All acceptable prekeys

AllFam = (Allj f j fj is a family of sets, called the family of all acceptable prekeys, and all jest decides membership in this family in time polynomial in the security parameters alone. Hence all jest is an algorithm... 

Effectiveness of authentication. For all acceptable prekeys and all key pairs based on it, all correct signatures are acceptable. ... 

The following components from Construction 9.4 are not used The families of correct prekey distributions and sets of good and all acceptable prekeys (only the generation and verification algorithms are used) the zero-knowledge proof scheme, except for the generation algorithm, because it only repeats alljtest and the security parameters as components of the prekey. 

Moreover, one can already construct one-time fail-stop signature schemes for real finite message spaces M One only needs a number N and a polynomialtime computable injection I of M into the set 0,. .., 2 0 - 1. The scheme is changed so that any k < ko is replaced by k. This does not alter the security. Then one can map M into with i for all acceptable prekeys. ... 

For the risk bearer By the definition of res, an output idspj i g f 1 can only occur if res does not receive an acceptable prekey or if acc observed = FALSE. The former cannot happen to an honest risk bearer, because all correctly... 

The condition that tests should be polynomial-time in a subset of their inputs only and the upper bounds on the size of all acceptable keys (here and in the following) have the same purpose as with prekeys and their verification The algorithms will be used by entities that may get some of their inputs from an attacker, whereas the entities must be polynomial-time in their own initial values and interface inputs. 

A zero-knowledge proof scheme could be permitted instead of local verifiability, or, as with prekeys, two families of good and all acceptable groups. 

Additiondly, as zero-knowledge proof schemes have error probabilities, but some properties of standard fail-stop signature schemes were required without an error probability, one sometimes has to consider all prekeys that a signer s entity may possibly accept. They are represented by a set All. 

Local verification algorithm all jest (for acceptable and good prekeys) ... 

Sets of prekeys Prekeys of the form described above are acceptable if the two keys from underlying schemes in them are acceptable and k is correct. They are good if, in addition, the prekey from the underlying scheme is good. Thus, for all k, [Pg.315]

---