/u¥xdotUo[p]

[IdqyXUv#5o[IZ\[Iu:do]]{klZ%Id{ov~:tU[<][Idx/]zklZ&do{vw:tU[\‡5rstUo‘lt :tU[$}~[p]‡Uov¦Z\v¦d{v~‘s[p]]{rsv~[Iu:d‡Uors|¥xs|Uv¦}~vw]ndo[p]

­

€rstULˆm[<]Œx/ˆm‘s[Iy]{xsv¦o[p]'xsq³dov¦£¹]ŒˆUxsu¥]}¦[†qIxs]Œˆmt$qoXUv#-{[pZG[pu/d‚]{klZ%Id{ov~:tU[3uUrst¥]£´rstUouUv~]o]{rsu¥]ˆm[<]Œqr/u¥ˆmv¦¯

dov¦r/u¥]]{tm½V]{xsu/do[p]3‡5rstU†:tU[}'v~ZG‡¥}¦vwqIxOd{v~rsu@]{rsv¦d‘loxsv¦[

­

(‰Å šp™ à ž!) ™Ÿ ‘Iov®¤qpxdov¦r/uD¸l‡UorOdormqr/}¦[<]„ˆm[]pqtUov¦ds¸¥qrsuU¤ˆm[Iu:d{vwxO}~v®ds¸¥xO‡¥‡U}¦v~[pˆ‡Uv®¯¢qIxs}~qItU}¦t]

+ ,

G’'$%‚

^&okl‡md{r/–syx‡¥XUv~q§‡UorOdormqr/}~]xs{[¬]{Z\xs}¦}‡Uors–syxOZ$]SˆU[p]{v¦–/uU[pˆ·dor©[pu¥]{tU{[¬]{[pqItUo[FqIrsZ\ZtUuUvwqIxOd{v~rsu¥]

­

elv~u¥q[doXU[Ikxs{[ v~ˆU[I}~kˆmv~]zd{ov~|Utmd{[<ˆv~uµqov®dov~qpxO}D]{km]ndo[IZ$]I¸ldoXU[Iv~_]z[<qtUov¦d¢kVvw]‡U{v~Z\rsyˆmvwxO}

­.-

u@‡¥xO{d{vwq³¯

tU}wxO<¸¥‘s[Iov®¤qpxdov¦r/ut¥]{v¦u¥–\£´rsoZ$xO}DZ\[Id{XUrmˆ¥]_xd{d{yxsq³do[pˆ@x$}¦rsd†rs£ŒxOdzdo[Iu/dov¦r/u§ˆmtUov¦uU–$d{XUvw]_}~x/]ndfˆm[pqpxsˆm[

­

 ¤¥y]zdˆmv¦½VqtU}¦d¢k vw]Vd{r £´r/{Z$xs}¦}~k©[«m‡Uo[p]o]\doXU[F]{[pqt¥{v¦d¢k¨‡Uors‡5[I{d{v~[p]$d{X¥xOdxOo[µ[«m‡5[<q³d{[<ˆ

­0/

‘s[Iu

xS|¥xs]{vwq‡Uors‡5[pzdnk@]{t¥qyXFxs]bqr/um¤ˆm[Iu:d{vwxO}~v¦d¢k§xsˆmZ\v¦do]fd¢ „rˆmv#-[Io[Iu:dx/qIqI[I‡mdyxO|U}~[ˆm[I¤¥uUv¦d{v~rsu¥]bu¥xsZG[p}¦k

o[px/qoX¥xs|Uv¦}~v¦d¢k:¯±|¥xs]{[pˆV¾"1*23'4 !'f¿']z[<qo[pqIkxOuˆ[p:tUv~‘xO}~[Iu¥qI[¯±|¥xs]{[pˆV¾%"1 5m¿']{[pqI{[<qk

­

…[pxsqyX¥xs|Uv¦}~v¦d¢k:¯

|¥x/]z[<ˆS]{[pqo[pqIk\v~]/t¥v®do[xO‡¥‡[<xO}~v~uU–'v¦d]ox<km]‚doX¥xd3d{XU[]z[<qo[d3v~]„u¥[I‘s[Ixsqpq[p]o]{v¦|U}~[_d{rdoXU[x/ˆm‘s[Iy]oxO{k

­

¼

rsf[«UxOZ\‡U}~[s¸-qIrsu¥]{vwˆm[I†doXU[£´rs}~}~rJ v~uU–S‡U{rsd{rmqIrs}’ XU[Io[d{X¥[xs–s[pu/d

A

]zv~Z\‡U}~k@]{[IuˆU]fxS]{[pqo[d

s

^d{r

xsuxs–s[pu/d

B

¸U[pu¥qokl‡md{[pˆ v®doX

B

]3‡UtU|¥}¦vwq¶s[Ik

­

A → B : { s } pub(B)

_uv¦u:d{ot¥ˆm[IqIxsuUuUrsd3ˆm[pˆUt¥q[

s

¸ld{Xlt¥]

s

vw]3]zklu/dyxsqd{vwqIxO}~}~k$]z[<qo[d

­

†}¦d{X¥rstU–/XVdoXUv~]3uUrOdov¦r/uSrO£']z[<q{[<qk

Z$xJk$|5[]ztm½Vqv~[Iu:dv¦uZ$xOulkV]oq[pu¥xOov¦r:]I¸:v~ursd{XU[po]p¸m]ndo{r/uU–s[p„]{[pqItU{v¦dnk${[<:tUv¦o[IZ\[pu/do]3xOo[bˆm[<]zv~yxO|U}~[

­

¼

rsv~u¥]zdoxOuq[$qIrsu¥]{vwˆm[Ix@]{[d{d{v~uU–µ XU[Io[

s

vw]x@‘srOdo[$xOu¥ˆ

B

|5[IX¥xJ‘s[p]ˆmv#-[Io[Iu:d{}~kFˆm[p‡5[Iu¥ˆUv¦uU–µr/u v¦do]_‘xO}~tU[

­6-

£doXU[x/q³dov¦r/u¥]rs£

B

xs{[r/|¥]z[p{‘OxO|U}~[s¸

s

{[pZ\xsv¦u]†]zklu:doxsqd{vwqIxs}¦}~k]{[pqo[d_|UtmdbxOu§xd{doxsqy¶s[I

qpxOu§}~[pxs{uµdoXU[‘OxO}~tU[p]frO£Ld{XU[G‘srOdo[|lk@ 3xdyqoXUv~uU–

B

]bxsqd{v~rsu¥]

­

W3XU[Gˆm[<]zv~–su°rO£‚[p:tUv~‘xs}¦[pu¥q[¯±|¥x/]z[<ˆ

]{[pqo[pqIkv~]†dyxOo–s[do[pˆµxdb]zt¥qyX°]{qI[Iu¥xs{v~r/]†xOu¥ˆµv~u/d{t¥v®dov¦‘s[p}¦kµ]ox<km]d{X¥xOdbxOu°xsˆm‘s[po]oxO{kqIxsuUuUrsd_rs|¥]{[Io‘s[

doXU[$ˆmv#5[p{[pu¥q[\ XU[IuFdoXU[\‘xs}¦t¥[GrO£‚doXU[$]{[pqI{[dqyX¥xsuU–s[<]

­

W3XUv~]ˆm[I¤¥uUv¦d{v~rsu¬vw][p]o]z[pu/d{vwxO}d{r@[«m‡Uo[p]o]

‡Uors‡5[pzdov¦[<]}~v¦¶s[qr/um¤ˆm[pu/d{vwxO}~v¦d¢krs£LxV‘srOd{[/¸rO£‚x$‡¥x/]{]{ &rsyˆ²¸¥rs†d{X¥[xOuUr/u:klZ\v¦d¢krO£Œ‡xO{d{vwqv~‡¥xOu:do]d{r

xG‡UorOdormqr/}

­

†}¦d{XUr/tU–sXSdoXU[]{[pqIrsu¥ˆV£´rsoZtU}~xOd{v~rsuS[pu¥]{tU{[<]„xXUv~–sXU[p„}~[I‘s[p}-rO£']{[pqtUov¦d¢kVxsu¥ˆSv~]q}~r/]{[I&d{r\qI{kl‡m¯

dors–syxO‡¥XUv~quUrOdov¦r/u¥]\rO£]z[<qo[pqk/¸&]zr¬£¹xOVˆm[pqIv~ˆ¥xO|Uv~}¦v¦dnkªo[p]{tU}¦do]$xOu¥ˆ¨xstmd{r/Z\xOd{vwqSdorlrs}w]GX¥xJ‘s[@Z\xsv¦u¥}¦k

£´rmqIt¥]z[<ˆ#r/u#doXU[¬¤o]zd§ˆm[¤¥u¥v®dov¦r/u

­

W3XU[ ]{klu/dox/q³dov~q ]z[<qo[pqIk·‡U{[<]z[p{‘Oxd{v~rsu#‡Uors|U}~[IZ vw]@tUu¥ˆm[<qvwˆl¯

xs|U}¦[$v¦u –s[puU[IyxO}87:9<“<;7¸v®dv~]qrs¯

"

€Œ¯±qIrsZ\‡U}~[do[G£r/x|5r/tUu¥ˆm[pˆ¬u:t¥Z|5[IrO£3]{[p]o]{v¦r/u¥]=7:9p”<;±¸'xOu¥ˆ¬]{[I‘:¯

[poxs}bˆm[<qvwˆUxO|U}~[¬qI}~x/]{]{[p]SX¥xJ‘s[F|5[I[pu#vwˆm[Iu:d{v¦¤¥[pˆ#v~u#d{XU[ qpxs]{[°rO£GxOu#tUu:|5r/tUu¥ˆm[<ˆ ultUZ|5[I@rs£]z[<]n¯

]{v¦r/u¥]>7:9<“m¸LU¸@?l¸A9?:¸A9J‹B;

­

W3XU[<]z[@o[p]{tU}®dy]Grs£d{[pu qrsZ\[@ v®doX xstmd{r/Z\xOd{[<ˆªd{rlr/}~]p¸‚ &[@Z\[Iu:d{v~rsu©£´r/

[I«mxsZ\‡U}¦[€LorCL[Iov®£D7‹<;±¸’^„†€&e

79391;±¸-xsu¥ˆ§’‘lvw]z‡xE7F;

­

WrVd{X¥[|5[p]zdfrs£LrstUf¶luUrJ }~[pˆU–s[s¸d{XU[r/uU}¦k

dorlrs}²qIxs‡¥xO|¥}¦[brO£‘s[p{v¦£´klv¦u¥–d{X¥v~]3‡Uors‡5[pzdnk$v~]„d{XU[o[p]{rs}~tmd{v~r/um¯7|¥x/]z[pˆSxO}~–srsov¦d{XUZ rO£€LorCŒ[p{v¦£@7”;²d{Xxd

X¥x/]|5[I[Iuª[«ld{[pu¥ˆm[<ˆ¬dor°]ndo{r/uU–§]{[pqo[pqIkFxsu¥ˆ rsuU}~kFr/uU[Sˆm[pqIv~ˆ¥xO|Uv~}¦v¦dnk¬{[<]ztU}¦dvw]xJ‘xOv~}wxO|U}~[E79<•<;

­E-

u

doXUv~]†xO{d{vwq}~[s¸#GDHmd{d{[p}D‡UorJ‘s[<]„ˆm[<qvwˆUxO|¥}¦[b£´rs†x£´yxO–/Z\[Iu/drO£d{XU[]z‡Uv¦¯¢qIxO}wqt¥}¦t¥]3 v®doXUrstmd†{[<qtUy]zv~rsuV£´r/

£´yxOZ\[pˆ|Uvw]{v¦Z\v~}~xs{v¦d¢k/¸UxGo[I}wxd{[<ˆS[<:tUv¦‘OxO}~[Iu¥qI[bo[I}wxd{v~rsuv¦u:d{ormˆmt¥q[<ˆ|:k_|¥xsˆmv’xsu¥ˆJIbrsyˆmrsuK7“<;

­

-u }¦v~–/X/drs£3d{XU[xO|5r‘s[Vˆmvw]{qIt¥]{]{v~rsuD¸'v®dZ$xJk¬]z[p[IZcd{X¥xOddoXU[$dn &r§u¥rOd{v~rsu]rs£†]z[<q{[<qkFxs{[S]z[p‡m¯

xsoxOd{[pˆª|:k¡xF]{vL<xO|U}~[–/xs‡ª£´{r/Z |rsd{X¨x¬qrsuq[I‡Ud{t¥xs}„|UtmdVxs}~]{r§£´orsZ xF‡Uyxsq³dov~qpxO}„‡5rsv~u/d$rO£f‘:v~[I 

­

W3XU[<]z[d¢ „r$uUrsd{v~rsu¥]Xx<‘s[qIrstUu:d{[Io‡¥xszdy]3v¦u@doXU[qokl‡mdors–syxO‡UXUvwq]z[d{d{v~uU–°¾´ XU[p{[ZG[<]{]oxO–/[p]xs{[|Uv¦dz¯

]zd{ov¦u¥–/]†xOuˆdoXU[xsˆm‘s[po]oxO{kVvw]_xOulk‡5rs}~kluUrsZ\vwxO}D‡Uors|¥xs|Uv~}¦vw]zd{vwqW’tUov~uU–$Z$xsqyXUv~uU[<¿

­8-

u/d{t¥v®dov¦‘s[p}¦k/¸¥doXU[

]{klu/dox/q³dov~q\]z[<qo[pqkµuUrsd{v~rsu qIxOu¬|5[Gd{yxOu¥]{}~xOd{[<ˆ§v~u/dorµx]{v¦Z\v~}~xso[pxsqyX¥xO|¥v¦}~v¦d¢k:¯±|¥xs]z[<ˆ§]{[pqI{[<qkµuUrsd{v~rsu

xsu¥ˆ§[p:tUv~‘xs}¦[pu¥q[I¯7|¥x/]z[<ˆ@uUrsd{v~rsu°vw]bqI}¦r:]z[d{rv¦uˆmv~]zd{v~uU–/tUv~]{X¥xs|Uv¦}~v¦d¢k

­  :tUv¦d{[\]{tU{‡¥{vw]zv~uU–So[p]{tU}®dM79<Ž<;

]zdoxOd{[p]‚doX¥xdqI{kl‡mdors–syxO‡UXUvwq†]{klu/dox/q³dov~qf]{[pqI{[<qk\x/q³d{txO}~}¦k\v~Z\‡U}~v¦[<]&v~u¥ˆmvw]zd{v~uU–stUvw]{X¥xO|Uv~}~v®dnk$v¦uSd{XU[qI{kl‡m¯

dors–syxO‡¥XUv~qG]z[Idzdov¦u¥–

­

W3XUvw]o[p]{tU}¦d{[p}¦v~[p]v~u¬‡¥xszdov~qItU}~xsrsuFd{XU[\£¹xsqddoX¥xdd{X¥[\[pu¥qokl‡md{v~rsu ]{qyXU[IZ\[<]

xs{[b‡¥{r/|¥xO|Uv~}~v~]zd{vwq_doX:t¥]3dn &r\[pu¥qokl‡md{v~rsu]„rs£d{XU[]oxOZ\[‡U}wxOv~u/d{[I«ld}~[px/ˆSd{r$ˆmv#-[Io[Iu/d_qIv¦‡¥XU[I{d{[I«:dy]

­

aµrOdov¦‘Oxd{[<ˆµ|:k@d{X¥[o[p]{tU}®dbrO£7:9pŽ<;LxOu¥ˆµd{X¥[}wxOo–s[ultUZ|5[IrO£&x<‘xsv¦}wxs|U}¦[]zkm]zd{[IZ$]_£´rs]zklu:doxsqd{vwq

]{[pqo[pqIkS‘s[p{v¦¤qIxOd{v~rsuD¸¥ &[v¦u¥v®dov~xOd{[v¦uµd{X¥v~]_‡¥xs‡5[IfxV]zkm]zd{[IZ$xOd{vwqv~u:‘s[<]ndov¦–:xdov¦r/u@rO£L]{v®dot¥xdov¦r/u¥]† XU[Io[

]{klu/dox/q³dov~q3]z[pqI{[<qk[Iu:doxsv¦}w]]zdo{r/uU–b]{[pqo[pqIk

­

emtU{‡Uovw]zv~uU–/}¦k/¸Jd{XUvw]X¥xs‡U‡5[Iu¥]v~uGZ$xOu:kv~u/do[Io[p]zd{v~uU–qIx/]z[<]

­

º

[\r#5[p{[<]ztU}¦do]bv~u¬|5rOd{X¬‡¥xs]o]{v¦‘s[\xOu¥ˆFx/q³dov¦‘s[\qIx/]z[<]fv~u°doXU[$]{[dzdov~uU–rs£‚d{XU[ ! ' '

5" 7:91;

­3º

[¤¥y]zddo{[<xd_v~u°el[pqd{v~rsu°“Gd{XU[qIx/]z[rO£Œ‡¥xs]o]zv~‘s[xsˆU‘s[Iy]{xs{v¦[<]

­&º

[‡UorJ‘s[doX¥xdb]zklu:doxsqd{vwq

]{[pqo[pqIkvw]Œ[p:tUv~‘xs}¦[pu/ddor]zd{orsuU–]{[pqI{[<qk

­

W3XUvw]ŒXUrs}wˆU]£´rsL]{v¦–/u¥xdotUo[p]p¸O]{k:Z\Z\[do{vwq3xsu¥ˆGxs]{klZ\ZG[Id{ov~q

[pu¥qok:‡Ud{v~rsu

­&-

dqpxOu°|5[[px/]zv~}¦kµ]{[I[Iu§doX¥xdbd{XU[dn &ruUrOdov¦r/u¥]frO£&]z[<qo[pqkµxOo[uUrOdb[<:tUv¦‘OxO}~[Iu:dfv~u§doXU[

qpxs]{[3rO£²ˆm[do[IoZGv~uUvw]ndov~q[Iu¥qI{kl‡mdov¦r/u

­O-

u¥ˆm[p[pˆ²¸sdoXU[†]{[pqI{[Id

s

qIxsuUuUrsdŒ|5[†ˆm[<ˆmt¥qI[pˆ£´orsZ‰doXU[[pu¥qokl‡md{[<ˆ

Z\[p]o]oxO–s[

{ s } pub(B)

|UtmdLv®£doXU[3[Iu¥qI{kl‡mdov¦r/uvw]ˆU[d{[p{Z\v~uUvw]ndov~qs¸sxOuv~u/do{tˆm[IŒZ\xJkdookˆmv#5[p{[pu/dŒ‘OxO}~tU[p]

£´r/

s

xOu¥ˆqyXU[pqy¶$ XU[doXU[I„doXU[qIv¦‡UX¥[I{d{[«ld3XU[br/|mdoxsv¦u¥[pˆVt¥]{v~uU–

B

]„‡UtU|U}~v~qb¶s[Ik$vw]„[p:t¥xO}5d{rd{X¥[brsu¥[

XU[o[pq[pv¦‘s[<]

­

W3Xlt¥]3£´rsr/tUo[p]{tU}®dd{r$XUrs}wˆ²¸U &[{[</t¥v¦o[fd{Xxd†[Iuqok:‡Ud{v~rsuv~]‡Uors|¥xs|Uv~}¦vw]ndov~q

­

W3XUvw]v~]

uUrsd3xo[p]zd{ov~qd{v~rsuV]{v~u¥q[_d{XUvw]„v~]&$4'doXU[b]zdoxsu¥ˆUxOyˆ\v~uxO}~Z\r/]zd„xO}~}-qokl‡md{r/–syx‡¥XUv~q†xs‡U‡U}~v~qpxd{v~rsu]

­

"

[«ldp¸¥ &[qIrsu¥]{v~ˆU[I3d{XU[Z\r/{[qoXxO}~}¦[puU–sv~uU–\qpxs]{[brs£xsqd{v~‘s[xsˆm‘s[po]oxOov¦[<]

­'º

[–sv~‘s[]ztm½Vqv~[Iu:d_qr/u¥ˆmv¦¯

dov¦r/u¥]3r/udoXU[‡UorOdormqrs}w]&£´rs_]zklu/dyxsqd{vwq]{[pqo[pqIk$d{r$v¦Z\‡U}~k]zd{orsu¥–\]z[<qo[pqk°¾7el[pqd{v~rsuµ•/¿

­ -

u:d{tUv¦d{v~‘s[I}~k/¸

 &[o[p:tUv~{[fd{X¥xOd3d{XU[qIrsu¥ˆUv®dov¦r/u¥xO}5do[p]zdo]xOo[fu¥rOd‡5[I{£´rsoZG[<ˆˆmv¦o[pqd{}~k$r/uSd{X¥[]z[<qo[d]{v¦u¥qI[b „[bX¥xJ‘s[

]{[I[Iuxs|5rJ‘s[†d{Xxd3]{t¥qyXVd{[<]ndy]&‡UorJ‘lvwˆm[_v~um£´rsoZ$xd{v~rsuVr/u$doXU[b‘xO}~tU[frO£Dd{XUvw]3]z[<qo[d

­º

[xO–:xOv~u$[«mXUv~|Uv¦d

]{[I‘s[poxs}Dqr/tUu/d{[pz¯±[«UxsZG‡¥}¦[<]„d{rVZGrsd{v~‘xOd{[doXU[v~u/d{ormˆmtq³d{v~rsu@rs£r/tU_qr/u¥ˆmv¦d{v~rsu¥]

­

†uµv~Z\‡5rs{doxsu/d_x/]n¯

‡5[pqd&rs£²r/tU‚o[p]{tU}¦d‚vw]LdoX¥xd& „[fˆmruUrOd&Z$xs¶s[_xOulk\xs]o]zt¥ZG‡mdov~rsu$rsu$doXU[_ultUZ|5[I&rs£’]z[<]{]{v¦r/u¥] ’ &[_‡UtUd

uUr\o[p]zd{ovwq³dov¦r/uSr/ud{XU[t]z[rs£'{[p‡U}~v~qpxd{v~rsu

­

W3XU[\v¦u:d{[Io[p]zdrs£&r/tUqrsu:d{ov~|Utmd{v~rsuFvw]bd¢ „rO£´rs}wˆ

­\¼

v~y]nd<¸’qrsuq[I‡mdot¥xO}~}~ks¸Dv®dXU[I}~‡¥]bd{r@tUu¥ˆm[po]zdoxsu¥ˆ

 XU[pu§d{XU[d¢ „rˆU[¤¥uUv¦d{v~rsu]frO£&]z[<qo[pqk@xs{[x/q³dot¥xO}~}¦k@[p:tUv~‘xs}¦[pu/d

­

el[<qrsuˆ²¸- &[GqIxsuµd{yxOu]n£´[pfZ\xsu:k

[I«lvw]zd{v~uU–µo[p]{tU}®dy]V¾8xOu¥ˆ¬d{XU[xOoZ$xsˆUxrO£†xOtmdorsZ$xdov~q\d{rlr/}~]y¿ˆm[I‘s[p}¦r/‡5[pˆF£´r/]{k:u:dox/q³d{vwqV]z[pqI{[<qk

­¼ rs

v~u¥]zdoxOuq[s¸Œ]{v~u¥q[Vd{XU[]zklu:doxsqd{vwqV]{[pqI{[<qkF‡Uors|U}~[IZvw]ˆm[pqIv~ˆUxs|U}~[$£´r/dyxO–/–s[pˆ ‡UorOd{rUqrs}w]£´rsGxOuªtUum¯

|5r/tUu¥ˆm[pˆ°u:tUZ|5[pbrs£‚]{[p]o]{v¦r/u¥]79J‹B;

­

kdooxsu¥]z}wxdov¦u¥–$doXU[doxO–/–sv~uU–xs]o]ztUZ\‡mdov¦r/uµdorSd{XU[\xO‡¥‡U}¦v~[pˆm¯7‡Uv

qpxO}wqtU}~t¥]I¸¥ &[qIxsu@ˆm[p{v~‘s[xG¤¥y]zd†ˆU[pqvwˆUxs|Uv¦}~v¦d¢k{[<]zt¥}®d£´rs_]zd{orsuU–$]{[pqo[pqIk$£´rs_xsutUul|5rstUu¥ˆU[pˆ@u:tUZG¯

|5[I‚rs£D]z[<]{]{v¦r/u¥]

­

`_doXU[I&ˆm[<qvwˆUxO|U}~[£´yxO–/ZG[pu/dy]ŒZ\v¦–/X/d&|5[_ˆm[p{v~‘s[pˆG£´{r/ZQ7:9<“B;£´rs‚|5r/tUu¥ˆm[pˆ$ZG[<]{]oxO–/[p]

¾8xOu¥ˆuUrsu¥qI[p]y¿„xOu¥ˆK7•;D£´rs†xG|5r/tUu¥ˆm[pˆu:tUZ|5[p†rO£]{[p]o]zv~rsu¥]

­

’ ’ %&

!#"%$ &')(*+,

^&okl‡md{r/–syx‡¥XUv~qb‡Uov¦Z\v¦d{v~‘s[p]†xs{[o[I‡Uo[p]{[Iu:d{[<ˆ|:kS£´tUu¥qd{v~rsu¥xs}’]{klZ|5rs}w]

­

aµrso[]{‡5[pqv¦¤qpxO}~}¦k/¸U &[qr/um¯

]{v~ˆU[IdoXU[†]{v¦–/u¥xdotUo[

Σ = {enc

^¸

dec

^¸

enca

^¸

deca

^¸

hi

^¸

π 1

¸

π 2

¸

sign

^¸

check

^¸

pub

^¸

priv}

^­

T (Σ, X , N )

ˆm[puUrOdo[p]d{XU[_]z[IdŒrs£d{[p{Z$]Œ|UtUv~}¦dLr‘s[I

Σ

[«ldo[Iu¥ˆm[<ˆG|:kx]z[IdLrO£-qIrsu¥]zdoxsu/do]p¸doXU[v~um¤¥uUv¦d{[_]{[dLrO£ .-M4"

N

xsu¥ˆSd{XU[v~um¤¥uUv¦d{[]{[drs£‘OxOov~xs|U}~[p]

X

^{­ } do[IoZ!vw] '4:<" r/D/ Sv¦£'v¦d†ˆUrl[p]3uUrOd_qrsu:doxsv¦u@xOu:k

‘xs{vwxs|U}¦[

­

W3XU[]{[d_rs£u¥xsZ\[p]†rmqIqItUo{v~uU–\v~u§x\d{[IoZ

m

v~]fˆm[IuUrsd{[<ˆ@|:k

fn(m)

¸¥doXU[]{[d_rs£Œ‘xOov~xs|U}~[p]

vw]\ˆm[puUrOdo[pˆ¡|lk

V(m)

^­ W3XU[0#<"1 !#"µv~u¨x°do[IoZ

t

xs{[ˆU[¤¥uU[<ˆ¡o[pqItUo]{v~‘s[I}~k xs]Gt¥]{t¥xO}¾) 12·x/]

]{[p:tU[Iuq[p]rs£„‡5r:]zv¦dov¦‘s[$v~u/d{[p–s[po]y¿³¸

|5[pv¦uU–µd{XU[V[IZ\‡mdnk¬]{[p:tU[pu¥q[

­

Pos(t)

 v~}¦}&ˆm[puUrOdo[\doXU[S]z[IdrO£

‡5r:]zv¦d{v~rsu¥]ŒrO£

t

^xOu¥ˆ

Pos v (t)

doXU[_]z[IdLrs£-‡5r/]{v®dov~rsu¥]ŒrO£-‘OxOov~xs|U}~[p]'v~u

t

^­'º [_ˆm[IuUrsd{[†|:k

t| p

d{X¥[_]ztU|Ud{[IoZ

rs£

t

xd‡5r:]zv¦d{v~rsu

p

^¸D|:k

u[v] p

d{XU[Gdo[IoZ r/|mdoxsv¦u¥[pˆ°|:k§o[I‡U}wxsqIv¦uU–v~u

u

d{XU[$]{tU|md{[p{ZixOd‡5r/]{v¦d{v~rsu

p

|lk

v

^­L¼ rs†xdo[IoZ

u

¸m „[ˆU[IuUrOdo[|:k

h u

d{XU[£´tUu¥qd{v~rsu@]{klZ|5rs}7¸luxOZ\[rs3‘xs{vwxO|¥}¦[bxOd3‡5r:]zv¦d{v~r/u

^v¦u

u

^­†º [ˆm[puUrOdo[|:k

≤ _st

¾¹{[<]z‡

­

< st

¿3doXU[]{tU|md{[p{Z ¾´o[p]{‡

­

]zdo{vwq³d³¿rsyˆm[I

­3º

[Z$xJk]{v~ZG‡¥}¦k@]oxJkSd{Xxd

x$d{[p{Z

v

"v~u°x$d{[p{Z

u

^v¦£

v

vw]fxV]{tU|mdo[IoZ rs£

u

^{­- £}

p = i 1 . · · · .i n

¸5 XU[Io[

n ≥ 1

¸-v~]fxV‡5r/]{v¦d{v~rsu doXU[Iu

pr(p) = i 1 . · · · .i n−1

vw]„d{X¥[#T„‡5r/]{v¦d{v~rsu 

­ ­d ­

p

^­ [Iu¥rOd{[|lk

N ^∗ ₊

d{XU[]{[drO£]z[<:tU[Iu¥qI[p]

rs£'‡5r/]{v®dov¦‘s[v~u/do[I–s[po]

­

º

[[p:tUv~‡doXU[]{v¦–/u¥xdotU{[b v¦doX@xsu[p:t¥xdov~rsu¥xO}-d{XU[prsok

E

 

 

 

 

 

 

 



π 1 (hz 1 , z 2 i) = z 1

π 2 (hz 1 , z 2 i) = z 2

dec(enc(z 1 , z 2 , z 3 ), z 2 ) = z 1

deca(enca(z 1 , pub(z 2 ), z 3 ), priv(z 2 )) = z 1

check(z 1 , sign(z 1 , priv(z 2 )), pub(z 2 )) = ok retrieve(sign(z 1 , z 2 )) = z 1

W3XU[b£´tUu¥q³dov¦r/u@]zklZ|5r/}~]

π 1 , π 2 , dec, deca, check

^xsu¥ˆ

retrieve

xOo[bqIxs}¦}~[pˆ 4"1 T'("

­ [Id

R E

|5[

doXU[$qr/{o[p]{‡5rsu¥ˆmv~uU–So[I ov®do[G]{km]ndo[IZ ¾¹rs|mdyxOv~uU[pˆF|:k§r/{v~[Iu:d{v~uU–SdoXU[\[p:t¥xOd{v~rsu¥]f£´{r/Z }~[£dd{rov~–sX/d³¿

­

R E

vw]_qrsul‘s[Io–s[Iu:d

­

W3XU[uUr/{Z$xO}²£´rsoZrO£ŒxGdo[IoZ

t

  ^{­ ­d ­}

R E

v~]_ˆm[Iu¥rOd{[<ˆ|lk

t↓

^{­ "} rOdov~qI[doX¥xd

E

vw]‚xs}~]{r]zdoxO|¥}¦[†|lkG]{tU|¥]zd{v¦d{tUd{v~rsuVrO£²u¥xsZ\[p]

­

_]‚t¥]ztxO}7¸/ &[† ov¦d{[

u → v

v¦£-doXU[Io[†[«mvw]zdo]

θ

¸:x‡5r/]{v¦d{v~rsu

p

^v~u

u

^xOu¥ˆ

l → r ∈ R E

]zt¥qyXdoX¥xd

u| p = lθ

^xOu¥ˆ

v = u[rθ] p

^­

W3XU[§]zklZ|5rs}

h , i

{[p‡U{[<]z[pu/dy]doXU[µ‡¥xsv¦ov¦u¥–F£´tUu¥qd{v~rsu·xsu¥ˆ

π 1

xsu¥ˆ

π 2

xs{[d{XU[°xs]o]zrmqIv~xOd{[pˆ

‡UorOƒn[pqd{v~rsuF£´tUu¥q³dov¦r/u¥]

­

W3XU[\d{[p{Z

enc(m, k, r)

o[I‡Uo[p]{[Iu/dy]fdoXU[$Z\[p]o]{xs–s[

m

[Iu¥qokl‡mdo[pˆF v¦d{X¬d{XU[

¶s[pk

k

^­ W3X¥[d{X¥v¦yˆ$xs{–/tUZG[pu/d

r

o[[pq³dy]Œd{X¥xOdLdoXU[_[Iu¥qI{kl‡mdov¦r/u\vw]L‡Uors|¥xs|Uv~}¦vw]zd{vwq ’d¢ &r[Iu¥qokl‡mdov¦r/u¥]Œrs£

doXU[†]oxOZ\[3Z\[<]{]oxO–/[p]'tUuˆm[IŒdoXU[_]{xsZG[¶s[Ikm]Œxs{[ˆUv#-[Io[Iu/d

­

W3X¥[†]zklZ|5r/}

dec

]ndyxOu¥ˆ¥]'£´r/‚ˆm[pqokl‡md{v~rsu

­

W3XU[†]{klZ|5rs}w]

enca

^xsu¥ˆ

deca

xOo[3‘s[Iok]{v¦Z\v~}~xsŒ|Utmd‚v~u$xOu$xs]{k:Z\Z\[do{vwq3]{[dzdov¦u¥–¥¸s XU[p{[

pub(a)

^xsu¥ˆ

priv(a)

{[p‡U{[<]z[pu/do[p]{‡5[pq³dov~‘s[I}~kd{XU[‡UtU|U}~vwq3xsu¥ˆ‡¥{v~‘xOd{[„¶s[Ikm]rO£-xOu\xO–s[pu/d

a

^­ W3XU[„do[IoZ

sign(m, k)

o[I‡Uo[p]{[Iu:do]Ld{XU[]zv~–suxd{t¥{[_rO£’Z\[p]{]oxO–/[

m

 v¦d{X¶s[Ik

k

^­

check

[Iu¥xs|U}¦[<]Ldor‘/[I{v¦£´kGd{XU[]{v¦–/u¥xdotU{[fxOu¥ˆ

retrieve

[pu¥xO|U}~[p]„dor\o[d{ov~[I‘s[fdoXU[]zv~–su¥[pˆZG[<]{]oxO–/[f£´{r/Z d{X¥[]zv~–su¥xOd{tUo[

­

£d{[pfdoXU[[«m[<qtmdov¦r/u§rO£&xV‡UorOd{rUqrs}7¸5xOuFxdzdyxsqy¶s[If¶luUrJ †]†doXU[Z\[p]o]oxO–s[<]_]z[pu/dbrsu§d{XU[u¥[dn &rso¶

xsu¥ˆ xO}w]zrµv¦u  XUvwqoX rsyˆm[pd{XU[pkF &[p{[V]{[Iu/d

­

elt¥qyX Z\[p]o]{xs–s[$]z[<:tU[Iu¥qI[p]xOo[\r/{–:xOuUv:LI[<ˆFxs]D$(.-M4"

ϕ = ν e n.σ

^{¸L XU[p{[}

σ = { ^{m 1} / y 1 , . . . , ^{m k} / y k }

vw]Gx°–sorst¥u¥ˆª]ztU|¥]zdov®dotmd{v~rsu¨xOu¥ˆ

e n

vw]Gx§¤¥uUv¦d{[@]z[IdGrs£

u¥xsZ\[p]

­Œº

[ˆm[Iu¥rOd{[|:k

dom(ϕ) = dom(σ) = {y 1 , . . . , y k }

^­ W3XU[‘OxOov~xs|U}¦[<]

y i

[IuxO|U}~[t¥]„dor\{[I£´[I

dor[px/qoXFZ\[p]o]{xs–s[

­

W3XU[Gu¥xsZ\[p]bv~u

e n

xs{[G]oxOvwˆ§d{r@|[J4"(1 !'4(

­=-

u/d{t¥v®dov¦‘s[p}¦k/¸²doXU[p]{[GuxOZ\[p]xs{[E

1 !1 &tUu¥¶:u¥rJ udorGd{XU[v~u/d{ot¥ˆm[p

­  d{[IoZ

M

^{vw]]oxOvwˆ 4 !'  ­ ­d ­ x£´oxsZ\[}

ν n.σ e

¾´rs†]{v¦Z\‡U}~k

n e

^¿

v¦£

fn(M ) ∩ e n = ∅

^­ W3XU[]z[Idrs£'{[<]ndo{vwq³do[pˆu¥xOZ\[<]

e

n

Z\v¦–/X/d†|5[rsZ\v®d{d{[<ˆ X¥[Iu@v®d†vw]†q}~[pxO3£´orsZ!d{XU[

qIrsu/do[«ld

­Œº

[t¥]zt¥xs}~}¦kV ov¦d{[

νn

v¦u¥]zd{[<xsˆrs£

ν{n}

¸¥xsu¥ˆSd{X¥[]{xsZG[b£´rs†|Uv¦–/–s[p]z[Ido]

­

!#"! *.'

Ibv~‘s[Iu·x¬£yxOZ\[

ϕ

d{X¥xOdV{[p‡Uo[p]{[Iu/dy]Gd{XU[§XUv~]zd{r/{k¡rO£ZG[<]{]oxO–/[p]\]{[Iu:dSˆmtUov¦u¥–¬d{X¥[µ[«m[<qtmdov¦r/u¨rO£x

‡UorOdormqr/}8¸‚ „[µˆm[I¤¥uU[@d{X¥[ .T'4 !M{[p}~xOd{v~rsuD¸„ˆm[puUrOdo[pˆ¨|:k

ϕ ` M

^­ [<ˆmt¥qv~|U}~[µZ\[p]o]oxO–s[<]Gxs{[

Z\[p]o]oxO–s[<]†d{XxdqpxOuF|5[Grs|mdyxOv~uU[pˆ§£´{r/Z

ϕ

|:k°xO‡¥‡U}¦klv~uU–S£´tUuq³d{v~rsuxO}Œ]{klZ|5rs}w]bxsu¥ˆµdoXU[\[p:t¥xdov¦r/u¥xO}

P! #"%$'&)('*,+-&./&(/.0132

(#*456('&78$9

84

P%:;56$'.0!

51P<51P= #+%&>(

P-&2<./&(#(,

&6?A@B5C&%P%:;56$D*& '+-&

P #$D"-2-&$

*878E 4

&(F%G&H8(#('"-./&I #+! I./&(#(#

&(*(P>84GJ1K(EL&M$'&N '$

&NO&2)56"% 56:B '+-&H(

P! #"%$'&6?

doXU[Ir/{k

E

^­

ν n.σ ˜ ` xσ x ∈ dom(σ)

ν n.σ ˜ ` s s ∈ N \ e n ν ˜ n.σ ` t 1 · · · ν n.σ ˜ ` t r

ν ˜ n.σ ` f (t 1 , . . . , t r )

ν n.σ ˜ ` t t = E t <sup>0</sup> ν n.σ ˜ ` t ⁰

œ )Á #4 -"

k

hk, k ⁰ i

(/T' D4:O$(.- # $(/-

νk, k ⁰ , r.{ ^{enc(k,k 0 ,r)} / x , ^k / ⁰ y }

1Z\[p]o]{xs–s[bvw]t¥]{t¥xO}~}~kS]oxOvwˆ]{[pqo[d†v®£v¦d†vw]uUrsd_ˆm[pˆmt¥qIv¦|¥}¦[

­

kSr/‡U‡5r/]{v®dov¦r/uSdor$rstUu¥[«ld†uUrsd{v~rsu

rs£]z[<q{[<qk/¸l &[]{xJk$d{X¥xOd_xd{[IoZ

M

vw]&"(*23'4 !' * " '43v¦u

ϕ

^v¦£

ϕ 6` M

^­

!#" &*+ * +M (

[pˆmt¥qIv¦|¥v¦}~v¦d¢kˆmrm[p]3uUrOd_xO}~ „xJkm]3]ztm½VqI[bd{r$[«m‡Uo[p]o]&d{XU[xs|Uv~}¦v¦d{v~[p]rO£xsuv~u:d{ot¥ˆm[I

­

œ )Á #>" %$J .T' 9 -1"("4" " 5T".-M $1 #&$(/-1"

ϕ 1 = νk,n 0 ,n 1 ,r 0 . { ^{enc(n 0 ,k,r 0 )} / x , ^{hn 0 ,n 1 i} / y , ^k / z }

ϕ 2 = νk,n 0 ,n 1 ,r 1 .{ ^{enc(n 1 ,k,r 1 )} / x , ^{hn 0 ,n 1 i} / y , ^k / z }

⁰

' " 2J34 'D5TD5T=:<"1-4"("4 3'1)4"# <"M2E "1 'A' 4"10#1 !'

#=23'34 " "1 5 " 5T 1:<" 4"42( 4*

ϕ 1

ϕ 2

º [ ]{xJk©doX¥xdµxª£yxOZ\[

ϕ = ν e n.σ

^#" "4"K5TK4"(

(M, N )

 ^XU[Io[

M, N

xs{[§dn &r¡d{[p{Z$]p¸

ˆm[puUrOdo[pˆ¬|:k

(M = N )ϕ

¸'v®£„doXU[Io[$[«mvw]ndy]x@o[Iu¥xsZGv~uU–@rO£„d{X¥[$o[p]zd{ov~qd{[pˆFuxOZ\[p]v~u

ϕ

]zt¥qyX¬d{X¥xOd

(fn(M )∪fn(N ))∩ n e = ∅

^xOuˆ

M σ = E N σ

^­ W &r†£´oxsZG[<]

ϕ = ν e n.σ

^xOu¥ˆ

ϕ ⁰ = ν m.σ e ⁰

xOo[A"1 !' *

8¸D {v¦dzdo[Iu

ϕ ≈ ϕ ⁰

¸-v¦£LdoXU[Ik§‡¥xs]o]†doXU[\]{xsZ\[do[p]zdo]p¸5doX¥xdvw]

dom(ϕ) = dom(ϕ ⁰ )

xOu¥ˆµ£´r/

xs}¦}5d{[IoZ$]

M, N

]zt¥qyXVdoX¥xd

(V (M ) ∪ V(N )) ⊆ dom(ϕ)

^xOu¥ˆ

(fn(M ) ∪ fn(N)) ∩ ( n e ∪ m) = e ∅

^¸l &[

X¥xJ‘s[

(M = N )ϕ

^v#

(M = N )ϕ ⁰

^­

œ )Á #@$(/-1"

ϕ 1

ϕ 2

"! ( $#5/- % "1 !' * <4 "1 '

(dec(x, z) = π 1 (y))ϕ 1

(dec(x, z) 6= π 1 (y))ϕ 2

[d

s

|5[\xV£´o[I[u¥xsZ\[rO£&xV£´yxOZ\[

ϕ = ν e n.σ

^­º [\]ox<kdoX¥xd

s

vw]"(5* " '_v~u

ϕ

^{v®£‚£´rs}

[p‘s[Iok§q}~r/]{[pˆ°‡UtU|U}~vwqdo[I{Z$]

M, M ⁰

  ^{­ ­d ­}

ϕ

¸D &[\X¥xJ‘s[

ϕ( ^M / ^s ) ≈ ϕ( ^{M 0} / ^s )

d{Xxdvw]I¸Dd{XU[$v¦u:d{ot¥ˆm[I

qpxOuUuUrsd3ˆmvw]zd{v~uU–stUvw]{XSd{XU[b£´oxsZG[bv~u¥]ndyxOu:d{vwxd{[<ˆS|:k$d¢ „rdo[IoZ$]„rO£v®dy]3qyXUrsvwq[

­¼

rs]zv~Z\‡U}~v~qIv®dnkV &[bZ$x<k

r/ZGv¦d

s

xOuˆ {v¦d{[

ϕ(M )

v¦u]ndo[pxsˆrs£

ϕ( ^M / s )

^­

!#"'& &')(*+M * )( I+* ' -,/.(( *0*21(435( +* '

elklu:doxsqd{vwq]{[pqI{[<qkv~]_t¥]{t¥xO}~}¦k &[pxs¶s[IdoX¥xOu°]ndo{r/uU–V]{[pqo[pqIk+6

º

[¤¥y]nd_[I«mXUv¦|¥v®db]{rsZ\[[«UxOZ\‡U}~[p]†rs£

£´yxOZ\[p]d{Xxd‡U{[<]z[p{‘s[<]]{k:u:dox/q³d{vwqV]z[<qo[pqIk°|UtmduUrsd]zd{orsuU–§]{[pqo[pqIk

­

W3XU[Ik xO}~}‚o[I}~kFrsuªˆmv#5[Io[Iu:d

‡Uors‡5[pzdov¦[<]

­

7 › Å ˜œm˜98')'88™Iš:8¹ž Á0; žO›  'š<8Å=;?>ªW3XU[V£´yxOZ\[

ψ 1 = ν s , k, r.{ ^{enc(s ,k,r)} / x , ^enc(n,k,r) / y }

ˆUrl[p]uUrOd

‡Uo[p]{[Io‘s[d{XU[§]zd{orsuU– ]{[pqo[pqIk rs£

s

­ - u¥ˆm[I[<ˆ²¸

ψ 1 (n) 6≈ ψ 1 (n ⁰ )

^]zv~u¥q[

(x = y)ψ 1 (n)

^|Utmd

(x 6=

y)ψ 1 (n ⁰ )

^­ W3X¥v~]_ &rstU}wˆ@uUrOdfX¥xO‡U‡5[puµv¦£Œ[px/qoXµ[Iu¥qI{kl‡mdov~rsu@t¥]{[pˆµxVˆmvw]zd{v~u¥q³dfyxOu¥ˆUrsZ\uU[p]o]p¸md{X¥xOd_vw]p¸v®£

doXU[[Iu¥qI{kl‡mdov¦r/u „x/]3‡U{r/|¥xO|¥v¦}~v~]zd{vwq

­

ÀµÁ/ Å

™:8¹š<8

Å=;?>fW3XU[£´yxOZ\[

ψ 2 = ν s , n.{ ^{enc(hn,n 0 i, s ,r)} / x }

ˆmrl[p]_uUrOdf‡Uo[p]{[Io‘s[d{XU[]zd{orsu¥–V]z[I¯

qI{[pqIk rO£

s

­ - uˆm[I[<ˆ²¸

ψ 2 (k) 6≈ ψ 2 (k ⁰ )

^]zv~u¥qI[

(π 2 (dec(x, k)) = n ⁰ )ψ 2 (k)

^|Utmd

(π 2 (dec(x, k)) 6= n)ψ 2 (k ⁰ )

^{­ - £}

s

rmqIqItUy]$v~u ¶s[Ik¨‡5r:]zv¦d{v~rsu v¦u#]{rsZ\[°qIv¦‡UX¥[I{d{[«ld<¸3doXU[Fv¦u:d{ot¥ˆm[I

Z$xJkµd{okµd{rµˆm[<qokl‡mdd{XU[Vqv~‡UXU[pzdo[«ld]{v¦uq[

s

vw]{[p‡U}wxsq[<ˆ°|:k°‡UtU|U}~vwqdo[IoZ$]xOu¥ˆ¬qoX¥[pqy¶µ£´rs]{rsZ\[

o[pˆmtUuˆUxOu¥qIk

­ -

d†Z$x<kVrmqpqtU„doX¥xdd{XU[[Iuq{kl‡mdo[pˆZ\[p]o]{xs–s[bˆUrl[p]3uUrOd†qIrsu:doxOv~uxsu:kV‘s[p{v¦¤xO|¥}¦[b‡¥xszd

­

-

udoX¥xd_qIxs]{[s¸ld{XU[£´oxsZ\[bZ$xJkV‡U{[<]z[p{‘s[b]zdo{r/uU–G]{[pqI{[<qk

­ -

dvw]„£´rs[«UxOZ\‡U}~[bd{XU[qIxs]{[brO£d{X¥[b£´yxOZ\[

νn{ ^{enc(n, s ,r)} / x }

^­ elt¥qyX@qpxs]{[p]3xs{[XUrJ „[I‘s[I†:tUv®do[oxs{[bv¦u@‡Uyxsqd{vwq[

­

µÅ Æ Á ™pšI› 'žOš Å ›™ >3W3XU[_£´oxsZ\[

ψ 3 = ν s .{ ^{π 1 ( s )} / x }

ˆmrl[p]&uUrOd„‡¥{[<]z[Io‘s[doXU[b]zd{orsuU–]z[<qo[pqkGrs£

s

]{v¦Z\‡U}~kS|5[pqpxOt¥]{[

(x = k)

v~]3d{otU[b£´r/

ψ 3 (hk, k ⁰ i)

 XUv~}¦[uUrsd3£´rs

ψ 3 (k)

^­

SÁ šI›8Á5Á › )Á=>LW3XU[

retrieve(sign(z 1 , z 2 )) = z 1

Z$x<kb]{[I[pZ xOo|Uv¦d{yxOok†]{v~u¥q[LuUrsdxO}~}s]{v~–su¥xOd{tUo[

]oqoX¥[IZ\[p]b[Iu¥xs|U}~[dor–s[dbdoXU[\]{v¦–/uU[pˆ°ZG[<]{]oxO–/[rstUdrO£„x]{v¦–/u¥xdotUo[

­ -

dvw]x/q³d{txO}~}¦k§qot¥qvwxO}£´r/rstU

o[p]{tU}¦d

­'¼

r/'[«UxOZ\‡U}~[s¸d{XU[&£´yxOZ\[

ψ 4 = ν s .{ ^{sign( s ,priv(a))} / x , ^pub(a) / y }

ˆUrl[p]'uUrOd‡Uo[p]{[Io‘s[Ld{XU[]ndo{r/uU–

]{[pqo[pqIk$rs£

s

|5[pqpxOt¥]{[

(check(n, x, y) = ok)

vw]„do{tU[£´rs

ψ 4 (n)

|Utmd_uUrOd£´rs

ψ 4 (n ⁰ )

^­

-u d{X¥[p]{[$£´rst¥qIx/]z[<]I¸d{XU[V£´yxOZ\[p]‡Uo[p]{[Io‘s[GdoXU[]{k:u:dox/q³d{vwqV]{[pqo[pqIk°rO£

s

¸doX¥xdvw]

ψ i 6` s

¸'£´r/

1 ≤ i ≤ 4

^­

W3XUv~]}~[pxsˆ¥]3t¥]„dorGdoXU[£´rs}~}¦r v~uU–\ˆm[I¤¥uUv¦d{v~rsu

­

Á9;

8´š:8

Å=; $(/-

ϕ = ν e n.σ

" &[I}~}¦¯8£´r/{Z\[pˆ ::@".-M .-M

s

$

6'44*% ! " 4 "( !'6 1 $1T*" 44 -

enc(m, t, r)

^)$

φ

^{$4T* 4 -}

t ⁰ ∈ φ

T<"1 !

p

^{" T' K#}

t ⁰ | _p = r

^T

p = q.3

^$4".-M

q

t ⁰ | _q = enc(m, t, r)

# "4.-M'( T" $4 <"1*/- -M 1 !'4'41* ! 1 ! $

s

B' ' ("

m

#<"1 !

p ⁰

^{" T'} #4'44*% !K # ("##5&$(.- #&B 2

p ⁰

^#

r

- 5"1 1"11 !'4 / 5#@ "

r ∈ e n

%

s

"K #1)$ 3* 1 6$4

enc(m, t, r)

enca(m ⁰ , t ⁰ , r ⁰ )

sign(u, v)

pub(w)

priv(w ⁰ )

" 2 -" %$

ϕ

s ∈ / fn(t, t ⁰ , v, w, w ⁰ , n, n ⁰ )

ϕ

^{B1" 8' 2} 31"1 T'4&"1*/-3("

^&r/u¥ˆmv¦d{v~rsuK9o[p:tUv~{[<]‚doX¥xd[<xsqyXv~uUuU[IoZ\r/]zd3[pu¥qokl‡md{v~rsuxs|5rJ‘s[

s

qr/u/dyxOv~u¥]3xG{[<]ndo{vwq³do[pˆSyxOu¥ˆmr/ZG¯

uU[<]{]

­

W3XUv~]vw]uUrOdx@{[<]ndo{vwq³dov¦r/u¬]{v¦uq[

s

vw]Z\[pxsu/ddor@|5[Vxµ]z[<qo[d‘xs}¦t¥[$xOu¥ˆ ]ztqoX [Iu¥qI{kl‡mdov~rsu¥]

X¥xJ‘s[bd{r$|[‡Uormˆmt¥qI[pˆ|:kSXUr/uU[p]zd†xO–/[Iu:do]xOu¥ˆSdoX:t¥]†qIrsu:doxOv~u@xG{[<]ndo{vwq³do[pˆoxsu¥ˆmrsZ\uU[<]{]

­

¼

rs „[I}~}®¯7£´rsoZG[<ˆV£´yxOZ\[p]p¸U]{k:u:dox/q³d{vwq]{[pqo[pqIk$vw]x/q³dot¥xO}~}¦kV[<:tUv¦‘OxO}~[Iu/dd{r$]zd{orsuU–\]{[pqI{[<qk

­

ÁlÅ › Á 4

ϕ = ν e n.σ

^{(= $4 -M( $(/-::}

s ∈ e n

ϕ 0 s

ν e n\{ s }.σ( ^M / s ) ≈ ν n\{ e s }.σ( ^{M 0} / s )

$4

M, M ⁰

'<"( 4 !'2 -"&::

ϕ

7 › ÅDÅ

º

[‡Uo[p]{[Iu:d†d{XU[]{¶s[I}~[dorsu@rs£d{XU[‡Uorlrs£xO}~}ˆm[Idoxsv¦}w]_qIxsuµ|5[£´rst¥u¥ˆ@v~u°†‡U‡5[Iuˆmv®«§

­ [d

ϕ = ν e n.σ

|5[xV &[I}~}¦¯8£´rsoZ\[pˆ£´yxOZ\[ 

­ ­d ­

s ∈ e n

^­D-£

ϕ ` s

¸d{XUvw]†do{v~‘lv~xs}¦}~kv~Z\‡U}¦v~[p]_d{X¥xOd

s

vw]_uUrOd

]zd{orsuU–/}¦k°]{[pqI{[Id

­-

u¥ˆm[p[pˆ²¸doXU[Io[$[«mvw]ndy]x@‡UtU|U}~vwq\d{[IoZ

M

  ^{­ ­d ­}

ϕ

]zt¥qyX¬doX¥xd

M σ = E s

¾doXUv~]

qpxOuS|5[b[<xs]{v¦}~k$]{XUrJ u|:k$v~u¥ˆmt¥qd{v~rsur/uVdoXU[ˆm[<ˆmt¥q³dov¦r/u]zkm]zd{[pZ$¿

­

[d

n 1 , n 2

|5[f£´{[<]zXu¥xOZ\[<]„]{t¥qyX

doX¥xd

n 1 , n 2 ∈ / e n

^xOu¥ˆ

n 1 , n 2 ∈ / fn(ϕ)

^{­ elv~u¥q[}

M σ( ^{n 1} / s ) = E n 1

doXU[G£´oxsZ\[p]

ν n\{ e s }.σ( ^{n 1} / s )

^xsu¥ˆ

ν e n\{ s }.σ( ^{n 2} / s )

xOo[ˆmvw]ndov~uU–stUvw]zXxO|U}~[ v®doXd{XU[do[p]zd

(M = n 1 )

^­

º

[$xs]o]ztUZ\[uUr »doX¥xd

ϕ 0 s

­º

[¤o]zd]zXUr »d{X¥xOdxsu:k§]zklu:doxsqd{vwq[<:t¥xO}~v®dnk§]oxd{vw]z¤¥[pˆ§|lk@doXU[

£´yxOZ\[

ϕ( ^M / ^s )

v~]†xO}~o[pxsˆmkS]{xOd{vw]n¤¥[<ˆS|lk

ϕ

^­

&Á œ O4

ϕ = ν n.σ e

⁽ $4 -M(K$(.-M ::

s ∈ e n

u, v

^{2 -" " T' 05T}

V(u), V(v) ⊆ dom(ϕ)

M

^{'"4( 4 -}

u

v

M

^{!' ::}

n e

^$

ϕ 0 s

uσ( ^M / s ) = vσ( ^M / s )

^{5-) !1"}

uσ = vσ

t

^{(K "4 - %$ 4 -}

σ

^{5TM3 4"E}

'(T

s

!$

ϕ 0 s

t = vσ( ^M / s )

^{5- !1"}

t = vσ

W3XU[§¶s[pk©}~[IZ\Z$x v~]Vd{XxdxOu:k¨{[<ˆmt¥q³dov~rsu d{X¥xOdxs‡U‡U}~v¦[<]$d{r©x ˆU[pˆmt¥qIv¦|U}~[§d{[p{Z

t

 ^XU[p{[

s

v~]

o[I‡U}wxsqI[pˆS|lk]zr/ZG[

M

¸¥ˆmv¦o[pqd{}~kSxs‡U‡U}~v¦[<]„d{r

t

^­

&Á œ O4

ϕ = ν e n.σ

^{( > 4$4 - $(/-M::}

s ∈ e n

^{" T' 5T}

ϕ 0 s

O4

u

⁽

4 - 5

V(u) ⊆ dom(ϕ)

M

(J'<"(>2 - -5$4 -

u

M

^!'M::

e

n

^?$

uσ( ^M / s ) → v

$4D".-M -

v

^O# 5T4&#3 "1!" $4 -8$().-

ϕ ⁰ = ν e n.σ ⁰

^::

s

#32

ϕ

^{#@ "}

xσ ⁰ = xσ

^$4

x ∈ dom(σ)

)4" 5>3 /T' D4 -"

ϕ ` w

ϕ ⁰ ` w

"T'J#

v = v ⁰ σ ⁰ ( ^M / s )

^{$4 "/-}

v ⁰

^!'::

e n

W3XUvw]„}¦[pZGZ$xxs}~}¦r †]‚t¥]&d{r\qrsuq}~t¥ˆm[_d{X¥[b‡U{rmrO£DrO£W3XU[prso[IZ 9

­¼

v¦«SxOo|Uv®dooxs{v~}~kdn &r‡Ut¥|U}¦vwqbq}~r/]{[pˆ

do[IoZ\]

M, M ⁰

^­ªº [@qpxOu©x/]{]{tUZ\[ 

­}­r ­– ­ d{Xxd

M

^xsu¥ˆ

M ⁰

xs{[v¦u©u¥rsoZ\xs}‚£´r/{Z

­

[d

u 6= v

|5[d¢ „rS‡UtU|¥}¦vwqd{[p{Z$]b]zt¥qyXµdoX¥xd

V(u), V(v) ⊆ dom(ϕ)

^xsu¥ˆ

uσ( ^M / s ) = E vσ( ^M / s )

^­ W3XU[Iu§d{X¥[Io[

xs{[

u 1 , . . . , u k

xsu¥ˆ

v 1 , . . . , v l

]zt¥qyX¬d{X¥xOd

uσ( ^M / s ) → u 1 → . . . → u k

¸

vσ( ^M / s ) → v 1 → . . . → v l

¸

u k = uσ( ^M / s )↓

^¸

v l = vσ( ^M / s )↓

^xsu¥ˆ

u k = v l

^­

†‡U‡U}~klv¦u¥–§o[I‡5[<xdo[pˆm}~k

[pZ\Z\xF“@ &[Sr/|mdoxsv¦u doX¥xddoXU[Io[S[«mv~]zd‡UtU|U}~v~qVd{[IoZ$]

u ⁰ ₁ , . . . , u ⁰ _k

^xsu¥ˆ

v ₁ ⁰ , . . . , v _l ⁰

^xsu¥ˆ  &[p}¦}¦¯8£´r/{Z\[<ˆF£´yxOZ\[p]

ϕ ^{u i} = ν e n.σ ^{u i}

^¸'£´rs

i ∈ {1, . . . , k}

^xsu¥ˆ

ϕ ^{v j} = ν e n.σ ^{v j}

^¸£´r/

j ∈ {1, . . . , l}

¾¹x/]3v¦ud{X¥[}¦[pZGZ$x:¿„]{t¥qyXd{Xxd

u i = u ⁰ _i σ ^{u i}

^xOu¥ˆ

v j = v _j ⁰ σ ^{v j}

^­

º

[qrsu¥]{vwˆm[I

ϕ ⁰ =ν e n.σ ⁰

 ^XU[Io[

σ ⁰ =σ ^{u k} ∪ σ ^{v l}

^­ elv¦uq[r/uU}¦k]{tU|mdo[IoZ\]rO£

ϕ

X¥xJ‘s[|5[I[puµxsˆUˆm[<ˆ

dor

ϕ ⁰

¸mv¦dvw]„[<xs]{kGdorG‘s[p{v¦£´k\doX¥xd

ϕ ⁰

v~]]ndov¦}~}Dx &[p}¦}¦¯7£´rsoZG[<ˆ$£´yxOZ\[xsu¥ˆV£´rs[I‘s[Iok\d{[IoZ

w

^¸

ϕ ` w

^v#

ϕ ⁰ ` w

^{­ -} u@‡¥xO{d{vwqt¥}~xs

ϕ ⁰ 0 s

­

kFqr/u¥]ndo{t¥qd{v~rsuF „[\X¥xJ‘s[doX¥xd

u ⁰ _k σ ^{u k} ( ^M / ^s )=v ⁰ _l σ ^{v l} ( ^M / ^s )

^­ W3XU[IuD¸|:k

[pZ\Z\x 9/¸D „[$ˆm[pˆmtq[

doX¥xd

u ⁰ _k σ ^{u k} ( s )=v _l ⁰ σ ^{v l} ( s )

^{doX¥xdv¦d}

uσ = E vσ

^­ k§]zdoxs|Uv¦}~v¦d¢k§rO£„]{tU|¥]ndov¦d{tmdov¦r/uFrs£‚u¥xsZ\[p]p¸² &[GX¥xJ‘s[

uσ( ^{M 0} / s ) = E vσ( ^{M 0} / s )

^­Œº [ˆU[pˆmt¥qI[bdoX¥xd

ν e n\{ s }.σ( ^M / s ) ≈ ν n\{ e s }.σ( ^{M 0} / s )

^­

%‚ %„ ’

Wr]{v¦Z\‡U}~v¦£´kd{XU[†xOu¥xO}~k5LI[„rO£d{XU[†xsqd{v~‘s[3qIx/]z[/¸ „[„o[p]zd{ovwq³drst¥Œxd{d{[Iu:d{v~rsudorb‡xOv~{v~uU–xOu¥ˆG]zklZ\Z\[do{vwq

[pu¥qok:‡Ud{v~rsu‚d{XU[xO}~‡UX¥xs|5[d

Σ

v~]_uUrJ 1{[<ˆmt¥qI[pˆd{r

Σ = {enc, dec, hi, π 1 , π 2 }

^xsu¥ˆ

E

vw]†}¦v~Z\v®do[pˆ@d{r doXU[¤¥o]zd3doXU{[p[[p:t¥xOd{v~rsu¥]

­

#"%$ 1/0 ( 3 .* 1 * 1/+1 ( *( *0 + . . . +M (

W3XU[xO‡¥‡U}¦v~[pˆ@‡UvqpxO}wqtU}~t¥] 7:94;vw]†x$‡U{rUq[p]o]xO}~–s[p|Uyx &[p}¦}¦¯¢]ztUv¦d{[<ˆ£´r/†Z\rmˆm[I}~v~uU–Vqokl‡md{r/–syxO‡UXUvwqf‡UorO¯

dormqr/}~]p¸l–s[puU[IyxO}~v:LIv~uU–d{X¥[]{‡Uv¦¯±qpxO}wqtU}~t¥] 7“<;

­Œº

[]zXUr/zdo}¦kSˆm[<]{qI{v~|5[bv¦do]†]zklu:dox«xsu¥ˆ]z[pZ\xsu/dov~qp]

­

W3X¥v~]

‡¥xszdvw]3Z\r:]ndo}¦kS|5rso{r &[pˆV£´{r/Z 7:91;

­

6 ' 4"("1"³¸xs}~]{r\qIxs}¦}~[pˆ‡U}wxOv~u‡UormqI[p]{]{[p]p¸mxOo[ˆm[I¤¥uU[pˆ|:kVdoXU[–syxOZ\Z$xO

P, Q, R :=

‡Uormq[p]o]{[p]

0

u:tU}~}D‡Uormq[<]{]

P|Q

‡xOyxO}~}¦[p}²qr/ZG‡5r:]zv¦d{v~rsu

!P

o[I‡¥}¦vwqIxOd{v~rsu

νn.P

u¥xsZ\[o[p]ndoov~qd{v~rsu

if M = N then P else Q

qr/u¥ˆmv¦d{v~rsu¥xs}

c(z).P

ZG[<]{]oxO–/[bv¦uU‡¥tmd

chM i.P

Z\[p]o]oxO–s[br/tmd{‡UtUd

 XU[p{[

n

vw]x§u¥xsZ\[s¸

M

^¸

N

xOo[$d{[p{Z$]p¸Œxsu¥ˆ

c

vw]x§uxOZ\[SrsGx§‘xs{vwxO|¥}¦[

­

W3XU[SultU}~}„‡Uormq[<]{]

0

ˆmrm[p]„uUrsd{XUv~uU–

­

€xsoxs}¦}~[I}²qr/Z\‡5r/]{v®dov¦r/uS[«m[<qtmdo[p]&doXU[bdn &r\‡U{rUq[p]o]{[p]„qrsuqtUo{[pu/do}¦k

­

…[I‡¥}¦vwqIxOd{v~rsu

!P

qI{[pxOd{[<]ŒtUul|5rstUu¥ˆU[pˆm}~kGuU[p  v~u¥]ndyxOu¥qI[p]Lrs£

P

^{­ "} xOZ\[†o[p]zd{ovwq³d{v~rsu

νn.P

|¥tUv¦}wˆU]&xuU[I ¸:‡Uov¦‘Oxd{[†u¥xsZG[

n

¸-|Uv~u¥ˆU]bv®dv¦u

P

xsu¥ˆ@doXU[IuF[«m[pqItmd{[<]

P

^­ W3XU[Gqr/u¥ˆmv¦d{v~rsu¥xs}

if M = N then P else Q

|5[IX¥xJ‘s[p]

}~v¦¶s[

P

^rs

Q

ˆm[I‡5[pu¥ˆmv~uU–r/u$doXU[fo[p]{tU}¦d&rs£²doXU[_do[p]zd

M = N

^{­ - £}

Q

vw]‚d{X¥[fu:t¥}¦}-‡Uormq[<]{]Ld{XU[puS „[ft¥]z[

doXU[buUrOdyxd{v~rsu

[M = N].P

v¦u]ndo[pxsˆ

­¼

v~u¥xO}~}~ks¸:d{X¥[f‡¥{rmqI[p]o]

c(z).P

v~uU‡Utmdy]3xZ\[p]o]{xs–s[fxOu¥ˆV[I«l[<qtmdo[p]

P

|¥v¦u¥ˆUv¦uU–°doXU[‘OxOov~xs|U}¦[

z

d{r°d{XU[{[<q[Iv~‘s[pˆ Z\[p]o]{xs–s[/¸' XUv~}~[Sd{XU[‡U{rmqI[p]o]

chM i.P

rstmdo‡Utmdy]d{X¥[

Z\[p]o]oxO–s[

M

xOu¥ˆSd{XU[pu|5[IX¥xJ‘s[p]„}~v¦¶s[

P

^­Œº [Z\xJkVrsZ\v®d

P

^v¦£v¦dvw]

0

­ -

u X¥xd3£´rs}~}¦r †]p¸l &[{[p]zdo{vwq³d

r/tULxdzdo[Iu:d{v~rsuGd{rd{XU[†qpxs]{[„ XU[p{[

c

v~]Œu¥xsZG[†]zv~u¥qI[3v¦dLv~]Œt¥]{t¥xO}~}~k]{tm½Vqv~[Iu/dLd{rZ\rmˆU[I}¥qok:‡Ud{rs–/oxO‡UX¥v~q

‡UorOdormqr/}~]

­

$#32 3 ' 4"("1"xOo[ˆm[I¤¥uU[pˆ|lkVd{XU[–/oxsZGZ$xs

A, B :=

[«ld{[pu¥ˆm[<ˆ‡Uormq[<]{]{[p]

P

‡U}~xsv~u‡U{rUq[p]o]

A|B

‡xOyxO}~}¦[p}²qr/ZG‡5r:]zv¦d{v~rsu

νn.A

u¥xOZ\[o[p]zd{ov~qd{v~rsu

νx.A

‘OxOov~xs|U}¦[bo[p]zd{ov~qd{v~rsu

{ ^M / x }

xsq³dov¦‘/[]{tU|¥]zd{v¦d{tUd{v~rsu

' < " 4"( !T"\–s[puU[IyxO}~vLp[

let

^¸'v¦u d{X¥[S]z[pu¥]z[\doX¥xd

νx.({ ^M / x }|P )

qr/{o[p]{‡5rsu¥ˆU]bd{r

let x = M in P

¸_ X¥v¦}~[Ft¥uU{[<]ndo{vwq³do[pˆ²¸

{ ^M / x }

|5[IX¥xJ‘s[p]}~v¦¶s[¬x¡‡5[p{Z$xOu¥[Iu/d@¶:u¥rJ }~[pˆm–/[s¸_‡[p{Z\v¦dzdov¦u¥–¡d{r

o[£´[I–s}~rs|xO}~}¦k§d{r

M

|:k¬ZG[<xOu¥]rO£

x

^­@º [Sv~ˆU[Iu/dov®£´k ‘xs{vwxO|U}~[$]{tU|¥]zd{v¦d{tmdov¦r/u¥]

{ ^{M 1} / x 1 , . . . , ^{M k} / x k }

^¸

k ≥ 0

 v®doX[I«ld{[Iuˆm[pˆ‡U{rUq[p]o]z[<]

{ ^{M 1} / x 1 }| . . . |{ ^{M k} / x k }

^{­ -} u‡¥xszdov~qItU}~xs„d{XU[[IZ\‡mdnk]{tU|¥]zd{v¦d{tmdov~rsu@v~]

vwˆm[Iu:d{v¦¤¥[pˆ v¦doXdoXU[u:tU}~}D‡UormqI[p]o]

­

º

[ˆU[IuUrsd{[|:k

fv(A)

^¸

bv(A)

^¸

fn(A)

^¸-xOu¥ˆ

bn(A)

d{XU[G]z[Ido]_rO£Œ£´{[p[xOuˆ@|5r/tUu¥ˆµ‘xOovwxO|U}~[p]†xOuˆ

£´o[I[SxOuˆ¬|5r/tUu¥ˆ u¥xsZG[<]rO£

A

¸{[<]z‡5[<q³d{v~‘s[I}~k/¸'ˆm[¤¥u¥[pˆ v~u¥ˆmtq³d{v~‘s[I}~k xs]t¥]{t¥xO}L£´r/doXU[V‡¥v&qpxO}wqtU}~t¥]

qIrsu¥]zd{ot¥q³dy]_xsu¥ˆµt¥]{v¦uU–

fv({ ^M / x }) = fv(M ) ∪ {x}

^xsu¥ˆ

fn({ ^M / x }) = fn(M )

£´r/bxsqd{v~‘s[]{tU|¥]zd{v¦d{tU¯

dov¦r/u¥]

­

†uF[«ld{[pu¥ˆm[pˆ§‡UormqI[p]o]†vw]='"4(§v®£&v®dbXxs]_u¥rV£´o[I[‘xOovwxO|U}~[p]†[I«mqI[I‡mdfdoXUr/]{[v~u§d{XU[\ˆmrsZ$xOv~u

rs£xsq³dov¦‘s[]{tU|¥]zd{v¦d{tmdov~rsu¥]

­

/

«ld{[Iuˆm[pˆF‡Uormq[<]{]{[p]f|UtUv~}®dtU‡F£´{r/Z d{X¥[GultU}¦}Œ‡¥{rmqI[p]o]¾¹t¥]{v¦uU–doXU[\–sv~‘s[IuFqIrsu¥]zd{ot¥qd{v~rsu¥]p¸5d{Xxd

vw]I¸’‡¥xOyxO}~}~[I}Œqr/ZG‡5r:]zv¦d{v~r/uD¸²o[p]zd{ov~qd{v~rsu¬xOu¥ˆ¬xsqd{v~‘s[\]{tU|¥]zd{v¦d{tmdov¦r/u¥]y¿bxs{[\qIxs}¦}~[pˆ>$(/-1"

­

W’r@[I‘s[p{k

[I«:do[Iu¥ˆm[<ˆ@‡UormqI[p]o]

A

 &[xs]o]zrmqIv~xOd{[bdoXU[£´oxsZG[

ϕ(A)

r/|mdoxsv¦u¥[pˆ@|:ko[I‡U}wxsqv~uU–Vxs}¦}’[pZ|5[pˆUˆm[<ˆµ‡U}~xsv¦u

‡Uormq[<]{]{[p]„ v¦d{X

0

­

&M(#&&M4! #&$

P0 #+

(('&*N

51PG+10G&M"%(#& '+-&H(#8./& P8./&M8(J:;56$ '+-&P-58

51P2-&P-&2

P('&*N

51P%?

†u <T !0' T #3Gvw]SxOu [I«:do[Iu¥ˆU[pˆ ‡U{rUq[p]o]\ v¦d{X x XUr/}~[µuUrOdStUu¥ˆU[Ix o[I‡U}~v~qpxdov¦r/uD¸3x

qIrsu¥ˆmv¦d{v~rsuxO}7¸mxsuv¦u¥‡Utmd†r/xsurstmdo‡Utmd

­

T'4 # '(¾

≡

¿'v~]'d{XU[]{Z\xs}¦}~[p]zd[p:tUv~‘xs}¦[pu¥q[&o[I}wxdov~rsursu[«ldo[Iu¥ˆm[<ˆ‡UormqI[p]o]z[<]Dd{Xxd vw]qI}¦r:]z[<ˆS|lk

α

¯¢qrsul‘s[Iy]zv~rsuSrs£'u¥xsZG[<]xOuˆ‘xs{vwxO|U}~[p]p¸l|:kxs‡U‡U}~v~qpxdov¦r/urO£[I‘xs}¦txd{v~rsu@qrsu:d{[«ldy]xOuˆ

]{t¥qyXGd{X¥xOdLd{XU[_]zdoxsu¥ˆUxOyˆG]zd{ot¥q³dotUoxs}motU}~[p]£´rsLd{XU[†u:t¥}¦}‡U{rUq[p]o]I¸O‡xOyxO}~}¦[p}Uqr/ZG‡5r:]zv¦d{v~rsu$xOu¥ˆGo[p]zd{ov~q¯

dov¦r/u°¾¹]{t¥qoXxs]&xs]o]zrmqIv~xOd{v~‘lv®dnkxsu¥ˆVqr/ZGZtUdoxdov¦‘lv¦dnkGrO£

|

¸lqIrsZ\ZtmdoxOd{v~‘lv®dnk\xsu¥ˆ$|Uv~u¥ˆmv~uU–O¯±rs‡5[Iyxdorsz¯±}¦v~¶s[

|5[IXx<‘lv~rs3rs£

ν

¿&d{r/–s[Id{XU[p3 v¦d{Xd{X¥[£´rs}~}¦r v¦u¥–Grsu¥[p]3XUr/}~ˆ

­

νx.{ ^M / x } ≡ 0

{ ^M / x } | A ≡ { ^M / x } | A{ ^M / x }

{ ^M / x } ≡ { ^N / x }

^v¦£

M = E N

-£

n e

{[p‡Uo[p]{[Iu/dy]µd{X¥[M¾¹‡5r/]o]zv~|U}~k [IZ\‡mdnkU¿°]{[d

{n 1 , . . . , n l }

¸ „[©xO|U|¥{[p‘:vwxdo[ª|:k

ν e n

doXU[¨]z[I¯

:tU[pu¥q[

νn 1 .νn 2 . . . νn l

^{­ /}

‘s[Iok qI}¦r:]z[<ˆ [«ldo[Iu¥ˆm[<ˆ1‡Uormq[<]{]

A

qIxsu1|5[¡|UorstU–sX:dµdor·d{XU[ª£´r/{Z

ν e n.{ ^{M 1} / x 1 }| . . . |{ ^{M k} / x k }|P

|:kt¥]{v¦uU–]zd{ot¥q³dotUyxO}m[<:tUv¦‘OxO}~[Iu¥qI[s¸O X¥[Io[

P

v~]‚xb‡¥}~xsv¦u$qI}¦r:]z[<ˆ‡Uormq[<]{]p¸

k ≥ 0

^xsu¥ˆ

{ e n} ⊆ ∪ i fn(M i )

^­ G†[pu¥q[§d{X¥[§d¢ &r©ˆm[¤¥u¥v®dov¦r/u¥]SrO££´oxsZ\[p]SxOo[µ[</t¥v¦‘OxO}~[Iu/dStU‡·d{r ]zd{ot¥q³dotUyxO}-[</t¥v¦‘OxO}~[Iu¥qI[brsu@q}~r/]{[pˆS[I«ld{[Iuˆm[pˆ‡¥{rmqI[p]o]z[<]

­

Wr\]{[I[bdoXUv~] &[xO‡U‡U}~kVotU}~[

tUu/dov¦}

xs}¦}3d{[p{Z$]\xs{[–sorst¥u¥ˆ#¾´d{XUvw]\vw]$xs]o]ztUo[pˆª|lk d{X¥[£¹xsqd\d{X¥xOd\d{XU[µqIrsu¥]{vwˆm[Io[pˆª[I«ld{[Iuˆm[pˆ©‡Uormq[<]{]{[p]

xs{[q}~r/]{[pˆµxOu¥ˆdoXU[x/q³dov¦‘s[]zt¥|¥]ndov®dotmd{v~rsu]_xs{[qIkmq}~[¯7£o[I[J¿

­

_}~]{r¥¸5xOuUrsd{XU[p_qr/u¥]{[p:tU[Iuq[vw]d{Xxdfv®£

A ≡ B

^doXU[Iu

ϕ(A) ≡ ϕ(B)

^­

W’ &r©]z[pZ\xsu/dov~qp]SqIxsu·|5[°qIrsu¥]{vwˆm[Io[pˆ©£´r/VdoXUv~]qIxO}wqtU}~t¥]p¸†ˆm[¤¥u¥[pˆ·|:k·]ndo{t¥qd{tUyxO}_[</t¥v¦‘xs}~[Iu¥q[

xsu¥ˆ°|lk T41 (/T' !©xOu¥ˆ (4: (/T' !¥¸’o[p]{‡5[pq³dov¦‘s[p}¦k

­

W3XU[p]{[\]{[IZ$xOu:d{vwqI]}¦[<xsˆ§dor

" < ! :4' ª¾´ X¥v~qyX©v~]\]ndyxOu¥ˆ¥xOyˆªxOu¥ˆ¡uUrOd\{[<qIxO}~}~[pˆ XU[p{[J¿xOuˆ (4: 4 "1 5-= 1 *

o[I}wxdov¦r/u¥]

­

W3X¥[bd¢ &r\|Uvw]zv~Z\v~}~xs{v¦d¢kVo[I}wxd{v~rsu]„qr/v¦uqvwˆm[=7:94;’xOuˆS &[t¥]{[bX¥[Io[fd{X¥[}~xOdzdo[I†]zv~u¥q[v¦d‡5[I{¯

Z\v¦do]fd{rSdyxO¶s[v¦Z\‡U}~vwqv¦d{}~kµv¦u:d{r@xsqIqIrstUu:d_doXU[r/|¥]{[Io‘s[I<¸XU[Iu¥qI[v¦dbXxs]_d{XU[\xsˆU‘xOu:doxs–s[rs£Lo[I}~klv¦uU–Sr/u

]zdoxOd{vwqb[p:tUv~‘xs}¦[pu¥q[byxdoXU[I3d{X¥xsu@:t¥xsu/d{v¦¤qpxd{v~r/ur‘s[IqIrsu:d{[«ldy]

­

1T1 (/T' !Gvw]Dd{XU[&}~xs{–/[p]zdDo[I}wxd{v~rsursu[«ld{[pu¥ˆm[pˆ‡U{rUq[p]o]{[p]Dq}~r/]{[pˆ|lk]zd{ot¥q³dotUoxs}s[p:tUv~‘:¯

xs}¦[pu¥q[xOuˆxO‡U‡U}~vwqIxdov¦r/urs£'[I‘xs}¦txd{v~rsuqIrsu/do[«ldo]†]ztqoXdoX¥xd

chxi.P | c(x).Q → P | Q

if M = M then P else Q → P

if M = N then P else Q → Q

^!

£´r/†xOulkV–sorst¥u¥ˆVd{[p{Z$]

M

^xOuˆ

N

]ztqoXdoX¥xd

M 6= _E N

`fud{XU[rsd{XU[p3XxOu¥ˆ²¸ ( .T'4 !°vw]ˆm[I¤¥uU[pˆ|lk$doXU[£´rs}~}~rJ v~uU–\{tU}~[p]

c(x).P ^c(M) −→ P { ^M / x }

chui.P −→ ^chui P

^#"$%

A −→ ^chui A ⁰ νu.A ^νu.chui −→ A ⁰

u 6= c

& '"$%

A −→ ^α A ⁰ νu.A −→ ^α νu.A ⁰

u

2-5&(OP-58 5K**"-$

P

α

(&

A −→ ^α A ⁰ A|B −→ ^α A ⁰ |B

¾)s¿

&*

A ≡ B B −→ ^α B ⁰ B ⁰ ≡ A ⁰

A −→ ^α A ⁰

 XU[p{[

u

vw]xZ\[dyx<‘OxOov~xs|U}~[doX¥xdoxsuU–s[<]brJ‘s[pu¥xOZ\[p]xOu¥ˆ¬‘xs{vwxO|U}~[p]p¸’xOu¥ˆFd{XU[Sqr/u¥ˆmv¦d{v~rsu ¾)O¿brs£

doXU[{tU}~[

&*

vw]

bv(α) ∩ fv(B ) = bn(α) ∩ fn(B) = ∅

^­

Á9; 8´š:8Å=;

xs|5[I}~[pˆ |Uvw]zv~Z\v¦}wxOov¦d¢k

≈ _l

"5# 34"1 "1*/- -41 !' !

R

^{'4" #}

4( )B' 4"("44" " T' E5#

A R B

^{- !1"}

ϕ(A) ≈ ϕ(B)

% $

A → A ⁰

^#

B → ^∗ B ⁰

A ⁰ R B ⁰

T$4&".-M

B ⁰

$

A → ^α A ⁰

fv(α) ⊆ dom(ϕ(A))

bn(α) ∩ fn(B) = ∅

^#

B → ^∗ →→ ^{α ∗} B ⁰

A ⁰ R B ⁰

T$4&"/-

B ⁰

º

[ˆm[puUrOdo[

A ⇒ B

^v¦£

A → B

^r/

A → ^α B

^­ †}w]{r\ &[t]z[bdoXU[uUrsdoxdov~rsu

ν s ϕ

^£´rs

ν ( n e ∪ { s }).σ

^¸

 XU[p{[

ϕ = ν e n.σ

^­

Á9;

8´š:8

Å=; $(.-M

ϕ

"V‘OxO}~v~ˆ :: '(4" "

P

^{$M# "}

A

^{" T' #}

P ⇒ ^∗ A

ϕ ≡ ϕ(A)

Á9; 8´š:8Å=;

P

⁽ '4:<" 0 )B' 4"("> 5T/ 1 ! 44" <"E' T "J

s

M$ (

/- %$

P

^{' TT4 .-M = "*=#}

s

"]{klu/dyxsq³dov~qpxO}~}¦k$]z[<qo[d

P

^{$ T$4 1*}

! $(.-M

ϕ

^::

P

s

" 63 .T'4 D6$(.-

ν s ϕ

^{= "* 5T}

s

"]ndo{r/uU–s}~kV]{[pqo[d $$4

T*'<"( 4 -"

M, M ⁰

" T'J5T

bn(P ) ∩ (fn(M ) ∪ fn(M ⁰ )) = ∅

P ( ^M / s ) ≈ l P ( ^{M 0} / s )

[d

M o (P )

|5[d{X¥[@]{[d\rO£M/ "SrO£

P

¸ŒdoX¥xd$v~]doXU[@]{[d\rO£_d{[p{Z$]

m

]zt¥qyX¡d{X¥xOd

chmi

^vw]

x§Z\[p]o]{xs–s[Vrstmdo‡Utmd\qIrsu¥]zd{ot¥q³d£´rsG]{rsZ\[qoXxOuUuU[p}&u¥xsZ\[

c

^v¦u

P

^{¸LxOu¥ˆ }~[d}

M t (P )

|5[VdoXU[]z[Idrs£

#4 " %$>1"1!"rO£

P

¸‚ X¥[Io[x 1"1v~]$x¬qrstU‡¥}¦[

M = N

rmqpqtUo{v~uU–°v~u xFqIrsu¥ˆUv®dov¦r/u¥xO}xOuˆ

v¦do]> #<"xOo[

M

^xsu¥ˆ

N

^{­ [d}

M(P ) = M o (P) ∪ M t (P )

|5[$doXU[]z[IdrO£-1"("1"SrO£

P

^­

/

«UxsZG‡¥}¦[<]xOo[b‡¥{r‘lv~ˆm[<ˆxdd{XU[[pu¥ˆrs£d{X¥v~]†]{[pq³dov~rsu

­

W3XU[f£´r/}¦}~r v¦uU–G}¦[pZ\Z\xGv¦u:d{tUv¦d{v~‘s[I}~k]ndyxd{[<]&d{Xxd†xOulk$Z\[p]o]{xs–s[bqr/u/doxsv¦u¥[pˆSv¦u@xsqd{v~‘s[f£´oxsZG[bvw]3xsu

r/tmd{‡Utmd_v¦u¥]zdoxsu/dov~xOd{[pˆ|:kSZ\[p]o]{xs–s[<]„ˆm[<ˆmt¥qI[pˆ£´{r/Z!‡Uo[I‘lv~rst¥]3ZG[<]{]oxO–/[p]

­

&Á

œ O4

P

^{J '"4( : B' 4" "}

A

^{J '"4( #32 3} '(1"(" " T' 5T

P ⇒ ^∗ A

^#J

k ≥ 0

^{# ( '} 4"("

B = ν e n.σ k |P _B

^T4

P B

""/-

)B' 4"(" 8

θ

M" 1"1 ! !'::

e

n

^"T'J#

A ≡ B

{ n} ⊆ e bn(P )

^T$4 41*"( !3

)$= 24"1A= /

M

^%$

P B

#= "=0-1"("

M 0 P

^{%"1 ! )$= 24"1DM /}

4"T ' * " T' 5T

M = M 0 θσ k

σ i = σ i−1 ∪ { ^{m i θ i σ i− 1} / y i }

^$4

1 ≤ i ≤ k

^#

m i

" /

P

θ i

""4"1 ! !'::

e n

σ 0

" #- *M" 1"1 !

W3XU[‡¥{rlrs£v~]fˆmr/uU[|lkv¦u¥ˆUt¥q³dov¦r/uµr/u@d{XU[ultUZ|5[Ifrs£Œ{[<ˆmt¥q³dov~rsu¥]†v~u

P ⇒ ^∗ A

^­A-u/dotUv®dov¦‘/[I}~ks¸

B

vw]_rs|mdyxOv~uU[pˆ@|lk@xO‡U‡¥}¦klv~uU–$d{XU[ otU}~[S¾´£´{r/Z }¦[I£d_dorVov~–sX/d³¿x/]†Z\r/]zdfx/]†‡5r/]o]zv~|U}~[tUu/dov¦}d{X¥[Io[

xs{[u¥rS‘xOovwxO|U}~[p]†}¦[I£dbv~uµdoXU[‡U}~xsv~u§‡U{rUq[p]o]

­ "

rOdo[doX¥xd

B

v~]ftUuUvw:tU[tU‡µdorVdoXU[G]ndo{t¥qd{tUyxO}otU}¦[<]

ˆmv#-[Io[Iu/d‚£´orsZ

¸ xOuˆ

L­sº

[f]{xJkdoX¥xd

ϕ(B)

^{v~]Ld{XU[ "12 6$(/-f  ­ ­d ­}

A

^­

_]†xG{t¥uUuUv~uU–\[«UxOZ\‡U}~[ &[qrsu¥]{vwˆm[I3d{XU[g‚xsX¥xO}~rsZ!‡UorOdormqr/}'

A ⇒ B : A, N a

B ⇒ S : B, {A, N _a , N b } _{K bs}

S ⇒ A : {B, K _ab , N a , N b } _{K as} , {A, K _ab } _{K bs} A ⇒ B : {A, K _ab } _{K bs}

-

ud{X¥v~]‡UorOdormqr/}8¸:d¢ „r\‡¥xO{d{vwqv~‡¥xsu/do]

A

^xOu¥ˆ

B

 v~]{Xd{r$[p]zdoxO|¥}¦vw]zX@x\]zXxOo[pˆS¶s[Ik

K ab

^­

W3X¥[¶s[Ik

vw]qo[pxOd{[<ˆ°|:kFxd{ot¥]zd{[pˆ ]z[Io‘s[p

S

 ^XUvwqoX ]zXxOo[p]fd{XU[V]{[pqI{[d¶s[Ikm]

K as

xsu¥ˆ

K bs

 v¦d{X

A

^xsu¥ˆ

B

o[p]{‡5[pq³dov¦‘/[I}~k

­

W3XU[‡¥{rsd{rmqIrs}-v~]Z\rmˆm[p}¦[<ˆ|:kVd{X¥[b£´r/}¦}~r v¦u¥–G‡Uormq[<]{]

P Y (k ab ) = νk as , k bs .(!P A )|(!P B )|(!νk.P S (k))|P S (k ab )

 XU[p{[

P A = νn a .cha, n a i.c(z a ).[b = u b ].[n a = u n a ].chπ 2 (z a )i

P B = c(z b ).νn b , r b .chb, enc(hπ 1 (z b ), hπ 2 (z b ), n b ii, k bs , r b )i.c(z _b ⁰ ).[a = π 1 (dec(z _b ⁰ , k bs ))]

P S (x) = c(z s ).νr s , r ⁰ _s .chenc(hπ 1 (z s ), hx, v n ii, k as , r s ), enc(hv a , xi, k bs , r ⁰ _s )i

xsu¥ˆ

u b = π 1 (dec(π 1 (z a ), k as )) u n a = π 1 (π 2 (π 2 (dec(π 1 (z a ), k as )))) v a = π 1 (dec(π 2 (z s ), k bs )) v n = π 2 (dec(π 2 (z s ), k bs ))

¼

rs3doXUvw]‡U{rsd{rmqIrs}5d{X¥[]{[d†rO£'r/tmd{‡¥tmdo]†xsu¥ˆrs‡5[poxsu¥ˆU]„rO£do[p]zdo]†xOo[bo[p]{‡5[pq³dov~‘s[I}~k

M o (P Y ) = {ha, n a i, z a , π 2 (z a ), hb, enc(hπ 1 (z b ), hπ 2 (z b ), n b ii, k bs , r b )i, z _b ⁰ , enc(hπ 1 (z s ), hx, v n ii, k as , r s ), enc(hv a , xi, k bs , r _s ⁰ )}

xsu¥ˆ

M t (P Y ) = {b, u b , n a , u n a , a, π 1 (dec(z _b ⁰ , k bs ))}.

#"! * ' . 1 *0( (

-

u X¥xOd3£´rs}~}~rJ †]p¸l „[xs]o]ztUZ\[

s

d{r\|5[bdoXU[]{[pqI{[Id

­º

[o[p]zd{ov~qd3rst¥o]{[I}¦£’d{r\‡Uormq[<]{]{[p]& v¦d{X@–sorst¥u¥ˆ

do[IoZ\]v~u#¶s[pk ‡5r/]{v®dov~rsu

­ -

uˆm[I[<ˆ²¸_v¦£¶s[Ikm]qIrsu/dyxOv~uU[pˆ ‘xs{vwxO|¥}¦[<]I¸d{XU[Ik qIrstU}wˆ#xO}w]zr©qIrsu/dyxOv~u·doXU[

]{[pqo[dxsu¥ˆ°}~[pxsˆ§dord{X¥[\]oxOZ\[G¶lv~u¥ˆ°rs£„xdzdyxsqy¶m]bx/]bv¦uFd{XU[\‡xs]o]zv~‘s[GqIx/]z[

­¼

r/b[I«UxOZ\‡U}~[s¸D}¦[Id

P 1 = νk, r, r ⁰ .(chenc( s , k, r)i | c(z).chenc(a, dec(z, k), r ⁰ )i)

^­ W3XU[3uxOZ\[

s

v¦u

P 1

v~]L]{k:u:dox/q³d{vwqIxs}¦}~k]z[<qo[d

|Utmd_uUrOd_]ndo{r/uU–s}~kV]{[pqI{[d

­ - u¥ˆm[p[pˆ²¸

P 1 ≡ νk, r, r ⁰ .(νz.({ ^{enc( s ,k,r)} / z } | chzi | c(z).chenc(a, dec(z, k), r ⁰ )i))

→ νk, r, r ⁰ .({ ^{enc( s ,k,r)} / z } | chenc(a, s , r ⁰ )i)

^{¾ otU}¦[J¿}

≡ νk, r, r ⁰ .(νz ⁰ .({ ^{enc( s ,k,r)} / z , ^{enc(a, s ,r 0 )} / z ⁰ } | chz ⁰ i))

νz ⁰ .chz ⁰ i

−→ νk, r, r ⁰ .{ ^{enc( s ,k,r)} / z , ^{enc(a, s ,r 0 )} / z ⁰ },

xsu¥ˆd{XU[o[p]{tU}¦d{v~uU–b£´yxOZ\[ˆmrl[p]ŒuUrOdL‡U{[<]z[p{‘s[&doXU[†]ndoorsuU–]{[pqo[pqIkrs£

s

¾8]z[p[„doXU[3£´yxOZ\[

ψ 2

rO£-]{[pqd{v~rsu

“ ­ Fl¿

­