%PDF-1.3 % 2 0 obj << /Length 7905 >> stream BT /TT2 1 Tf 14.3462 0 0 14.3462 160.14 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw [(Computationally)-242.6(Sound)-246.8(Symbolic)-250.9(Secr)16.7(ecy)-250.9(in)-250.9(the)]TJ 4.1739 -1.2505 TD [(Pr)16.7(esence)-250.9(of)-246.8(Hash)-246.8(Functions)]TJ /F1 1 Tf 9.9626 0 0 9.9626 389.1 703.4401 Tm ()Tj /TT4 1 Tf -23.2709 -3.999 TD (V)Tj 0.7769 0.006 TD ()Tj -0.0542 -0.006 TD [(eronique)-246.9(Cortier)]TJ /F2 1 Tf 6.9739 0 0 6.9739 229.98 667.26 Tm (1)Tj /TT4 1 Tf 9.9626 0 0 9.9626 234.48 663.6 Tm [(,)-246.9(Ste)24.1(v)12(e)-246.9(Kremer)]TJ /F2 1 Tf 6.9739 0 0 6.9739 294.12 667.26 Tm (2)Tj /TT4 1 Tf 9.9626 0 0 9.9626 298.62 663.6 Tm [(,)-246.9(Ralf)-246.9(K)]TJ 3.2762 0.006 TD ()Tj -0.0843 -0.006 TD (usters)Tj /F2 1 Tf 6.9739 0 0 6.9739 353.7 667.26 Tm (3)Tj /TT4 1 Tf 9.9626 0 0 9.9626 358.14 663.6 Tm [(,)-246.9(and)-246.9(Bogdan)-246.9(W)78.3(arinschi)]TJ /F2 1 Tf 6.9739 0 0 6.9739 453.66 667.26 Tm (4)Tj /F3 1 Tf 5.9776 0 0 5.9776 220.92 646.5601 Tm (1)Tj /TT4 1 Tf 8.9664 0 0 8.9664 229.56 642.72 Tm [(Loria,)-247.6(CNRS)-247.6(&)-254.3(INRIA)-240.9(project)-240.9(Cassis,)-254.3(France)]TJ /F3 1 Tf 5.9776 0 0 5.9776 195.96 635.5801 Tm (2)Tj /TT4 1 Tf 8.9664 0 0 8.9664 204.6 631.8 Tm [(LSV)127.1(,)-254.3(CNRS)-247.6(&)-247.6(ENS)-254.3(Cachan)-247.6(&)-254.3(INRIA)-240.9(project)-247.6(Secsi,)-254.3(France)]TJ /F3 1 Tf 5.9776 0 0 5.9776 257.94 624.6 Tm (3)Tj /TT4 1 Tf 8.9664 0 0 8.9664 266.52 620.8201 Tm [(ETH)-254.3(Zurich,)-247.6(Switzerland)]TJ /F3 1 Tf 5.9776 0 0 5.9776 187.74 613.6801 Tm (4)Tj /TT4 1 Tf 8.9664 0 0 8.9664 196.38 609.8401 Tm [(Loria,)-247.6(Uni)26.8(v)13.4(erit)]TJ 6.0225 0.0067 TD ()Tj -0.0535 -0.0067 TD [(e)-240.9(Henri)-247.6(Poincar)]TJ 6.3236 0.0067 TD ()Tj -0.0535 -0.0067 TD [(e)-247.6(&)-254.3(INRIA)-240.9(project)-240.9(Cassis,)-254.3(France)]TJ /TT2 1 Tf -15.9462 -4.47 TD (Abstract.)Tj /TT4 1 Tf 4.5266 0 TD [(The)-341.3(standard)-334.6(symbolic,)-334.6(deducibility-based)-321.2(notions)-321.2(of)-341.3(secrec)13.4(y)-341.3(are)-341.3(in)]TJ -4.5266 -1.2246 TD [(general)-354.7(insuf)]TJ /TT5 1 Tf 5.2703 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(cient)-354.7(from)-361.3(a)-361.4(cryptographic)-348(point)-354.7(of)-354.7(vie)26.8(w)66.9(,)-368(especially)-354.7(in)-361.4(presence)]TJ -5.8264 -1.2246 TD [(of)-321.2(hash)-334.6(functions.)-321.2(In)-327.9(this)-321.2(paper)-327.9(we)-334.6(de)26.8(vise)-334.6(and)-327.9(moti)26.8(v)26.8(ate)-327.9(a)-334.6(more)-327.9(appropriate)-321.2(se-)]TJ 0 -1.2179 TD [(crec)13.4(y)-227.5(criterion)-220.8(which)-227.5(e)13.4(xactly)-220.8(captures)-234.2(a)-227.5(standard)-227.5(cryptographic)-214.1(notion)-220.8(of)-227.5(secrec)13.4(y)]TJ 0 -1.2246 TD [(for)-327.9(protocols)-321.2(in)40.1(v)20.1(olving)-307.8(public-k)6.7(e)13.4(y)-321.2(enryption)-314.5(and)-334.6(hash)-334.6(functions:)-314.5(protocols)-321.2(that)]TJ T* [(satisfy)-261(it)-267.7(are)-274.4(computationally)-254.3(secure)-274.4(while)-267.7(an)13.4(y)-267.7(violation)-254.3(of)-267.7(our)-267.7(criterion)-261(directly)]TJ 0 -1.2179 TD [(leads)-214.1(to)-207.4(an)-214.1(attack.)-214.1(Furthermore,)-214.1(we)-214.1(pro)13.4(v)13.4(e)-207.4(that)-207.4(our)-214.1(criterion)-200.7(is)-214.1(decidable)-214.1(via)-207.4(an)-214.1(NP)]TJ 0 -1.2246 TD [(decision)-254.3(procedure.)-261(Our)-254.3(results)-254.3(hold)-254.3(for)-254.3(standard)-261(security)-254.3(notions)-247.6(for)-254.3(encryption)]TJ T* [(and)-247.6(hash)-247.6(functions)-240.9(modeled)-247.6(as)-247.6(random)-247.6(oracles.)]TJ /TT2 1 Tf 11.9552 0 0 11.9552 134.76 448.5601 Tm [(1)-998.7(Intr)20.1(oduction)]TJ /TT4 1 Tf 9.9626 0 0 9.9626 134.76 424.86 Tm [(T)78.3(w)12(o)-259(distinct)-252.9(kinds)-259(of)-259(models)-252.9(ha)18.1(v)12(e)-246.9(been)-252.9(de)24.1(v)12(eloped)-246.9(for)-259(the)-259(rigorous)-259(design)-252.9(and)-252.9(analysis)]TJ 0 -1.1985 TD [(of)-222.8(cryptographic)-216.8(protocols:)-216.8(the)-216.8(so-called)-216.8(Dole)24.1(v-Y)102.4(ao,)-216.8(symbolic,)-210.8(or)-222.8(formal)-222.8(models)-216.8(on)-216.8(the)]TJ T* [(one)-277(hand)-271(and)-271(the)-277(cryptographic,)-277(computational,)-271(or)-277(concrete)-271(models)-271(on)-277(the)-277(other)-277(hand.)]TJ T* [(In)-367.4(symbolic)-361.4(models)-355.3(messages)-355.3(are)-361.3(considered)-355.3(as)-355.3(formal)-367.4(terms)-361.4(and)-361.3(the)-361.4(adv)12(ersary)-355.3(can)]TJ 0 -1.2045 TD [(manipulate)-307.1(these)-301.1(terms)-307.1(based)-301.1(on)-301.1(a)]TJ /TT5 1 Tf 14.2648 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(x)12(e)0(d)-301.1(set)-307.1(of)-307.1(operations.)-301.1(The)-307.1(main)-307.1(adv)24.1(antage)-301.1(of)-307.1(the)]TJ -14.8209 -1.1985 TD [(symbolic)-204.8(approach)-204.8(is)-210.8(its)-204.8(relati)24.1(v)12(e)-204.8(simplicity)-204.8(which)-210.8(mak)12.1(es)-204.8(it)-204.8(amenable)-204.8(to)-210.8(automated)-204.8(anal-)]TJ T* [(ysis)-319.2(tools)-319.2(\(see,)-313.2(e.g.,)-313.2([6,)-162.6(15]\).)-325.2(In)-325.2(cryptographic)-319.2(models,)-319.2(messages)-307.1(are)-319.2(actual)-319.2(bit)-325.2(strings)]TJ T* [(and)-319.2(the)-319.2(adv)12(ersary)-313.2(is)-319.2(an)-313.2(arbitrary)-325.2(probabilistic)-319.2(polynomial-time)-325.2(\(ppt\))-325.2(T)42.2(uring)-325.2(machine.)]TJ 0 -1.2045 TD [(While)-367.4(proofs)-373.4(in)-367.4(this)-373.4(kind)-367.4(of)-373.4(models)-367.4(yield)-367.4(strong)-373.4(security)-367.4(guarantees,)-355.3(the)-373.4(proofs)-367.4(are)]TJ 0 -1.1985 TD [(often)-252.9(quite)-246.9(in)42.2(v)18.1(olv)12(ed)-252.9(and)-246.9(only)-252.9(rarely)-246.9(suitable)-246.9(for)-259(automation)-246.9(\(see,)-246.9(e.g.,)-234.9([11,)-168.6(5]\).)]TJ 1.4996 -1.1985 TD [(Starting)-373.4(with)-367.4(the)-367.4(seminal)-361.3(w)12(ork)-367.4(of)-367.4(Abadi)-367.4(and)-367.4(Rog)6(a)12(w)12(a)0(y)-361.4([1],)-361.4(a)-367.4(signi)]TJ /TT5 1 Tf 27.6207 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(cant)-367.4(amount)]TJ -29.6764 -1.2045 TD [(of)-385.4(research)-379.4(has)-379.4(been)-379.4(directed)-385.4(at)-379.4(bridging)-391.5(the)-379.4(g)6(a)0(p)-385.4(between)-379.4(the)-379.4(tw)12(o)-391.5(approaches.)-373.4(The)]TJ 0 -1.1985 TD [(goal)-289.1(is)-295.1(to)-289.1(obtain)-295.1(the)-289.1(best)-289.1(of)-295.1(both)-295.1(w)12(orlds:)-295.1(simple,)-283.1(automated)-295.1(security)-289.1(proofs)-289.1(that)-295.1(entail)]TJ T* [(strong)-313.2(security)-307.1(guarantees.)-301.1(The)-307.1(typical)-313.2(approach)-301.1(is)-313.2(to)-307.1(sho)24.1(w)-307.1(that)-307.1(the)-313.2(e)12(x)12(ecutions)-295.1(of)-313.2(the)]TJ T* [(computational)-349.3(adv)12(ersaries)-337.3(correspond)-349.3(to)-349.3(e)12(x)12(ecutions)-337.3(of)-355.3(the)-343.3(symbolic)-349.3(adv)12(ersaries,)-337.3(and)]TJ 0 -1.2045 TD [(then)-283.1(use)-283.1(this)-283.1(result)-289.1(to)-283.1(sho)24.1(w)-283.1(h)0(o)24.1(w)-283.1(to)-289.1(translate)-283.1(security)-283.1(notions)-283.1(from)-295.1(the)-283.1(symbolic)-283.1(w)12(orld)]TJ 0 -1.1985 TD [(to)-252.9(the)-246.9(computational)-252.9(w)12(orld.)]TJ 1.4996 -1.1985 TD [(F)12(o)0(r)-301.1(some)-295.1(security)-295.1(notions)-295.1(lik)12(e)-301.1(inte)12(grity)-301.1(and)-295.1(authentication,)-295.1(the)-295.1(deri)24.1(v)24.1(ation)-301.1(of)-301.1(com-)]TJ -1.4996 -1.1985 TD [(putational)-246.9(guarantees)-246.9(out)-246.9(of)-252.9(symbolic)-246.9(ones)-240.9(can)-246.9(be)-246.9(done)-246.9(with)-246.9(relati)24.1(v)12(e)-246.9(simplicity)-252.9([3,)-162.6(14].)]TJ 0 -1.2045 TD [(In)-271(contrast,)-265(analogous)-265(results)-271(for)-271(the)-271(basic)-265(notion)-271(of)-271(secrec)12(y)-259(pro)12(v)12(e)0(d)-265(signi)]TJ /TT5 1 Tf 29.3732 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(cantly)-271(more)]TJ ET 134.76 189.72 56.7 -0.42 re f BT /F4 1 Tf 5.9776 0 0 5.9776 138.18 182.8801 Tm ()Tj /TT4 1 Tf 8.9664 0 0 8.9664 144.72 179.0401 Tm [(W)80.3(ork)-247.6(partly)-240.9(supported)-240.9(by)-240.9(A)40.1(C)0(I)-247.6(Jeunes)-254.3(Chercheurs)-247.6(JC9005)-240.9(and)-247.6(ARA)-247.6(SSIA)-247.6(F)13.4(ormacrypt.)]TJ ET endstream endobj 3 0 obj << /ProcSet [/PDF /Text ] /Font << /F1 4 0 R /F2 5 0 R /F3 6 0 R /F4 7 0 R /TT2 8 0 R /TT4 9 0 R /TT5 10 0 R >> /ExtGState << /GS1 11 0 R >> >> endobj 14 0 obj << /Length 10843 >> stream BT /TT4 1 Tf 9.9626 0 0 9.9626 134.76 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw [(elusi)24.1(v)12(e)-271(and)-277(ha)18.1(v)12(e)-271(appeared)-277(only)-283.1(recently)-277([4,)-162.6(10,)-168.6(12,)-162.6(7].)-277(The)-283.1(apparent)-277(reason)-271(for)-283.1(this)-283.1(sit-)]TJ 0 -1.1985 TD [(uation)-259(is)-252.9(the)-259(striking)-259(dif)24.1(ference)-252.9(between)-252.9(the)-252.9(de)]TJ /TT5 1 Tf 18.7578 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nitional)-259(ideas)-252.9(used)-252.9(in)-259(the)-252.9(tw)12(o)-259(dif)24.1(ferent)]TJ -19.3139 -1.1985 TD [(models.)-307.1(Symbolic)-319.2(secrec)12(y)-301.1(typically)-313.2(states)-307.1(that)-313.2(the)-313.2(adv)12(ersary)-307.1(cannot)-313.2(deduce)-307.1(the)-313.2(entire)]TJ T* [(secret)-283.1(from)-295.1(the)-289.1(messages)-277(it)-289.1(g)6(athers)-289.1(in)-289.1(an)-289.1(e)12(x)12(ecution.)-277(On)-289.1(the)-283.1(other)-295.1(hand,)-283.1(computational)]TJ 0 -1.2045 TD [(secrec)12(y)-343.3(requires)-355.3(that)-355.3(not)-355.3(only)-355.3(the)-349.3(secret,)-349.3(b)18.1(u)0(t)-355.3(also)-349.3(no)-355.3(partial)-355.3(information)-361.4(is)-349.3(leak)12(ed)-355.3(to)]TJ 0 -1.1985 TD [(the)-313.2(adv)12(ersary)66.2(.)-307.1(A)-319.2(typical)-313.2(formulation)-319.2(that)-319.2(is)-313.2(used)-313.2(requires)-313.2(the)-313.2(adv)12(ersary)-307.1(to)-319.2(distinguish)]TJ T* [(between)-246.9(the)-246.9(secret)-246.9(and)-246.9(a)-246.9(completely)-252.9(unrelated)-246.9(alternati)24.1(v)12(e)0(.)]TJ 0.0241 -1.6743 TD (O)Tj 7.9701 0 0 7.9701 142.6747 627.78 Tm 0.0602 Tc [(UR)-308.7(CONTRIB)7.5(UTIONS)]TJ 9.9626 0 0 9.9626 227.5509 627.78 Tm 0 Tc [(.)-277(I)0(n)-246.9(this)-240.9(paper)-246.9(we)-240.9(in)42.2(v)12(estig)6(ate)-240.9(soundness)-234.9(results)-240.9(for)-252.9(symbolic)-240.9(se-)]TJ -9.3139 -1.2045 TD [(crec)12(y)-319.2(i)0(n)-325.2(the)-319.2(presence)-319.2(of)-325.2(hash)-319.2(functions.)-319.2(One)-319.2(of)-325.2(the)-325.2(main)-319.2(moti)24.1(v)24.1(ations)-325.2(for)-325.2(considering)]TJ 0 -1.1985 TD [(hash)-283.1(functions,)-277(which)-283.1(ha)18.1(v)12(e)-277(not)-283.1(been)-283.1(considered)-283.1(in)-283.1(the)-283.1(aforementioned)-283.1(results)]TJ 6.9739 0 0 6.9739 446.88 607.4401 Tm (5)Tj 9.9626 0 0 9.9626 450.84 603.8401 Tm [(,)-283.1(i)0(s)-283.1(that)]TJ -31.7265 -1.1985 TD [(the)12(y)-325.2(present)-325.2(a)-331.2(n)0(e)24.1(w)-325.2(challenge)-656.5(in)-325.2(linking)-337.3(symbolic)-325.2(and)-331.2(cryptographic)-325.2(secrec)12(y:)-325.2(Unlik)12(e)]TJ T* [(cipherte)12(xts,)-343.3(hashes)-343.3(ha)18.1(v)12(e)-337.3(to)-355.3(be)-343.3(publicly)-355.3(v)12(eri)]TJ /TT5 1 Tf 17.7682 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(able,)-343.3(i.e.,)-343.3(an)12(y)-343.3(third)-355.3(party)-349.3(can)-343.3(v)12(erify)-355.3(if)-349.3(a)]TJ -18.3243 -1.2045 TD [(v)24.1(alue)]TJ /F5 1 Tf 2.3944 0 TD (h)Tj /TT4 1 Tf 0.8251 0 TD [(is)-252.9(the)-252.9(hash)-246.9(v)24.1(alue)-252.9(corresponding)-252.9(to)-252.9(a)-252.9(g)0(i)24.1(v)12(en)-246.9(message)]TJ /F5 1 Tf 20.6312 0 TD (m)Tj /TT4 1 Tf 0.8793 0 TD [(.)-252.9(This)-252.9(implies)-252.9(that)-252.9(a)-252.9(sim-)]TJ -24.7299 -1.1985 TD [(ple)-277(minded)-277(e)12(xtension)-265(of)-277(pre)24.1(vious)-277(results)-271(on)-277(symbolic)-277(and)-271(computational)-277(secrec)12(y)-265(f)12(ails.)]TJ T* [(Assume,)-252.9(for)-259(e)12(xample,)-252.9(that)-259(in)-259(some)-259(protocol)-259(the)-259(hash)]TJ /F5 1 Tf 21.3514 0 TD (h)Tj /F6 1 Tf 0.8733 0 TD (=)Tj /F5 1 Tf 1.072 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (s)Tj /F6 1 Tf 0.4698 0 TD (\))Tj /TT4 1 Tf 0.6444 0 TD [(of)-259(some)-259(secret)]TJ /F5 1 Tf 6.0463 0 TD (s)Tj /TT4 1 Tf 0.7287 0 TD [(is)-252.9(sent)]TJ -32.1555 -1.1985 TD [(in)-331.2(clear)-325.2(o)12(v)12(e)0(r)-319.2(the)-331.2(netw)12(ork.)-325.2(Then,)-325.2(while)-331.2(virtually)-331.2(all)-325.2(symbolic)-325.2(models)-331.2(w)12(ould)-325.2(conclude)]TJ 0 -1.2045 TD (that)Tj /F5 1 Tf 1.8609 0 TD (s)Tj /TT4 1 Tf 0.8311 0 TD [(remains)-361.3(secret)-355.3(\(and)-361.3(this)-361.3(is)-361.3(also)-361.3(a)-361.4(nai)24.1(v)12(e)-355.3(assumption)-355.3(often)-367.4(made)-355.3(in)-367.4(practice\),)-355.3(a)]TJ -2.692 -1.1985 TD [(tri)24.1(vial)-313.2(attack)-307.1(w)12(orks)-307.1(in)-307.1(computational)-313.2(models:)-307.1(gi)24.1(v)12(e)0(n)]TJ /F5 1 Tf 21.1902 0 TD (s)Tj /TT4 1 Tf 0.4698 0 TD (,)Tj /F5 1 Tf 0.5572 0 TD (s)Tj /F7 1 Tf 6.9739 0 0 6.9739 360.84 511.8 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 366.72 508.2001 Tm (and)Tj /F5 1 Tf 1.751 0 TD (h)Tj /TT4 1 Tf 0.5782 0 TD [(,)-301.1(compare)]TJ /F5 1 Tf 4.3007 0 TD (h)Tj /TT4 1 Tf 0.8853 0 TD (with)Tj /F5 1 Tf 2.085 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (s)Tj /F6 1 Tf 0.4698 0 TD (\))Tj /TT4 1 Tf -34.3225 -1.1985 TD (and)Tj /F5 1 Tf 1.7691 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (s)Tj /F7 1 Tf 6.9739 0 0 6.9739 166.74 499.86 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 169.5 496.2601 Tm (\))Tj /TT4 1 Tf 0.3915 0 TD [(,)-319.2(and)-325.2(therefore)-325.2(reco)12(v)12(e)0(r)]TJ /F5 1 Tf 9.5645 0 TD (s)Tj /TT4 1 Tf 0.4698 0 TD [(.)-325.2(Similar)-331.2(v)12(eri)]TJ /TT5 1 Tf 5.3934 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ability)-331.2(properties)-325.2(also)-319.2(occur)-325.2(in)-331.2(other)]TJ -19.8624 -1.1985 TD [(settings,)-246.9(e.g.)-240.9(digital)-252.9(signatures)-246.9(which)-246.9(do)-246.9(not)-252.9(re)24.1(v)12(eal)-246.9(the)-246.9(message)-240.9(signed.)]TJ 1.4996 -1.3912 TD [(In)-289.1(this)-289.1(paper)-289.1(we)-289.1(propose)-289.1(a)-283.1(n)0(e)24.1(w)-289.1(symbolic)-289.1(de)]TJ /TT5 1 Tf 17.8333 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nition)-289.1(for)-295.1(nonce)-283.1(secrec)12(y)-283.1(i)0(n)-289.1(protocols)]TJ -19.8891 -1.1985 TD [(that)-252.9(use)-246.9(party)-252.9(identities,)-246.9(nonces,)-246.9(hash)-246.9(functions,)-246.9(and)-252.9(public)-246.9(k)12(e)12(y)-252.9(encryption.)-246.9(The)-252.9(de)]TJ /TT5 1 Tf 33.016 0 TD ()Tj /TT4 1 Tf 0.5561 0 TD (ni-)Tj -33.5721 -1.2045 TD [(tion)-252.9(that)-252.9(we)-246.9(gi)24.1(v)12(e)-240.9(is)-252.9(based)-240.9(on)-252.9(the)-246.9(intuiti)24.1(v)12(ely)-252.9(appealing)-246.9(concept)-246.9(of)-252.9(patterns)-246.9([1].)]TJ 1.4996 -1.3912 TD [(The)-216.8(central)-210.8(aspect)-210.8(of)-216.8(our)-210.8(criterion)-222.8(is)-210.8(that)-216.8(it)-210.8(captures)-210.8(precisely)-210.8(security)-210.8(in)-216.8(the)-216.8(compu-)]TJ -1.4996 -1.1985 TD [(tational)-234.9(w)12(orld)-240.9(in)-234.9(the)-234.9(sense)-228.9(that)-234.9(it)-234.9(is)-234.9(both)-234.9(sound)-234.9(and)-234.9(complete.)-228.9(More)-234.9(speci)]TJ /TT5 1 Tf 29.0017 0 TD ()Tj /TT4 1 Tf 0.5561 0 TD [(cally)66.2(,)-228.9(nonces)]TJ -29.5578 -1.1985 TD [(that)-313.2(are)-313.2(secret)-307.1(according)-313.2(to)-313.2(our)]TJ /TT7 1 Tf 12.984 0 TD (symbolic)Tj /TT4 1 Tf 3.8618 0 TD [(criterion)-319.2(are)-307.1(also)-313.2(secret)-307.1(according)-313.2(to)-313.2(a)-313.2(stan-)]TJ -16.8458 -1.1985 TD (dard)Tj /TT7 1 Tf 2.1141 0 TD (computational)Tj /TT4 1 Tf 6.1146 0 TD (de)Tj /TT5 1 Tf 0.9438 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nition.)-337.3(Furthermore,)-337.3(there)-331.2(e)12(xist)-331.2(successful)-325.2(attacks)-331.2(ag)6(ainst)-331.2(the)]TJ -9.7287 -1.2045 TD [(secrec)12(y)-319.2(o)0(f)-331.2(a)0(n)12(y)-325.2(nonce)-325.2(that)-331.2(does)-325.2(not)-331.2(satisfy)-325.2(our)-331.2(de)]TJ /TT5 1 Tf 20.0811 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nition.)-331.2(Our)-331.2(theorems)-325.2(hold)-331.2(for)-331.2(pro-)]TJ -20.6372 -1.1985 TD [(tocols)-301.1(implemented)-301.1(with)-307.1(encryption)-307.1(schemes)-289.1(that)-307.1(satisfy)-301.1(standard)-295.1(notions)-307.1(of)-301.1(security)66.2(,)]TJ T* [(and)-265(for)-277(hash)-265(functions)-265(modeled)-271(as)-265(random)-271(oracles.)-259(In)-271(the)-271(proofs)-271(we)-265(combine)-265(dif)24.1(ferent)]TJ T* [(techniques)-325.2(from)-331.2(cryptograph)6(y)-331.2(and)-325.2(mak)12(e)-331.2(direct)-331.2(use)-319.2(of)-331.2(a)-331.2(\(non-tri)24.1(vial\))-337.3(e)12(xtension)-319.2(of)-331.2(the)]TJ 0 -1.2045 TD [(mapping)-252.9(theorem)-246.9(of)-252.9([14])-252.9(to)-252.9(hash)-246.9(functions.)]TJ 1.4996 -1.3852 TD [(Our)-361.4(second)-355.3(important)-361.3(result)-361.4(is)-361.3(to)-361.4(pro)12(v)12(e)-349.3(the)-361.4(decidability)-361.4(of)-361.4(our)-361.4(symbolic)-361.3(secrec)12(y)]TJ -1.4996 -1.2045 TD [(criterion)-259(\(w)66.2(.r)54.2(.t.)-252.9(a)-252.9(bounded)-252.9(number)-259(of)-259(sessions\).)-246.9(This)-252.9(is)-259(a)-252.9(crucial)-252.9(result)-252.9(that)-511.9(enables)-252.9(the)]TJ 0 -1.1985 TD [(automatic)-361.4(v)12(eri)]TJ /TT5 1 Tf 5.8469 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(cation)-361.3(of)-361.3(computational)-367.4(secrec)12(y)-349.3(for)-367.4(nonces.)-349.3(W)78.3(e)-361.3(gi)24.1(v)12(e)-355.3(an)-361.3(NP-decision)]TJ -6.403 -1.1985 TD [(procedure)-289.1(based)-283.1(on)-289.1(constraint)-289.1(solving,)-283.1(a)-289.1(technique)-289.1(that)-289.1(is)-283.1(suitable)-289.1(for)-295.1(practical)-283.1(imple-)]TJ T* [(mentations)-668.5([2].)-337.3(While)-331.2(the)-337.3(constraint)-331.2(solving)-337.3(technique)-331.2(is)-337.3(standard)-331.2(in)-337.3(automatic)-331.2(pro-)]TJ 0 -1.2045 TD [(tocol)-313.2(analysis,)-295.1(we)-307.1(had)-313.2(to)-307.1(adapt)-307.1(it)-313.2(for)-313.2(our)-307.1(symbolic)-313.2(secrec)12(y)-295.1(criterion:)-319.2(F)12(o)0(r)-307.1(the)-307.1(standard)]TJ 0 -1.1985 TD [(deducibility-based)-367.4(secrec)12(y)-355.3(d)0(e)]TJ /TT5 1 Tf 12.0388 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nition)-373.4(it)-367.4(suf)]TJ /TT5 1 Tf 4.828 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ces)-367.4(to)-367.4(transform)-367.4(constraint)-367.4(systems)-361.3(until)]TJ -17.9791 -1.1985 TD [(one)-198.7(obtains)-198.7(a)-198.7(so-called)-192.7(simple)-198.7(form.)-204.8(Ho)24.1(we)24.1(v)12(e)0(r)42.2(,)-192.7(for)-198.7(our)-204.8(symbolic)-198.7(secrec)12(y)-186.7(criterion)-204.8(further)]TJ 0 -1.2045 TD [(transformations)-265(might)-265(be)-259(required)-265(in)-265(order)-265(for)-265(the)-265(procedure)-259(to)-265(be)-259(complete.)-524(Identify-)]TJ 0 -1.1985 TD [(ing)-313.2(a)-307.1(suf)]TJ /TT5 1 Tf 3.5401 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(cient)-307.1(set)-307.1(of)-307.1(such)-307.1(transformations)-313.2(and)-307.1(pro)12(ving)-307.1(that)-313.2(the)12(y)-301.1(are)-307.1(suf)]TJ /TT5 1 Tf 25.2446 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(cient)-313.2(turned)]TJ -29.897 -1.1985 TD [(out)-252.9(to)-246.9(be)-252.9(non-tri)24.1(vial.)]TJ ET 134.76 189.96 56.7 -0.42 re f BT 5.9776 0 0 5.9776 139.02 182.8801 Tm (5)Tj 8.9664 0 0 8.9664 144.72 179.0401 Tm [(One)-247.6(e)13.4(xception)-247.6(is)-247.6([12])-240.9(where)-247.6(hash)-254.3(functions)-234.2(are)-254.3(allo)26.8(wed,)-247.6(b)20.1(u)0(t)-247.6(only)-240.9(as)-247.6(randomness)-254.3(e)13.4(xtractors.)]TJ 9.9626 0 0 9.9626 305.16 149.1601 Tm (2)Tj ET endstream endobj 15 0 obj << /ProcSet [/PDF /Text ] /Font << /F5 16 0 R /F6 17 0 R /F7 18 0 R /TT4 9 0 R /TT5 10 0 R /TT7 19 0 R >> /ExtGState << /GS1 11 0 R >> >> endobj 21 0 obj << /Length 15151 >> stream BT /TT4 1 Tf 9.9626 0 0 9.9626 135 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw (R)Tj 7.9701 0 0 7.9701 142.125 716.16 Tm 0.0602 Tc [(ELA)112.9(TED)]TJ 9.9626 0 0 9.9626 178.7503 716.16 Tm 0 Tc (W)Tj 7.9701 0 0 7.9701 188.5735 716.16 Tm 0.0602 Tc (ORK)Tj 9.9626 0 0 9.9626 206.841 716.16 Tm 0 Tc [(.)-379.4(The)-355.3(papers)-349.3(that)-361.4(are)-349.3(immediately)-361.4(related)-355.3(to)-355.3(our)-355.3(w)12(ork)-361.3(are)-355.3(those)-355.3(of)]TJ -7.2351 -1.1985 TD [(Cortier)-222.8(and)-216.8(W)78.3(arinschi)-210.8([10],)-222.8(Back)12(es)-210.8(and)-216.8(P)]TJ /TT5 1 Tf 16.4 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(tzmann)-216.8([4],)-222.8(and)-216.8(Canetti)-216.8(and)-216.8(Herzog)-216.8([7],)-216.8(who)]TJ -16.9561 -1.1985 TD [(study)-313.2(computationally)-313.2(sound)-307.1(secrec)12(y)-301.1(properties,)-307.1(as)-307.1(well)-313.2(as)-307.1(the)-313.2(paper)-307.2(by)-313.2(Jan)42.2(vier)-313.2(et)-307.1(al.)]TJ T* [([13],)-265(that)-259(presents)-252.9(a)-259(soundness)-252.9(result)-259(in)-265(the)-259(presence)-252.9(of)-265(hash)-252.9(functions.)-259(In)-265(this)-259(conte)12(xt,)]TJ 0 -1.2045 TD [(our)-259(w)12(ork)-259(is)-259(the)]TJ /TT5 1 Tf 6.3007 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(rst)-259(to)-259(tackle)-252.9(computationally)-259(sound)-252.9(secrec)12(y)-246.9(i)0(n)-259(the)-259(presence)-252.9(of)-259(hashes.)]TJ -6.8568 -1.1985 TD [(W)78.3(e)-283.1(study)-289.1(the)-289.1(translation)-295.1(of)-289.1(symbolic)-289.1(secrec)12(y)-283.1(into)-289.1(a)-289.1(computational)-289.1(v)12(ersion)-289.1(in)-289.1(a)-289.1(setting)]TJ T* [(closely)-246.9(related)-252.9(to)-252.9(that)-252.9(in)-252.9([10].)-259(Ho)24.1(we)24.1(v)12(e)0(r)42.2(,)-240.9(the)-252.9(use)-246.9(of)-259(hashes)-240.9(requires,)-252.9(as)-246.9(e)12(xplained)-246.9(abo)12(v)12.1(e)0(,)]TJ T* [(ne)24.1(w)-234.9(notions)-234.9(and)-240.9(non-tri)24.1(vial)-240.9(e)12(xtensions)-228.9(of)-240.9(the)-234.9(results)-234.9(pro)12(v)12(e)0(d)-234.9(there.)-228.9(In)-240.9([13],)-240.9(Jan)42.2(vier)-234.9(et)-234.9(al.)]TJ 0 -1.2045 TD [(present)-349.3(a)-355.3(soundness)-349.3(result)-349.3(that)-355.3(dif)24.1(fers)-355.3(ho)24.1(we)24.1(v)12(e)0(r)-349.3(from)-361.4(this)-349.3(one.)-355.3(On)-349.3(the)-355.3(one)-355.3(hand)-349.3(the)12(y)]TJ 0 -1.1985 TD [(do)-385.4(not)-379.4(consider)-385.4(computational)-379.4(secrec)12(y)-373.4(o)0(f)-385.4(nonces)-379.4(sent)-379.4(under)-379.4(hash)-379.4(functions.)-379.4(On)-385.4(the)]TJ T* [(other)-331.2(hand,)-331.2(the)12(y)-325.2(present)-331.2(a)-331.2(n)0(e)24.1(w)-325.2(security)-331.2(criterion)-337.3(for)-337.3(hash)-325.2(functions,)-331.2(which)-331.2(is)-331.2(not)-331.2(the)]TJ T* [(random)-240.9(oracle,)-234.9(although)-240.9(no)-240.9(implementation)-240.9(of)-240.9(a)-234.9(hash)-240.9(function)-240.9(satisfying)-234.9(their)-240.9(criterion)]TJ 0 -1.2045 TD [(is)-198.7(currently)-204.8(kno)24.1(wn.)-198.7(The)-198.7(w)12(ork)-204.8(in)-204.8([4])-204.8(and)-198.7([7])-204.8(is)-397.5(concerned)-198.7(with)-198.7(secrec)12(y)-192.7(properties)-198.7(of)-204.8(k)12(e)12(y)0(-)]TJ 0 -1.1985 TD [(e)12(xchange)-301.1(protocols)-307.1(in)-307.1(the)-307.1(conte)12(xt)-301.1(of)-313.2(simulation-based)-301.1(security)66.2(,)-307.1(and)-307.1(hence,)-301.1(the)12(y)-301.1(study)]TJ T* [(dif)24.1(ferent)-246.9(computational)-246.9(settings.)-240.9(Interestingly)66.2(,)-240.9(the)-246.9(symbolic)-246.9(criterion)-246.9(used)-240.9(in)-246.9([7])-246.9(is)-240.9(also)]TJ T* [(formalized)-343.3(using)-343.3(patterns,)-337.3(b)18.1(u)0(t)-343.3(their)-343.3(use)-337.3(is)-343.3(unrelated)-337.3(to)-343.3(ours.)-680.5(None)-343.3(of)-343.3(the)-343.3(mentioned)]TJ 0 -1.2045 TD [(w)12(orks)-252.9(considers)-240.9(decidability)-252.9(issues.)]TJ 0.0241 -1.4815 TD (P)Tj 7.9701 0 0 7.9701 140.1807 510.1201 Tm 0.0602 Tc [(APER)-436.7(OUTLINE)]TJ 9.9626 0 0 9.9626 203.8402 510.1201 Tm 0 Tc [(.)-379.4(I)0(n)-343.3(the)-343.3(follo)24.1(wing)-349.3(section,)-337.3(we)-343.3(introduce)-343.3(the)-343.3(symbolic)-343.3(and)-343.3(computa-)]TJ -6.9339 -1.1985 TD [(tional)-301.1(models.)-289.1(Our)-295.1(symbolic)-295.1(secrec)12(y)-289.1(criterion)-301.1(is)-295.1(de)24.1(v)12(eloped)-289.1(in)-295.1(Section)-295.1(3.)-295.1(W)78.3(e)-295.1(state)-289.1(and)]TJ 0 -1.2045 TD [(pro)12(v)12(e)-283.1(the)-289.1(soundness)-283.1(and)-289.1(completeness)-283.1(of)-289.1(this)-289.1(criterion)-295.1(w)66.2(.)0(r)54.2(.t.)-283.1(computational)-289.1(secrec)12(y)-283.1(i)0(n)]TJ 0 -1.1985 TD [(Section)-283.1(4,)-277(and)-277(pro)12(v)12(e)-271(its)-277(decidability)-283.1(in)-277(Section)-283.1(5.)-277(Details)-277(about)-277(the)-277(models)-277(and)-283.1(proofs)]TJ T* [(can)-246.9(be)-246.9(found)-252.9(in)-252.9([9].)]TJ /TT2 1 Tf 11.9552 0 0 11.9552 134.76 430.92 Tm [(2)-998.7(The)-250.9(Symbolic)-250.9(and)-245.9(Concr)20.1(ete)-256(Pr)20.1(otocol)-256(and)-245.9(Intruder)-250.9(Models)]TJ 9.9626 0 0 9.9626 134.76 407.5201 Tm [(2.1)-999.7(The)-246.9(Symbolic)-259(Model)]TJ /TT4 1 Tf 0 -1.9513 TD -0.0783 Tc [(We)-271(d)-78.3(e)]TJ /TT5 1 Tf 2.446 0 TD 0 Tc ()Tj /TT4 1 Tf 0.5562 0 TD [(ne)-198.7(\(symbolic\))-204.8(messages)-186.7(and)-198.7(terms,)-198.7(ho)24.1(w)-198.7(honest)-198.7(agents)-192.7(and)-198.7(the)-198.7(\(Dole)24.1(v-Y)102.4(ao-style\))]TJ -3.0021 -1.2045 TD [(intruder)-252.9(can)-246.9(deri)24.1(v)12(e)-246.9(messages)-240.9(from)-252.9(a)-246.9(set)-246.9(of)-252.9(messages,)-234.9(and)-246.9(ho)24.1(w)-252.9(protocols)-246.9(are)-252.9(speci)]TJ /TT5 1 Tf 32.5119 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD (ed.)Tj -33.044 -1.4815 TD (M)Tj 7.9701 0 0 7.9701 144.3384 361.3201 Tm 0.0602 Tc [(ESSA)37.6(GES)-406.5(AND)]TJ 9.9626 0 0 9.9626 207.0718 361.3201 Tm 0 Tc (T)Tj 7.9701 0 0 7.9701 213.6374 361.3201 Tm 0.0602 Tc (ERMS)Tj 9.9626 0 0 9.9626 237.2611 361.3201 Tm 0.3553 Tc [(.T)433.6(o)36.1(d)355.3(e)]TJ /TT5 1 Tf 2.9009 0 TD 0 Tc ()Tj /TT4 1 Tf 0.5562 0 TD [(ne)-319.2(messages,)-307.1(we)-319.2(consider)-313.2(an)-319.2(in)]TJ /TT5 1 Tf 12.824 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-325.2(set)]TJ /F8 1 Tf 3.2548 0 TD (A)Tj /TT4 1 Tf 0.9877 0 TD [(of)-319.2(agent)]TJ -31.3682 -1.1985 TD [(identities,)-409.5(in)]TJ /TT5 1 Tf 5.1034 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-409.5(sets)]TJ /F8 1 Tf 3.8186 0 TD 0.0012 Tc (Nonce)Tj /F9 1 Tf 6.9739 0 0 6.9739 255.3 347.8801 Tm -0.0002 Tc (ag)Tj /TT4 1 Tf 9.9626 0 0 9.9626 264.24 349.3801 Tm 0 Tc (,)Tj /F8 1 Tf 0.6595 0 TD 0.0012 Tc (Nonce)Tj /F9 1 Tf 6.9739 0 0 6.9739 296.88 347.8801 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 310.08 349.3801 Tm 0 Tc (,)Tj /F8 1 Tf 0.6595 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 338.16 347.8801 Tm -0.0002 Tc (ag)Tj /TT4 1 Tf 9.9626 0 0 9.9626 347.1 349.3801 Tm 0 Tc [(,)-409.5(and)]TJ /F8 1 Tf 2.5129 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 393.72 347.8801 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 411 349.3801 Tm 0 Tc [(\(nonces)-409.5(and)-409.5(ran-)]TJ -27.7276 -1.2045 TD [(dom)-289.1(coins)-283.1(generated)-283.1(by)-289.1(the)-283.1(agents)-283.1(and)-289.1(the)-283.1(adv)12(ersary)66.2(,)-277(respecti)24.1(v)12(ely\),)-277(and)-289.1(an)-283.1(in)]TJ /TT5 1 Tf 31.2274 0 TD ()Tj /TT4 1 Tf 0.5561 0 TD [(nite)-289.1(set)]TJ /F8 1 Tf -31.7836 -1.1985 TD 0.0013 Tc [(Ga)30.2(rbage)]TJ /TT4 1 Tf 3.7159 0 TD 0 Tc [(representing)-307.1(g)6(arbage)-313.2(messages.)-295.1(All)-313.2(of)-313.2(these)-307.1(sets)-307.1(are)-307.2(assumed)-307.1(to)-313.2(be)-307.1(pairwise)]TJ -3.7159 -1.1985 TD [(disjoint.)-246.9(W)78.3(e)-246.9(set)]TJ /F8 1 Tf 6.4115 0 TD 0.0012 Tc (Nonce)Tj /F6 1 Tf 2.8908 0 TD 0 Tc (=)Tj /F8 1 Tf 1.0539 0 TD 0.0012 Tc (Nonce)Tj /F9 1 Tf 6.9739 0 0 6.9739 264.06 312.0001 Tm -0.0002 Tc (ag)Tj /F10 1 Tf 9.9626 0 0 9.9626 275.28 313.5001 Tm 0 Tc ()Tj /F8 1 Tf 0.8853 0 TD 0.0012 Tc (Nonce)Tj /F9 1 Tf 6.9739 0 0 6.9739 310.14 312.0001 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 325.86 313.5001 Tm 0 Tc (and)Tj /F8 1 Tf 1.6908 0 TD 0.0006 Tc (Rand)Tj /F6 1 Tf 2.4391 0 TD 0 Tc (=)Tj /F8 1 Tf 1.0539 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 399.06 312.0001 Tm -0.0002 Tc (ag)Tj /F10 1 Tf 9.9626 0 0 9.9626 410.22 313.5001 Tm 0 Tc ()Tj /F8 1 Tf 0.8853 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 440.58 312.0001 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 453.78 313.5001 Tm 0 Tc (.)Tj -30.522 -1.1985 TD [(The)-385.4(set)-379.4(of)-385.4(messages)]TJ /F8 1 Tf 8.7931 0 TD (M)Tj /TT4 1 Tf 1.2587 0 TD [(\(w)66.2(.r)54.2(.t.)]TJ /F8 1 Tf 2.675 0 TD (A)Tj /TT4 1 Tf 0.6685 0 TD (,)Tj /F8 1 Tf 0.6234 0 TD 0.0012 Tc (Nonce)Tj /TT4 1 Tf 2.6138 0 TD 0 Tc [(,)-379.4(and)]TJ /F8 1 Tf 2.4587 0 TD 0.0006 Tc (Rand)Tj /TT4 1 Tf 2.1561 0 TD 0.3854 Tc [(\)i)385.4(s)6(d)385.4(e)]TJ /TT5 1 Tf 2.7087 0 TD 0 Tc ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-379.4(by)-385.4(the)-379.4(follo)24.1(wing)]TJ -26.0117 -1.2045 TD (grammar:)Tj /F8 1 Tf 4.1944 0 TD (M)Tj /F6 1 Tf 1.2467 0 TD -0.0007 Tc (::=)Tj /F8 1 Tf 1.7044 0 TD 0 Tc (A)Tj /F10 1 Tf 1.0419 0 TD (|)Tj /F8 1 Tf 0.6504 0 TD 0.0012 Tc (Nonce)Tj /F10 1 Tf 2.9872 0 TD 0 Tc (|)Tj /F8 1 Tf 0.6565 0 TD 0.0012 Tc (ek)Tj /F6 1 Tf 0.9335 0 TD 0 Tc (\()Tj /F8 1 Tf 0.3915 0 TD (A)Tj /F6 1 Tf 0.6685 0 TD (\))Tj /F10 1 Tf 0.7528 0 TD (|)Tj /F8 1 Tf 0.6565 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 1.0058 0 TD 0 Tc (\()Tj /F8 1 Tf 0.3915 0 TD (A)Tj /F6 1 Tf 0.6685 0 TD (\))Tj /F10 1 Tf 0.7528 0 TD 0.3787 Tc (|)Tj /F8 1 Tf 1.0479 0 TD 0 Tc (M)Tj /F5 1 Tf 0.8733 0 TD (,)Tj /F8 1 Tf 0.4457 0 TD (M)Tj /F10 1 Tf 0.8733 0 TD 0.3713 Tc (|{)Tj /F8 1 Tf 1.9091 0 TD 0 Tc (M)Tj /F10 1 Tf 0.8733 0 TD (})Tj /F11 1 Tf 6.9739 0 0 6.9739 386.04 293.2201 Tm 0.0006 Tc (Rand)Tj 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9981 0 TD 0 Tc (\()Tj /F11 1 Tf 0.4474 0 TD (A)Tj /F2 1 Tf 0.7056 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 408.36 289.5601 Tm (|)Tj /F8 1 Tf 0.6504 0 TD (h)Tj /F6 1 Tf 0.5179 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD (M)Tj /F6 1 Tf 0.8733 0 TD (\))Tj /F10 1 Tf 0.7649 0 TD (|)Tj /F8 1 Tf 0.6504 0 TD 0.0013 Tc [(Ga)30.2(rbage)]TJ /TT4 1 Tf -31.311 -1.343 TD 0 Tc (where)Tj /F8 1 Tf 2.6898 0 TD 0.0012 Tc (ek)Tj /F6 1 Tf 0.9335 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT4 1 Tf 0.6384 0 TD (and)Tj /F8 1 Tf 1.6908 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 1.0058 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT4 1 Tf 0.6384 0 TD (with)Tj /F5 1 Tf 2.0308 0 TD (a)Tj /F10 1 Tf 0.807 0 TD ()Tj /F8 1 Tf 0.9455 0 TD (A)Tj /TT4 1 Tf 0.9154 0 TD [(denote)-246.9(the)-252.9(public)-252.9(and)-246.9(pri)24.1(v)24.1(ate)-246.9(k)12(e)12(y)-252.9(of)]TJ /F5 1 Tf 14.5641 0 TD (a)Tj /TT4 1 Tf 0.53 0 TD [(,)-240.9(respecti)24.1(v)12(ely)66.2(,)]TJ /F10 1 Tf -29.2323 -1.2045 TD ()Tj /F5 1 Tf 0.3915 0 TD 0.0013 Tc [(m,)-166.6(m)]TJ /F7 1 Tf 6.9739 0 0 6.9739 160.62 267.8401 Tm 0 Tc ()Tj /F10 1 Tf 9.9626 0 0 9.9626 163.38 264.1801 Tm ()Tj /TT4 1 Tf 0.6203 0 TD [(denotes)-234.9(pairing)-234.9(of)]TJ /F5 1 Tf 7.4249 0 TD (m)Tj /TT4 1 Tf 1.1142 0 TD (and)Tj /F5 1 Tf 1.6787 0 TD (m)Tj /F7 1 Tf 6.9739 0 0 6.9739 280.14 267.8401 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 282.9 264.1801 Tm (,)Tj /F10 1 Tf 0.4849 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (m)Tj /F10 1 Tf 0.8793 0 TD (})Tj /F9 1 Tf 6.9739 0 0 6.9739 306.48 267.8401 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /TT4 1 Tf 9.9626 0 0 9.9626 326.76 264.1801 Tm [(denotes)-228.9(the)-234.9(message)]TJ /F5 1 Tf 8.3567 0 TD (m)Tj /TT4 1 Tf 1.1142 0 TD [(encrypted)-234.9(with)]TJ /F8 1 Tf -28.7428 -1.343 TD 0.0012 Tc (ek)Tj /F6 1 Tf 0.9335 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT4 1 Tf 0.6986 0 TD [(using)-307.1(the)-313.2(random)-313.2(coins)]TJ /F5 1 Tf 9.7948 0 TD (r)Tj /TT4 1 Tf 0.4818 0 TD [(,)-307.1(and)]TJ /F5 1 Tf 2.3142 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (m)Tj /F6 1 Tf 0.8793 0 TD (\))Tj /TT4 1 Tf 0.6926 0 TD [(is)-313.2(the)-313.2(hash)-307.1(of)]TJ /F5 1 Tf 5.8014 0 TD (m)Tj /TT4 1 Tf 0.8793 0 TD 0.3072 Tc [(.W)385.5(ed)307.2(e)]TJ /TT5 1 Tf 3.1175 0 TD 0 Tc ()Tj /TT4 1 Tf 0.5562 0 TD [(ne)-313.2(the)-307.1(follo)24.1(wing)]TJ -28.0402 -1.1985 TD [(subsets)-361.4(of)]TJ /F8 1 Tf 4.4569 0 TD (M)Tj /TT4 1 Tf 0.8733 0 TD (:)Tj /F8 1 Tf 0.6512 0 TD -0.0001 Tc (EKey)Tj /TT4 1 Tf 2.2103 0 TD 0 Tc (,)Tj /F8 1 Tf 0.6234 0 TD 0.0003 Tc (DKey)Tj /TT4 1 Tf 2.3307 0 TD 0 Tc (,)Tj /F8 1 Tf 0.6234 0 TD 0.0012 Tc (Ciphertext)Tj /TT4 1 Tf 4.3242 0 TD 0 Tc (,)Tj /F8 1 Tf 0.6174 0 TD 0.002 Tc (Hash)Tj /TT4 1 Tf 2.0898 0 TD 0 Tc [(,)-367.4(and)]TJ /F8 1 Tf 2.4286 0 TD -0.0306 Tc [(Pa)-31.8(i)-32.6(r)]TJ /TT4 1 Tf 2.0597 0 TD 0 Tc [(are)-367.4(the)-373.4(sets)-361.4(of)-373.4(all)-373.4(messages)]TJ -23.289 -1.2045 TD [(starting)-295.1(with)]TJ /F8 1 Tf 5.3676 0 TD 0.0012 Tc (ek)Tj /F6 1 Tf 0.9335 0 TD 0 Tc (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.277 0 TD (\))Tj /TT4 1 Tf 0.3915 0 TD (,)Tj /F8 1 Tf 0.5391 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 1.0058 0 TD 0 Tc (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.277 0 TD (\))Tj /TT4 1 Tf 0.3915 0 TD (,)Tj /F10 1 Tf 0.5331 0 TD -0.0004 Tc ({})Tj /F7 1 Tf 6.9739 0 0 6.9739 252.12 230.5201 Tm 0 Tc ()Tj 0 -0.8776 TD ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 255 226.8601 Tm (,)Tj /F8 1 Tf 0.5451 0 TD (h)Tj /F6 1 Tf 0.5179 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.277 0 TD (\))Tj /TT4 1 Tf 0.3915 0 TD [(,)-283.1(and)]TJ /F10 1 Tf 2.272 0 TD 0.0026 Tc ()Tj /F5 1 Tf 0.6685 0 TD 0 Tc (,)Tj /F10 1 Tf 0.4457 0 TD -0.0007 Tc ()Tj /TT4 1 Tf 0.6685 0 TD 0 Tc [(,)-283.1(respecti)24.1(v)12(ely)66.2(.)-289.1(W)78.3(e)-289.1(sometimes)-289.1(refer)-295.1(to)-295.1(the)]TJ -18.2468 -1.1985 TD [(sets)-246.9(introduced)-246.9(abo)12(v)12(e)-240.9(as)-246.9(types.)]TJ 1.4996 -1.1985 TD [(W)78.3(e)-240.9(assume)-240.9(an)-246.9(in)]TJ /TT5 1 Tf 6.7037 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-252.9(set)-246.9(of)-246.9(typed)-246.9(v)24.1(ariables)]TJ /F8 1 Tf 10.491 0 TD (X)Tj /TT4 1 Tf 0.9154 0 TD [(where)-240.9(the)-252.9(types)-240.9(are)-246.9(as)-246.9(abo)12(v)12(e)-234.9(and)-246.9(for)]TJ -20.1658 -1.1985 TD [(a)-240.9(v)24.1(ariable)-246.9(of)-246.9(a)-240.9(certain)-246.9(type)-240.9(only)-246.9(messages)-234.9(of)-246.9(this)-240.9(type)-246.9(may)-246.9(be)-240.9(substituted.)-240.9(In)-246.9(particular)42.2(,)]TJ 0 -1.2045 TD [(we)-325.2(assume)-319.2(v)24.1(ariables)]TJ /F5 1 Tf 8.6588 0 TD (A)Tj /F9 1 Tf 6.9739 0 0 6.9739 228.66 177.5401 Tm (i)Tj /TT4 1 Tf 9.9626 0 0 9.9626 231.96 179.0401 Tm (,)Tj /F5 1 Tf 0.5752 0 TD (i)Tj /F10 1 Tf 0.7588 0 TD 0.4234 Tc ({)Tj /F6 1 Tf 1.59 0 TD 0 Tc (1)Tj /F5 1 Tf 0.4999 0 TD 0.1679 Tc [(,...)6(,k)]TJ /F10 1 Tf 2.7704 0 TD 0 Tc (})Tj /TT4 1 Tf 0.4999 0 TD [(,)-325.2(for)-331.2(agent)-325.2(identities)-325.2(and)-325.2(v)24.1(ariables)]TJ /F5 1 Tf 14.228 0 TD (X)Tj /F9 1 Tf 6.9739 0 0 6.9739 449.58 183.8401 Tm (j)Tj -0.1118 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 454.8 175.0801 Tm (i)Tj /TT4 1 Tf 9.9626 0 0 9.9626 458.4 179.0401 Tm (,)Tj /F5 1 Tf 0.5752 0 TD (L)Tj /F9 1 Tf 6.9739 0 0 6.9739 470.94 183.8401 Tm (j)Tj 0 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 476.94 175.0801 Tm (i)Tj /TT4 1 Tf 9.9626 0 0 9.9626 305.16 149.1601 Tm (3)Tj ET endstream endobj 22 0 obj << /ProcSet [/PDF /Text ] /Font << /F2 5 0 R /F5 16 0 R /F6 17 0 R /F7 18 0 R /F8 23 0 R /F9 24 0 R /F10 25 0 R /F11 26 0 R /F12 27 0 R /TT2 8 0 R /TT4 9 0 R /TT5 10 0 R >> /ExtGState << /GS1 11 0 R >> >> endobj 29 0 obj << /Length 21539 >> stream BT /F5 1 Tf 9.9626 0 0 9.9626 134.76 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw (j)Tj /F10 1 Tf 0.7468 0 TD ()Tj /F13 1 Tf 0.9455 0 TD (N)Tj /TT4 1 Tf 0.7227 0 TD [(,)-240.9(for)-252.9(fresh)-240.9(nonces)-240.9(and)-246.9(random)-246.9(coins)-240.9(generated)-240.9(by)]TJ /F5 1 Tf 19.8857 0 TD (A)Tj /F9 1 Tf 6.9739 0 0 6.9739 364.56 714.66 Tm (i)Tj /TT4 1 Tf 9.9626 0 0 9.9626 367.86 716.16 Tm [(.)-240.9(The)-246.9(set)-240.9(of)-246.9(terms)]TJ /F8 1 Tf 7.1928 0 TD (T)Tj /F6 1 Tf 0.6806 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD (X)Tj /F6 1 Tf 0.6685 0 TD (\))Tj /TT4 1 Tf 0.6324 0 TD -0.0121 Tc [(ove)-12.1(r)]TJ /F8 1 Tf -32.9631 -1.1985 TD 0 Tc (X)Tj /TT4 1 Tf 0.9154 0 TD [(is)-252.9(de)]TJ /TT5 1 Tf 1.8638 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-246.9(analogously)-246.9(to)-252.9(the)-246.9(set)-246.9(of)-252.9(messages.)]TJ -3.3113 -1.4815 TD (D)Tj 7.9701 0 0 7.9701 142.6747 689.4601 Tm 0.0602 Tc (ERIVING)Tj 9.9626 0 0 9.9626 181.0146 689.4601 Tm 0 Tc (M)Tj 7.9701 0 0 7.9701 190.353 689.4601 Tm 0.0602 Tc [(ESSA)37.6(GES)]TJ 9.9626 0 0 9.9626 227.9592 689.4601 Tm 0 Tc [(.)-234.9(terms.)-204.8(The)-210.8(set)-210.8(of)-210.8(terms)-210.8(that)-210.8(can)-204.8(be)-210.8(deri)24.1(v)12(e)0(d)-204.8(from)]TJ /F5 1 Tf 19.5099 0 TD ()Tj /TT4 1 Tf 0.801 0 TD [(is)-210.8(de)]TJ /TT5 1 Tf 1.8216 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-210.8(by)]TJ -32.0436 -1.2045 TD [(the)-265(deduction)-265(rules)-265(gi)24.1(v)12(e)0(n)-265(i)0(n)-265(Figure)-271(1.)-265(W)78.3(e)-259(write)]TJ /F5 1 Tf 19.1881 0 TD ()Tj /F10 1 Tf 0.9034 0 TD ()Tj /F5 1 Tf 0.9154 0 TD (t)Tj /TT4 1 Tf 0.6263 0 TD [(to)-271(say)-259(that)]TJ /F5 1 Tf 4.4114 0 TD (t)Tj /TT4 1 Tf 0.6263 0 TD [(can)-265(be)-265(deri)24.1(v)12(e)0(d)-259(from)]TJ /F5 1 Tf -26.671 -1.1985 TD ()Tj /TT4 1 Tf 0.5962 0 TD [(.)-246.9(F)12(or)-252.9(e)12(xample,)]TJ /F10 1 Tf 5.993 0 TD -0.0001 Tc ({)Tj /F8 1 Tf 0.8913 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 0.9997 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD (\))Tj /F5 1 Tf 0.3915 0 TD (,)Tj /F10 1 Tf 0.4457 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (c)Tj /F10 1 Tf 0.4336 0 TD (})Tj /F9 1 Tf 6.9739 0 0 6.9739 251.1 669.12 Tm (r)Tj /F11 1 Tf 0 -0.9722 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9809 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 268.98 665.52 Tm 0.0026 Tc [(})-220.1()]TJ /F8 1 Tf 1.9995 0 TD 0 Tc (A)Tj /F10 1 Tf 0.9455 0 TD 0.2802 Tc ({)Tj /F5 1 Tf 1.3912 0 TD 0 Tc (c)Tj /F10 1 Tf 0.4336 0 TD (})Tj /F9 1 Tf 6.9739 0 0 6.9739 321.48 669.12 Tm (r)Tj /F14 1 Tf 4.9813 0 0 4.9813 325.44 672.12 Tm ()Tj /F11 1 Tf 6.9739 0 0 6.9739 321.48 662.34 Tm 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (b)Tj /F2 1 Tf 0.4991 0 TD (\))Tj /TT4 1 Tf 9.9626 0 0 9.9626 341.1 665.52 Tm (where)Tj /F5 1 Tf 2.6898 0 TD (b)Tj /F10 1 Tf 0.7046 0 TD ()Tj /F8 1 Tf 0.9455 0 TD (A)Tj /TT4 1 Tf 0.9154 0 TD (and)Tj /F5 1 Tf 1.6968 0 TD (r)Tj /F7 1 Tf 6.9739 0 0 6.9739 415.2 669.12 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 420.72 665.52 Tm ()Tj /F8 1 Tf 0.9455 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 451.62 664.02 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 464.82 665.52 Tm 0 Tc (.)Tj ET 138.72 611.4 24.36 -0.42 re f BT /F15 1 Tf 8.9664 0 0 8.9664 138.72 602.8201 Tm ()Tj /F16 1 Tf 0.9034 0 TD ()Tj /F15 1 Tf 0.9101 0 TD (m)Tj 1.2915 0.6758 TD (m)Tj /F16 1 Tf 1.1911 0 TD ()Tj /F15 1 Tf 0.9703 0 TD ()Tj 2.5227 0.6491 TD ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F15 1 Tf 0.9168 0 TD (b)Tj ET 200.7 611.4 36 -0.42 re f BT 8.9664 0 0 8.9664 200.7 602.8201 Tm ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F17 1 Tf 0.9101 0 TD -0.0017 Tc (ek)Tj /F18 1 Tf 0.9569 0 TD 0 Tc (\()Tj /F15 1 Tf 0.4015 0 TD (b)Tj /F18 1 Tf 0.4417 0 TD (\))Tj /F15 1 Tf 1.5323 0.6758 TD (b)Tj /F16 1 Tf 0.7294 0 TD ()Tj /F17 1 Tf 0.9703 0 TD (A)Tj /F16 1 Tf 0.9101 0 TD ()Tj /F17 1 Tf 0.9168 0 TD (X)Tj /F15 1 Tf 0.6893 0 TD 0.0023 Tc (.a)Tj 1.8602 0.6491 TD 0 Tc ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F15 1 Tf 0.9168 0 TD (m)Tj /F3 1 Tf 5.9776 0 0 5.9776 325.62 613.6801 Tm (1)Tj /F15 1 Tf 8.9664 0 0 8.9664 338.76 614.7001 Tm ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F15 1 Tf 0.9101 0 TD (m)Tj /F3 1 Tf 5.9776 0 0 5.9776 363.06 613.6801 Tm (2)Tj ET 301.26 611.4 66 -0.42 re f BT /F15 1 Tf 8.9664 0 0 8.9664 308.22 602.8201 Tm ()Tj /F16 1 Tf 0.8967 0 TD 0.2887 Tc ()Tj /F15 1 Tf 1.3183 0 TD 0 Tc (m)Tj /F3 1 Tf 5.9776 0 0 5.9776 336.18 601.8 Tm (1)Tj /F15 1 Tf 8.9664 0 0 8.9664 340.32 602.8201 Tm 0.1696 Tc (,m)Tj /F3 1 Tf 5.9776 0 0 5.9776 352.5 601.8 Tm 0 Tc (2)Tj /F16 1 Tf 8.9664 0 0 8.9664 356.7 602.8201 Tm ()Tj /F15 1 Tf 2.3421 1.3249 TD ()Tj /F16 1 Tf 0.8967 0 TD 0.2887 Tc ()Tj /F15 1 Tf 1.3183 0 TD 0 Tc (m)Tj /F3 1 Tf 5.9776 0 0 5.9776 405.66 613.6801 Tm (1)Tj /F15 1 Tf 8.9664 0 0 8.9664 409.8 614.7001 Tm 0.1696 Tc (,m)Tj /F3 1 Tf 5.9776 0 0 5.9776 421.98 613.6801 Tm 0 Tc (2)Tj /F16 1 Tf 8.9664 0 0 8.9664 426.18 614.7001 Tm ()Tj ET 377.7 611.4 52.08 -0.42 re f BT /F15 1 Tf 8.9664 0 0 8.9664 389.94 602.8201 Tm ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F15 1 Tf 0.9168 0 TD (m)Tj /F4 1 Tf 5.9776 0 0 5.9776 414.3 601.8 Tm (i)Tj /F15 1 Tf 8.9664 0 0 8.9664 439.92 608.8801 Tm (i)Tj /F16 1 Tf 0.6357 0 TD 0.2851 Tc ({)Tj /F18 1 Tf 1.4856 0 TD 0 Tc (1)Tj /F15 1 Tf 0.5153 0 TD (,)Tj /F18 1 Tf 0.455 0 TD (2)Tj /F16 1 Tf 0.5153 0 TD (})Tj /F15 1 Tf -33.2643 -2.3956 TD ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F17 1 Tf 0.9168 0 TD -0.0017 Tc (ek)Tj /F18 1 Tf 0.9569 0 TD 0 Tc (\()Tj /F15 1 Tf 0.4015 0 TD (b)Tj /F18 1 Tf 0.4417 0 TD (\))Tj /F15 1 Tf 0.4015 0 TD 0.1696 Tc (,)Tj /F16 1 Tf 1.3517 0 TD 0 Tc ()Tj /F15 1 Tf 0.9101 0 TD (m)Tj ET 174 584.1 64.44 -0.42 re f BT 8.9664 0 0 8.9664 181.68 575.52 Tm ()Tj /F16 1 Tf 0.8967 0 TD 0.2887 Tc ({)Tj /F15 1 Tf 1.432 0 TD 0 Tc (m)Tj /F16 1 Tf 0.9034 0 TD (})Tj /F4 1 Tf 5.9776 0 0 5.9776 215.28 578.64 Tm (r)Tj /F11 1 Tf 0 -1.0038 TD -0.0004 Tc (ek)Tj /F3 1 Tf 0.9938 0 TD 0 Tc (\()Tj /F4 1 Tf 0.4819 0 TD (b)Tj /F3 1 Tf 0.5521 0 TD (\))Tj /F15 1 Tf 8.9664 0 0 8.9664 241.86 581.64 Tm (r)Tj /F16 1 Tf 0.7762 0 TD ()Tj /F17 1 Tf 0.9703 0 TD 0.0024 Tc [(Ran)4.6(d)]TJ /F4 1 Tf 5.9776 0 0 5.9776 277.44 580.5601 Tm -0.0012 Tc (adv)Tj /F15 1 Tf 8.9664 0 0 8.9664 299.04 588.8401 Tm 0 Tc ()Tj /F16 1 Tf 0.8967 0 TD 0.2887 Tc ({)Tj /F15 1 Tf 1.4321 0 TD 0 Tc (m)Tj /F16 1 Tf 0.9034 0 TD (})Tj /F4 1 Tf 5.9776 0 0 5.9776 332.64 592.6801 Tm (r)Tj /F11 1 Tf 0 -1.0038 TD -0.0004 Tc (ek)Tj /F3 1 Tf 0.9838 0 TD 0 Tc (\()Tj /F4 1 Tf 0.4819 0 TD (b)Tj /F3 1 Tf 0.5521 0 TD (\))Tj /F15 1 Tf 8.9664 0 0 8.9664 357 588.8401 Tm ()Tj /F16 1 Tf 0.9034 0 TD ()Tj /F17 1 Tf 0.9101 0 TD -0.0022 Tc (dk)Tj /F18 1 Tf 1.0305 0 TD 0 Tc (\()Tj /F15 1 Tf 0.4015 0 TD (b)Tj /F18 1 Tf 0.4417 0 TD (\))Tj ET 299.04 584.1 94.62 -0.42 re f BT /F15 1 Tf 8.9664 0 0 8.9664 334.14 575.52 Tm ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F15 1 Tf 0.9168 0 TD (m)Tj 6.6515 1.3249 TD ()Tj /F16 1 Tf 0.9034 0 TD ()Tj /F15 1 Tf 0.9101 0 TD (m)Tj ET 404.1 584.1 36.3 -0.42 re f BT 8.9664 0 0 8.9664 404.1 575.52 Tm ()Tj /F16 1 Tf 0.8967 0 TD ()Tj /F17 1 Tf 0.9168 0 TD (h)Tj /F18 1 Tf 0.5287 0 TD (\()Tj /F15 1 Tf 0.4015 0 TD (m)Tj /F18 1 Tf 0.9034 0 TD (\))Tj /TT2 1 Tf -18.9776 -3.8812 TD [(Fig)13.4(.)-167.3(1)0(.)]TJ /TT4 1 Tf 2.7902 0 TD [(Deduction)-240.9(rules)]TJ 9.9626 0 0 9.9626 135 506.9401 Tm (P)Tj 7.9701 0 0 7.9701 141.0207 506.9401 Tm 0.0602 Tc [(R)37.6(O)37.6(T)15(OCOLS)]TJ 9.9626 0 0 9.9626 186.2095 506.9401 Tm 0 Tc [(.)-228.9(Roles)-204.8(are)-204.8(usually)-198.7(speci)]TJ /TT5 1 Tf 9.529 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ed)-204.8(by)-204.8(a)-204.8(sequence)-192.7(of)-210.8(input/output)-210.8(actions.)-198.7(In)-210.8(order)]TJ -15.2494 -1.1985 TD [(to)-204.8(model)-198.7(branching)-198.7(protocols,)-198.7(the)]TJ /TT7 1 Tf 13.469 0 TD [(r)42.2(oles)]TJ /TT4 1 Tf 2.1506 0 TD [(we)-198.7(consider)-198.7(are)-198.7(ordered)-198.7(edge-labeled)]TJ /TT5 1 Tf 14.9297 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-198.7(trees)]TJ -31.1054 -1.2045 TD [(where)-198.7(e)24.1(v)12(ery)-198.7(edge)-192.7(is)-198.7(labeled)-198.7(by)-204.8(an)]TJ /TT7 1 Tf 13.4044 0 TD [(a)12(g)12(ent)-204.8(rule)]TJ /F6 1 Tf 4.2119 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD 0.0208 Tc [(l,)-147.1(r)]TJ /F6 1 Tf 1.2467 0 TD 0 Tc (\))Tj /TT4 1 Tf 0.3915 0 TD [(,)-186.7(where)]TJ /F5 1 Tf 3.0783 0 TD 0.0208 Tc [(l,)-147.1(r)]TJ /F10 1 Tf 1.5177 0 TD 0 Tc ()Tj /F8 1 Tf 0.9455 0 TD (T)Tj /F6 1 Tf 0.6805 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD (X)Tj /F6 1 Tf 0.6685 0 TD (\))Tj /TT4 1 Tf 0.5842 0 TD [(are)-198.7(messages)-192.7(with)]TJ -27.5122 -1.1985 TD [(v)24.1(ariables,)-204.8(and)-210.8(certain)-210.8(syntactic)-210.8(conditions)-210.8(are)-210.8(satis)]TJ /TT5 1 Tf 19.9773 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ed)-210.8(such)-204.8(that)-216.8(the)-210.8(actions)-204.8(can)-210.8(actually)]TJ -20.5334 -1.1985 TD [(be)-397.5(carried)-397.5(out)-403.5(\(in)-403.5(a)-397.5(computational)-397.5(interpretation\).)-403.5(A)]TJ /F5 1 Tf 22.1623 0 TD (k)Tj /TT7 1 Tf 0.548 0 TD [(-party)-403.5(pr)42.2(otocol)]TJ /TT4 1 Tf 6.5914 0 TD [(is)-397.5(a)-397.5(mapping)]TJ /F5 1 Tf -29.3017 -1.1985 TD ()Tj /F6 1 Tf 1.1925 0 TD 0.2763 Tc (:[)Tj /F5 1 Tf 0.8311 0 TD 0 Tc (k)Tj /F6 1 Tf 0.5481 0 TD (])Tj /F10 1 Tf 0.5601 0 TD ()Tj /F8 1 Tf 1.2768 0 TD 0.0004 Tc (Roles)Tj /TT4 1 Tf 2.4632 0 TD 0 Tc (where)Tj /F6 1 Tf 2.6898 0 TD ([)Tj /F5 1 Tf 0.277 0 TD (k)Tj /F6 1 Tf 0.5481 0 TD 0.2823 Tc (]=)Tj /F10 1 Tf 1.6201 0 TD 0 Tc ({)Tj /F6 1 Tf 0.4999 0 TD (1)Tj /F5 1 Tf 0.4999 0 TD 0.1679 Tc [(,...)6(,k)]TJ /F10 1 Tf 2.7704 0 TD 0 Tc (})Tj /TT4 1 Tf 0.7528 0 TD (and)Tj /F8 1 Tf 1.6908 0 TD 0.0004 Tc (Roles)Tj /TT4 1 Tf 2.4632 0 TD 0 Tc [(denotes)-246.9(the)-246.9(set)-246.9(of)-252.9(roles.)]TJ -20.6595 -1.4876 TD (S)Tj 7.9701 0 0 7.9701 141.0207 432.36 Tm 0.0602 Tc (YMBOLIC)Tj 9.9626 0 0 9.9626 183.4735 432.36 Tm 0 Tc (E)Tj 7.9701 0 0 7.9701 190.0391 432.36 Tm 0.0602 Tc [(XECUTION)-301.1(OF)-286.1(A)]TJ 9.9626 0 0 9.9626 258.8932 432.36 Tm 0 Tc (P)Tj 7.9701 0 0 7.9701 264.9139 432.36 Tm 0.0602 Tc [(R)37.6(O)37.6(T)15(OCOL)]TJ 9.9626 0 0 9.9626 305.19 432.36 Tm 0 Tc [(.)-252.9(The)-228.9(symbolic)-222.8(e)12(x)12(ecution)-216.8(of)-228.9(a)]TJ /F5 1 Tf 11.9843 0 TD (k)Tj /TT4 1 Tf 0.548 0 TD [(-party)-234.9(proto-)]TJ -29.6393 -1.1985 TD [(col)-246.9(is)-246.9(modeled)-246.9(as)-246.9(a)]TJ /TT5 1 Tf 7.8435 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-252.9(sequence)-234.9(of)-252.9(global)-246.9(states.)-240.9(A)]TJ /TT7 1 Tf 13.1659 0 TD [(global)-252.9(state)]TJ /TT4 1 Tf 4.9442 0 TD [(is)-246.9(a)-246.9(triple)]TJ /F6 1 Tf 3.962 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.4(,)]TJ /F6 1 Tf 2.0898 0 TD 0 Tc (\))Tj /TT4 1 Tf -34.3021 -1.1985 TD (where)Tj /F5 1 Tf 2.6597 0 TD ()Tj /TT4 1 Tf 0.8672 0 TD [(is)-216.8(a)]TJ /TT5 1 Tf 1.5384 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-222.8(set)-210.8(of)-216.8(messages)-204.8(\(the)]TJ /TT7 1 Tf 9.8529 0 TD [(curr)36.1(ent)-204.8(intruder)-210.8(knowledg)12(e)]TJ /TT4 1 Tf 10.8654 0 TD (\),)Tj /F8 1 Tf 0.7998 0 TD -0.0011 Tc (SId)Tj /TT4 1 Tf 1.5659 0 TD 0 Tc [(is)-210.8(a)]TJ /TT5 1 Tf 1.5384 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-216.8(set)-216.8(of)]TJ -30.8001 -1.2045 TD [(session)-234.9(ids,)-234.9(and)]TJ /F5 1 Tf 6.4546 0 TD (f)Tj /TT4 1 Tf 0.8371 0 TD [(maps)-240.9(e)24.1(v)12(ery)-234.9(session)-228.9(id)-240.9(in)]TJ /F8 1 Tf 9.9267 0 TD -0.0011 Tc (SId)Tj /TT4 1 Tf 1.59 0 TD 0 Tc [(to)-240.9(the)-240.9(current)-240.9(state)-234.9(of)-240.9(the)-240.9(corresponding)]TJ -18.8084 -1.1985 TD [(session.)-277(This)-289.1(state)-289.1(is)-289.1(called)-283.1(the)]TJ /TT7 1 Tf 12.7418 0 TD [(local)-289.1(state)]TJ /TT4 1 Tf 4.4663 0 TD [(and)-283.1(is)-289.1(of)-289.1(the)-289.1(form)]TJ /F6 1 Tf 7.5548 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD 0.0008 Tc [(i,)-167.1()18.2(,)-167.1(p,)]TJ /F6 1 Tf 2.7403 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F2 1 Tf 6.9739 0 0 6.9739 422.04 383.0401 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 426.36 384.5401 Tm 0.1679 Tc (,a)Tj /F2 1 Tf 6.9739 0 0 6.9739 436.08 383.0401 Tm 0 Tc (2)Tj /F5 1 Tf 9.9626 0 0 9.9626 440.52 384.5401 Tm 0.1679 Tc [(,...)6(,a)]TJ /F9 1 Tf 6.9739 0 0 6.9739 467.94 383.0401 Tm 0 Tc (k)Tj /F6 1 Tf 9.9626 0 0 9.9626 472.86 384.5401 Tm 0.0026 Tc (\)\))Tj /TT4 1 Tf -33.9368 -1.1985 TD 0 Tc (where)Tj /F5 1 Tf 2.7621 0 TD (i)Tj /F10 1 Tf 0.7468 0 TD ()Tj /F6 1 Tf 1.072 0 TD ([)Tj /F5 1 Tf 0.277 0 TD (k)Tj /F6 1 Tf 0.5481 0 TD (])Tj /TT4 1 Tf 0.6023 0 TD [(is)-319.2(the)-313.2(inde)12(x)-319.2(o)0(f)-319.2(the)-319.2(role)-319.2(that)-319.2(is)-319.2(e)12(x)12(ecuted)-307.1(in)-319.2(this)-319.2(session,)]TJ /F5 1 Tf 22.5653 0 TD ()Tj /TT4 1 Tf 0.9275 0 TD [(is)-313.2(a)-319.2(substitu-)]TJ -29.501 -1.1985 TD [(tion)-355.3(whose)-343.3(domain)-349.3(is)-349.3(a)-349.3(subset)-343.3(of)-355.3(the)-349.3(v)24.1(ariables)-343.3(occurring)-355.3(in)]TJ /F5 1 Tf 24.8129 0 TD ()Tj /F6 1 Tf 0.9094 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (i)Tj /F6 1 Tf 0.3433 0 TD (\))Tj /TT4 1 Tf 0.7408 0 TD (\(i.e.,)Tj /F5 1 Tf 2.148 0 TD ()Tj /TT4 1 Tf 0.9576 0 TD (determines)Tj -30.3034 -1.2045 TD [(the)-325.2(messages)-313.2(assigned)-313.2(to)-325.2(v)24.1(ariables)-325.2(so)-319.2(f)12(a)0(r)-331.2(i)0(n)-325.2(the)-319.2(current)-325.2(session\),)]TJ /F5 1 Tf 26.6369 0 TD (p)Tj /TT4 1 Tf 0.8251 0 TD [(is)-325.2(a)-319.2(node)-325.2(of)]TJ /F5 1 Tf 5.1825 0 TD ()Tj /F6 1 Tf 0.9094 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (i)Tj /F6 1 Tf 0.3433 0 TD (\))Tj /TT4 1 Tf -34.2887 -1.1985 TD [(and)-307.1(determines)-307.1(at)-307.1(what)-307.1(node)-307.1(the)-307.1(agent)-307.1(currently)-313.2(stands,)-301.1(and)]TJ /F6 1 Tf 24.7023 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F2 1 Tf 6.9739 0 0 6.9739 390.24 335.2201 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 394.62 336.7201 Tm 0.1679 Tc (,a)Tj /F2 1 Tf 6.9739 0 0 6.9739 404.34 335.2201 Tm 0 Tc (2)Tj /F5 1 Tf 9.9626 0 0 9.9626 408.78 336.7201 Tm 0.1679 Tc (,...,a)Tj /F9 1 Tf 6.9739 0 0 6.9739 436.26 335.2201 Tm 0 Tc (k)Tj /F6 1 Tf 9.9626 0 0 9.9626 441.12 336.7201 Tm (\))Tj /F10 1 Tf 0.7769 0 TD ()Tj /F8 1 Tf 1.0479 0 TD (A)Tj /F9 1 Tf 6.9739 0 0 6.9739 465.96 340.3201 Tm (k)Tj /TT4 1 Tf 9.9626 0 0 9.9626 473.94 336.7201 Tm (is)Tj -34.0452 -1.1985 TD [(the)-283.1(tuple)-289.1(of)-283.1(names)-283.1(of)-289.1(the)-283.1(agents)-283.1(that)-283.1(are)-283.1(in)42.2(v)18.1(olv)12(ed)-283.1(in)-289.1(the)-283.1(session,)-271(where)]TJ /F5 1 Tf 28.9161 0 TD (a)Tj /F9 1 Tf 6.9739 0 0 6.9739 428.34 323.2801 Tm (i)Tj /TT4 1 Tf 9.9626 0 0 9.9626 434.52 324.7801 Tm [(is)-283.1(the)-283.1(agent)]TJ -30.0884 -1.1985 TD [(carrying)-259(out)-252.9(the)-252.9(current)-252.9(session)-246.9(\(supposedly)-252.9(with)-252.9(the)-259(mentioned)-252.9(agents)]TJ /F5 1 Tf 28.6896 0 TD (a)Tj /F9 1 Tf 6.9739 0 0 6.9739 426 311.3401 Tm (j)Tj /TT4 1 Tf 9.9626 0 0 9.9626 430.2 312.8401 Tm (,)Tj /F5 1 Tf 0.503 0 TD (j)Tj /F10 1 Tf 0.7528 0 TD ()Tj /F6 1 Tf T* (=)Tj /F5 1 Tf 1.06 0 TD (i)Tj /TT4 1 Tf 0.3433 0 TD [(\).)-259(The)]TJ -32.3138 -1.2045 TD [(initial)-240.9(state)-234.9(is)]TJ /F5 1 Tf 5.5492 0 TD (q)Tj /F9 1 Tf 6.9739 0 0 6.9739 194.52 299.3401 Tm (I)Tj /F6 1 Tf 9.9626 0 0 9.9626 201.84 300.8401 Tm 0.2822 Tc (=\()Tj /F10 1 Tf 1.4514 0 TD 0 Tc ()Tj /F5 1 Tf 0.4999 0 TD (,)Tj /F10 1 Tf 0.4457 0 TD ()Tj /F5 1 Tf 0.4999 0 TD (,)Tj /F8 1 Tf 0.4457 0 TD (A)Tj /F10 1 Tf 0.8432 0 TD ()Tj /F8 1 Tf 0.8492 0 TD -0.0001 Tc (EKey)Tj /F10 1 Tf 2.397 0 TD 0 Tc ()Tj /F8 1 Tf 0.8492 0 TD 0.0012 Tc (Nonce)Tj /F9 1 Tf 6.9739 0 0 6.9739 310.38 299.3401 Tm -0.0006 Tc (adv)Tj /F6 1 Tf 9.9626 0 0 9.9626 323.58 300.8401 Tm 0 Tc (\))Tj /TT4 1 Tf 0.3915 0 TD [(,)-234.9(i.e.,)-228.9(the)-240.9(intruder)-240.9(kno)24.1(ws)-234.9(all)-240.9(names)-234.9(and)]TJ -19.3443 -1.1985 TD [(public)-252.9(k)12(e)12(y)0(s)-240.9(o)0(f)-252.9(agents)-246.9(as)-246.9(well)-246.9(as)-246.9(the)-246.9(in)]TJ /TT5 1 Tf 15.0647 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-259(set)-246.9(of)-246.9(intruder)-259(nonces.)]TJ -14.1213 -1.1985 TD [(W)78.3(e)-246.9(allo)24.1(w)-246.9(three)-252.9(kinds)-246.9(of)-252.9(transitions)-246.9(between)-246.9(global)-252.9(states.)]TJ /TT2 1 Tf -0.801 -1.867 TD ()Tj /TT4 1 Tf 0.9999 0 TD [(The)-331.2(adv)12(ersary)-325.2(corrupts)-331.2(a)-325.2(set)-325.2(of)-331.2(parties)-331.2(and)-325.2(thereby)-331.2(learns)-325.2(the)-331.2(pri)24.1(v)24.1(ate)-325.2(k)12(e)12(y)0(s)-325.2(o)0(f)-331.2(the)]TJ -0.0001 -1.5899 TD (agents:)Tj /F5 1 Tf 3.1276 0 TD (q)Tj /F9 1 Tf 6.9739 0 0 6.9739 187.32 241.0201 Tm (I)Tj /F19 1 Tf 1.5486 1.1443 TD -0.0023 Tc (corrupt)Tj /F2 1 Tf 4.2333 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F20 1 Tf 4.9813 0 0 4.9813 235.08 247.9801 Tm (1)Tj /F9 1 Tf 6.9739 0 0 6.9739 238.92 249.0001 Tm -0.0037 Tc [(,...)-17.2(,a)]TJ /F12 1 Tf 4.9813 0 0 4.9813 255.06 247.9201 Tm 0 Tc (l)Tj /F2 1 Tf 6.9739 0 0 6.9739 258 249.0001 Tm (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 195.6 242.5201 Tm ()Tj 0.4818 0 TD -0.2237 Tc [()-6()-6()-6()]TJ 5.4806 0 TD 0 Tc ()Tj /F6 1 Tf 1.3671 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.4999 0 TD (,)Tj /F10 1 Tf 0.4457 0 TD ()Tj /F5 1 Tf 0.4999 0 TD (,)Tj /F8 1 Tf 0.4457 0 TD (A)Tj /F10 1 Tf 0.9214 0 TD ()Tj /F8 1 Tf 0.9275 0 TD -0.0001 Tc (EKey)Tj /F10 1 Tf 2.4693 0 TD 0.2608 Tc ({)Tj /F8 1 Tf 1.4273 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 1.0058 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F9 1 Tf 6.9739 0 0 6.9739 367.8 241.0201 Tm (j)Tj /F6 1 Tf 9.9626 0 0 9.9626 371.94 242.5201 Tm (\))Tj /F10 1 Tf 0.7588 0 TD (|)Tj /F6 1 Tf 0.6444 0 TD (1)Tj /F10 1 Tf 0.8733 0 TD ( )Tj /F5 1 Tf 1.1443 0 TD (j)Tj /F10 1 Tf 0.8371 0 TD ( )Tj /F5 1 Tf 1.1503 0 TD (l)Tj /F10 1 Tf 0.3192 0 TD (})Tj /F6 1 Tf 0.4999 0 TD (\))Tj /TT4 1 Tf 0.3915 0 TD [(.)-289.1(Note)-301.1(that)]TJ -28.7274 -1.2045 TD [(this)-252.9(transition)-252.9(can)-246.9(only)-246.9(be)-252.9(applied)-246.9(at)-246.9(the)-252.9(be)12(ginning)-246.9(\(static)-246.9(corruption\).)]TJ /TT2 1 Tf -0.9997 -1.5659 TD ()Tj /TT4 1 Tf 0.9999 0 TD [(The)-343.3(adv)12(ersary)-337.3(can)-337.3(initiate)-337.3(ne)24.1(w)-337.3(sessions:)]TJ /F6 1 Tf 16.8156 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.4(,)]TJ /F6 1 Tf 2.0898 0 TD 0 Tc (\))Tj /F19 1 Tf 6.9739 0 0 6.9739 368.28 221.4001 Tm -0.0041 Tc [(ne)-5.4(w)]TJ /F2 1 Tf 2.2629 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD -0.0018 Tc (i,a)Tj /F20 1 Tf 4.9813 0 0 4.9813 396.66 220.3801 Tm 0 Tc (1)Tj /F9 1 Tf 6.9739 0 0 6.9739 400.56 221.4001 Tm -0.0037 Tc [(,...)-17.2(,a)]TJ /F12 1 Tf 4.9813 0 0 4.9813 416.7 220.3201 Tm 0 Tc (k)Tj /F2 1 Tf 6.9739 0 0 6.9739 421.08 221.4001 Tm (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 365.82 214.9201 Tm ()Tj 0.4035 0 TD -0.2237 Tc [()-6()-6()]TJ 4.8422 0 TD 0 Tc ()Tj /F6 1 Tf 1.4454 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F7 1 Tf 6.9739 0 0 6.9739 449.82 219.3601 Tm 0 Tc ()Tj /F5 1 Tf 9.9626 0 0 9.9626 452.58 214.9201 Tm 0.1679 Tc (,f)Tj /F7 1 Tf 6.9739 0 0 6.9739 462.96 218.5201 Tm 0 Tc ()Tj /F5 1 Tf 9.9626 0 0 9.9626 465.78 214.9201 Tm 0.1679 Tc (,)Tj /F6 1 Tf 1.1021 0 TD 0 Tc (\))Tj /TT4 1 Tf -32.6299 -1.1985 TD (where)Tj /F8 1 Tf 2.6476 0 TD -0.0011 Tc (SId)Tj /F7 1 Tf 6.9739 0 0 6.9739 191.52 207.4201 Tm 0 Tc ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 196.32 202.9801 Tm (and)Tj /F5 1 Tf 1.6486 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 218.7 206.5801 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 223.5 202.9801 Tm [(are)-204.8(de)]TJ /TT5 1 Tf 2.3693 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-198.7(as)-198.7(follo)24.1(ws.)-204.8(Let)]TJ /F8 1 Tf 7.6423 0 TD 0.0021 Tc (sid)Tj /F6 1 Tf 1.4153 0 TD 0 Tc (=)Tj /F10 1 Tf 1.054 0 TD (|)Tj /F8 1 Tf 0.277 0 TD -0.0011 Tc (SId)Tj /F10 1 Tf 1.3491 0 TD 0 Tc (|)Tj /F6 1 Tf 0.3252 0 TD 0.0473 Tc (+1)Tj /TT4 1 Tf 1.5357 0 TD 0 Tc [(be)-198.7(the)-204.8(session)-192.7(identi)]TJ /TT5 1 Tf 7.9283 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD (er)Tj -32.2174 -1.1985 TD [(of)-349.3(the)-343.3(ne)24.1(w)-343.3(session)-337.3(where)]TJ /F10 1 Tf 10.739 0 TD (|)Tj /F8 1 Tf 0.277 0 TD -0.0011 Tc (SId)Tj /F10 1 Tf 1.3551 0 TD 0 Tc (|)Tj /TT4 1 Tf 0.6203 0 TD [(denotes)-337.3(the)-349.3(cardinality)-343.3(of)]TJ /F8 1 Tf 10.7584 0 TD -0.0011 Tc (SId)Tj /TT4 1 Tf 1.3551 0 TD 0.3373 Tc [(.W)415.6(e)-6(d)337.3(e)]TJ /TT5 1 Tf 3.1838 0 TD 0 Tc ()Tj /TT4 1 Tf 0.5562 0 TD (ne)Tj /F8 1 Tf 1.2871 0 TD -0.0011 Tc (SId)Tj /F7 1 Tf 6.9739 0 0 6.9739 465.54 195.4801 Tm 0 Tc ()Tj /F6 1 Tf 9.9626 0 0 9.9626 472.86 191.0401 Tm (=)Tj /F8 1 Tf -32.2384 -1.2045 TD -0.0011 Tc (SId)Tj /F10 1 Tf 1.602 0 TD 0.2427 Tc ({)Tj /F8 1 Tf 1.4093 0 TD 0.0021 Tc (sid)Tj /F10 1 Tf 1.1383 0 TD 0 Tc (})Tj /TT4 1 Tf 0.4999 0 TD [(.)-283.1(The)-283.1(function)]TJ /F5 1 Tf 5.9924 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 263.64 182.7001 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 269.28 179.0401 Tm [(is)-277(de)]TJ /TT5 1 Tf 1.8879 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-283.1(as:)]TJ /F5 1 Tf 3.1208 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 330.72 182.7001 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 333.54 179.0401 Tm (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F7 1 Tf 6.9739 0 0 6.9739 348.72 183.5401 Tm 0 Tc ()Tj /F6 1 Tf 9.9626 0 0 9.9626 351.54 179.0401 Tm 0.3398 Tc (\)=)Tj /F5 1 Tf 1.8429 0 TD 0 Tc (f)Tj /F6 1 Tf 0.5962 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F7 1 Tf 6.9739 0 0 6.9739 391.08 183.5401 Tm 0 Tc ()Tj /F6 1 Tf 9.9626 0 0 9.9626 393.9 179.0401 Tm (\))Tj /TT4 1 Tf 0.6745 0 TD [(for)-283.1(e)24.1(v)12(ery)]TJ /F8 1 Tf 3.9107 0 TD 0.0021 Tc (sid)Tj /F7 1 Tf 6.9739 0 0 6.9739 450.96 183.5401 Tm 0 Tc ()Tj /F10 1 Tf 9.9626 0 0 9.9626 457.14 179.0401 Tm ()Tj /F8 1 Tf 1.0058 0 TD -0.0011 Tc (SId)Tj /TT4 1 Tf -16.2608 -2.9992 TD 0 Tc (4)Tj ET endstream endobj 30 0 obj << /ProcSet [/PDF /Text ] /Font << /F2 5 0 R /F3 6 0 R /F4 7 0 R /F5 16 0 R /F6 17 0 R /F7 18 0 R /F8 23 0 R /F9 24 0 R /F10 25 0 R /F11 26 0 R /F12 27 0 R /F13 31 0 R /F14 32 0 R /F15 33 0 R /F16 34 0 R /F17 35 0 R /F18 36 0 R /F19 37 0 R /F20 38 0 R /TT2 8 0 R /TT4 9 0 R /TT5 10 0 R /TT7 19 0 R >> /ExtGState << /GS1 11 0 R >> >> endobj 40 0 obj << /Length 22022 >> stream BT /TT4 1 Tf 9.9626 0 0 9.9626 151.68 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw (and)Tj /F5 1 Tf 1.757 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 175.14 719.8201 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 177.96 716.16 Tm (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F6 1 Tf 1.1383 0 TD 0.3923 Tc (\)=\()Tj /F5 1 Tf 2.3428 0 TD -0.0019 Tc [(i,)-169.8()15.5(,)-169.8(,)]TJ /F6 1 Tf 2.6981 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F2 1 Tf 6.9739 0 0 6.9739 252.6 714.66 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 256.98 716.16 Tm 0.1679 Tc (,...,a)Tj /F9 1 Tf 6.9739 0 0 6.9739 284.46 714.66 Tm 0 Tc (k)Tj /F6 1 Tf 9.9626 0 0 9.9626 289.32 716.16 Tm 0.0026 Tc (\)\))Tj /TT4 1 Tf 1.0901 0 TD 0 Tc (where)Tj /F5 1 Tf 2.756 0 TD ()Tj /TT4 1 Tf 0.7167 0 TD [(denotes)-307.1(the)-313.2(root)-319.2(of)-313.2(the)-313.2(role)-313.2(tree)-313.2(and)]TJ /F5 1 Tf -18.3784 -1.1985 TD ()Tj /F6 1 Tf 0.6083 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (A)Tj /F9 1 Tf 6.9739 0 0 6.9739 169.14 702.72 Tm (j)Tj /F6 1 Tf 9.9626 0 0 9.9626 173.28 704.22 Tm 0.2796 Tc (\)=)Tj /F5 1 Tf 1.7225 0 TD 0 Tc (a)Tj /F9 1 Tf 6.9739 0 0 6.9739 195.72 702.72 Tm (j)Tj /TT4 1 Tf 9.9626 0 0 9.9626 202.38 704.22 Tm (for)Tj /F6 1 Tf 1.425 0 TD (1)Tj /F10 1 Tf 0.7769 0 TD ( )Tj /F5 1 Tf 1.0539 0 TD (j)Tj /F10 1 Tf 0.7468 0 TD ( )Tj /F5 1 Tf 1.0539 0 TD (k)Tj /TT4 1 Tf 0.801 0 TD (and)Tj /F5 1 Tf 1.6968 0 TD ()Tj /F6 1 Tf 0.6083 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (X)Tj /F9 1 Tf 6.9739 0 0 6.9739 296.64 709.02 Tm (j)Tj -0.1118 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 301.86 700.26 Tm (i)Tj /F6 1 Tf 9.9626 0 0 9.9626 305.4 704.22 Tm 0.2796 Tc (\)=)Tj /F5 1 Tf 1.7225 0 TD 0 Tc (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 328.56 707.8201 Tm (a)Tj /F12 1 Tf 4.9813 0 0 4.9813 332.88 706.8 Tm (i)Tj /F9 1 Tf 6.9739 0 0 6.9739 336.06 707.8201 Tm -0.0027 Tc (,j,s)Tj /TT4 1 Tf 9.9626 0 0 9.9626 348.3 704.22 Tm 0 Tc (,)Tj /F5 1 Tf 0.4969 0 TD ()Tj /F6 1 Tf 0.6083 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (L)Tj /F9 1 Tf 6.9739 0 0 6.9739 370.02 709.02 Tm (j)Tj 0 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 376.02 700.26 Tm (i)Tj /F6 1 Tf 9.9626 0 0 9.9626 379.62 704.22 Tm 0.2796 Tc (\)=)Tj /F5 1 Tf 1.7225 0 TD 0 Tc (l)Tj /F9 1 Tf 6.9739 0 0 6.9739 399.96 707.8201 Tm (a)Tj /F12 1 Tf 4.9813 0 0 4.9813 404.28 706.8 Tm (i)Tj /F9 1 Tf 6.9739 0 0 6.9739 407.46 707.8201 Tm -0.0027 Tc (,j,s)Tj /TT4 1 Tf 9.9626 0 0 9.9626 422.22 704.22 Tm 0 Tc (for)Tj /F5 1 Tf 1.419 0 TD (j)Tj /F10 1 Tf 0.7468 0 TD ()Tj /F13 1 Tf 0.9395 0 TD (N)Tj /TT4 1 Tf 0.7227 0 TD (.)Tj /TT2 1 Tf -31.9832 -1.8007 TD ()Tj /TT4 1 Tf 0.9999 0 TD [(The)-198.7(adv)12(ersary)-186.7(can)-186.7(send)-186.7(messages:)]TJ /F6 1 Tf 13.6503 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.5(,)]TJ /F6 1 Tf 2.0898 0 TD 0 Tc (\))Tj /F19 1 Tf 6.9739 0 0 6.9739 335.1 692.8201 Tm 0.0027 Tc [(sen)6.8(d)]TJ /F2 1 Tf 2.5383 0 TD 0 Tc (\()Tj /F11 1 Tf 0.4474 0 TD -0.0034 Tc (sid)Tj /F9 1 Tf 1.2132 0 TD -0.0037 Tc (,m)Tj /F2 1 Tf 1.3509 0 TD 0 Tc (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 332.58 686.28 Tm -0.2237 Tc [()18.1()-6()]TJ 3.8364 0 TD 0 Tc ()Tj /F6 1 Tf 1.2768 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc (,f)Tj /F7 1 Tf 6.9739 0 0 6.9739 411.24 689.9401 Tm 0 Tc ()Tj /F5 1 Tf 9.9626 0 0 9.9626 414.06 686.28 Tm 0.1679 Tc (,)Tj /F7 1 Tf 6.9739 0 0 6.9739 425.04 689.9401 Tm 0 Tc ()Tj /F6 1 Tf 9.9626 0 0 9.9626 427.8 686.28 Tm (\))Tj /TT4 1 Tf 0.5782 0 TD (where)Tj /F8 1 Tf 2.6356 0 TD 0.0021 Tc (sid)Tj /F10 1 Tf 1.4153 0 TD 0 Tc ()Tj /F8 1 Tf -32.3446 -1.1985 TD -0.0011 Tc (SId)Tj /TT4 1 Tf 1.3551 0 TD 0 Tc (,)Tj /F5 1 Tf 0.4849 0 TD (m)Tj /F10 1 Tf 1.1563 0 TD ()Tj /F8 1 Tf 0.9455 0 TD (M)Tj /TT4 1 Tf 0.8733 0 TD [(,)-240.9(and)]TJ /F5 1 Tf 2.1757 0 TD ()Tj /F7 1 Tf 6.9739 0 0 6.9739 227.94 677.9401 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 233.1 674.34 Tm (and)Tj /F5 1 Tf 1.6848 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 255.84 677.9401 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 261.06 674.34 Tm [(are)-240.9(de)]TJ /TT5 1 Tf 2.4055 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-240.9(as)-234.9(follo)24.1(ws.)-240.9(W)78.3(e)-234.9(de)]TJ /TT5 1 Tf 8.7076 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD (ne)Tj /F5 1 Tf 1.1848 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 400.74 677.9401 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 403.56 674.34 Tm (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F7 1 Tf 6.9739 0 0 6.9739 418.8 678.84 Tm 0 Tc ()Tj /F6 1 Tf 9.9626 0 0 9.9626 421.56 674.34 Tm 0.2796 Tc (\)=)Tj /F5 1 Tf 1.7225 0 TD 0 Tc (f)Tj /F6 1 Tf 0.5962 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F7 1 Tf 6.9739 0 0 6.9739 459.9 678.84 Tm 0 Tc ()Tj /F6 1 Tf 9.9626 0 0 9.9626 462.72 674.34 Tm (\))Tj /TT4 1 Tf 0.6263 0 TD (for)Tj -31.847 -1.1985 TD [(e)24.1(v)12(ery)]TJ /F8 1 Tf 2.4194 0 TD 0.0021 Tc (sid)Tj /F7 1 Tf 6.9739 0 0 6.9739 187.14 666.84 Tm 0 Tc ()Tj /F10 1 Tf 9.9626 0 0 9.9626 192.72 662.4 Tm ()Tj /F6 1 Tf T* (=)Tj /F8 1 Tf 1.0539 0 TD 0.0021 Tc (sid)Tj /TT4 1 Tf 1.1383 0 TD 0 Tc [(.)-234.9(Suppose)-234.9(that)]TJ /F5 1 Tf 5.8493 0 TD (f)Tj /F6 1 Tf 0.5962 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F6 1 Tf 1.1383 0 TD 0.2736 Tc [(\)=)-8.6(\()]TJ /F5 1 Tf 2.1139 0 TD 0.0008 Tc [(i,)-167.1()18.1(,)-167.1(p,)]TJ /F6 1 Tf 2.7403 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F2 1 Tf 6.9739 0 0 6.9739 351.6 660.9 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 355.92 662.4 Tm 0.1679 Tc [(,...)6(,a)]TJ /F9 1 Tf 6.9739 0 0 6.9739 383.34 660.9 Tm 0 Tc (k)Tj /F6 1 Tf 9.9626 0 0 9.9626 388.2 662.4 Tm 0.0026 Tc (\)\))Tj /TT4 1 Tf 1.0178 0 TD 0 Tc (and)Tj /F6 1 Tf 1.6787 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (l)Tj /F2 1 Tf 6.9739 0 0 6.9739 421.98 660.9 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 426.42 662.4 Tm 0.1679 Tc (,r)Tj /F2 1 Tf 6.9739 0 0 6.9739 435.36 660.9 Tm 0 Tc (1)Tj /F6 1 Tf 9.9626 0 0 9.9626 439.8 662.4 Tm (\))Tj /F5 1 Tf 0.3915 0 TD 0.1679 Tc [(,...)6(,)]TJ /F6 1 Tf 2.2223 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (l)Tj /F9 1 Tf 6.9739 0 0 6.9739 472.74 660.9 Tm (h)Tj /F5 1 Tf 9.9626 0 0 9.9626 477.84 662.4 Tm (,)Tj -32.7383 -1.1985 TD (r)Tj /F9 1 Tf 6.9739 0 0 6.9739 156.18 648.96 Tm (h)Tj /F6 1 Tf 9.9626 0 0 9.9626 161.34 650.46 Tm (\))Tj /TT4 1 Tf 0.6384 0 TD [(are)-252.9(the)-246.9(labels)-246.9(of)-252.9(edges)-240.9(lea)18.1(ving)]TJ /F5 1 Tf 12.2976 0 TD (p)Tj /TT4 1 Tf 0.7528 0 TD [(\(in)-252.9(this)-252.9(order\).)-252.9(W)78.3(e)-240.9(distinguish)-252.9(tw)12(o)-252.9(cases:)]TJ /F10 1 Tf -13.9538 -1.2828 TD ()Tj /TT4 1 Tf 0.9997 0 TD [(there)-259(does)-259(not)-265(e)12(xist)-259(a)]TJ /F5 1 Tf 8.7367 0 TD (j)Tj /TT4 1 Tf 0.7287 0 TD [(such)-259(that)]TJ /F5 1 Tf 3.8565 0 TD (m)Tj /TT4 1 Tf 1.1443 0 TD (and)Tj /F5 1 Tf 1.7028 0 TD (l)Tj /F9 1 Tf 6.9739 0 0 6.9739 332.88 636.1801 Tm (j)Tj /F5 1 Tf 9.9626 0 0 9.9626 337.08 637.6801 Tm ()Tj /TT4 1 Tf 0.8672 0 TD [(match.)-259(Then,)-265(we)-259(de)]TJ /TT5 1 Tf 7.8908 0 TD ()Tj /TT4 1 Tf 0.5561 0 TD (ne)Tj /F5 1 Tf 1.2028 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 447.9 641.3401 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 450.72 637.6801 Tm (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F6 1 Tf 1.1383 0 TD 0.3037 Tc (\)=)Tj /F5 1 Tf -29.8415 -1.1985 TD 0 Tc (f)Tj /F6 1 Tf 0.5962 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F6 1 Tf 1.1322 0 TD 0 Tc (\))Tj /TT4 1 Tf 0.6444 0 TD (and)Tj /F5 1 Tf 1.6908 0 TD ()Tj /F7 1 Tf 6.9739 0 0 6.9739 219.6 629.3401 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 225.12 625.7401 Tm (=)Tj /F5 1 Tf 1.0539 0 TD ()Tj /TT4 1 Tf 0.9094 0 TD [(\(the)-246.9(state)-246.9(remains)-246.9(unchanged\);)]TJ /F10 1 Tf -8.6303 -1.2286 TD ()Tj /TT4 1 Tf 0.9997 0 TD [(else,)-301.1(let)]TJ /F5 1 Tf 3.4185 0 TD (j)Tj /TT4 1 Tf 0.7829 0 TD [(be)-307.1(minimal)-319.2(s.)-301.1(t.)]TJ /F5 1 Tf 6.6845 0 TD (m)Tj /TT4 1 Tf 1.1925 0 TD (and)Tj /F5 1 Tf 1.751 0 TD (l)Tj /F9 1 Tf 6.9739 0 0 6.9739 309.6 612.0001 Tm (j)Tj /F5 1 Tf 9.9626 0 0 9.9626 313.8 613.5001 Tm ()Tj /TT4 1 Tf 0.9154 0 TD [(match.)-307.1(Let)]TJ /F5 1 Tf 4.6462 0 TD ()Tj /TT4 1 Tf 0.813 0 TD [(be)-307.2(the)-313.2(matcher)42.2(,)-313.2(i.e.,)]TJ /F5 1 Tf 8.2999 0 TD (m)Tj /F6 1 Tf 1.2708 0 TD (=)Tj -30.5137 -1.1985 TD (\()Tj /F5 1 Tf 0.3915 0 TD (l)Tj /F9 1 Tf 6.9739 0 0 6.9739 175.56 600.0601 Tm (j)Tj /F5 1 Tf 9.9626 0 0 9.9626 179.7 601.5601 Tm ()Tj /F6 1 Tf 0.6083 0 TD (\))Tj /F5 1 Tf 0.3915 0 TD ()Tj /TT4 1 Tf 0.4999 0 TD 0.1807 Tc [(.W)259(ed)180.7(e)]TJ /TT5 1 Tf 2.8646 0 TD 0 Tc ()Tj /TT4 1 Tf 0.5562 0 TD (ne)Tj /F5 1 Tf 1.1366 0 TD (f)Tj /F7 1 Tf 6.9739 0 0 6.9739 246.06 605.16 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 248.88 601.5601 Tm (\()Tj /F8 1 Tf 0.3915 0 TD 0.0021 Tc (sid)Tj /F6 1 Tf 1.1322 0 TD 0.2779 Tc (\)=\()Tj /F5 1 Tf 2.1139 0 TD -0.0012 Tc [(i,)-169.1()]TJ /F10 1 Tf 1.3972 0 TD 0 Tc ()Tj /F5 1 Tf 0.6685 0 TD 0.0304 Tc [(,)-137.5(p)27.6(j)32.7(,)]TJ /F6 1 Tf 2.3066 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F2 1 Tf 6.9739 0 0 6.9739 337.86 600.0601 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 342.24 601.5601 Tm 0.1679 Tc [(,...)6(,a)]TJ /F9 1 Tf 6.9739 0 0 6.9739 369.66 600.0601 Tm 0 Tc (k)Tj /F6 1 Tf 9.9626 0 0 9.9626 374.52 601.5601 Tm 0.0026 Tc (\)\))Tj /TT4 1 Tf 0.9696 0 TD 0 Tc (and)Tj /F5 1 Tf 1.6306 0 TD ()Tj /F7 1 Tf 6.9739 0 0 6.9739 406.98 605.16 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 412.5 601.5601 Tm (=)Tj /F5 1 Tf 1.06 0 TD ()Tj /F10 1 Tf 0.6565 0 TD 0.0018 Tc ({)Tj /F6 1 Tf 1.1684 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (r)Tj /F9 1 Tf 6.9739 0 0 6.9739 449.64 600.0601 Tm (j)Tj /F5 1 Tf 9.9626 0 0 9.9626 453.72 601.5601 Tm ()Tj /F9 1 Tf 6.9739 0 0 6.9739 458.1 600.0601 Tm (a)Tj /F12 1 Tf 4.9813 0 0 4.9813 462.42 599.04 Tm (i)Tj /F9 1 Tf 6.9739 0 0 6.9739 465.6 600.0601 Tm (,)Tj /F11 1 Tf 0.3356 0 TD -0.0034 Tc (sid)Tj /F6 1 Tf 9.9626 0 0 9.9626 476.88 601.5601 Tm 0 Tc (\))Tj /F5 1 Tf 0.3915 0 TD 0.0368 Tc ()Tj /F10 1 Tf 1.1082 0 TD 0 Tc (})Tj /TT4 1 Tf 0.4999 0 TD (.)Tj -34.8402 -2.132 TD (A)Tj /TT5 1 Tf 0.939 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-216.8(sequence)-210.8(of)-216.8(global)-216.8(states)-210.8(is)-216.8(called)-210.8(a)]TJ /TT7 1 Tf 15.9327 0 TD [(symbolic)-210.8(e)18.1(xecution)-210.8(tr)12(ace)]TJ /TT4 1 Tf 10.0427 0 TD [(\(for)-222.8(a)-210.8(protocol)]TJ /F5 1 Tf -28.9701 -1.1985 TD ()Tj /TT4 1 Tf 0.9094 0 TD [(\))-319.2(i)0(f)-319.2(i)0(t)-319.2(starts)-313.2(with)-319.2(the)-313.2(initial)-319.2(global)-319.2(state)]TJ /F5 1 Tf 16.1296 0 TD (q)Tj /F9 1 Tf 6.9739 0 0 6.9739 308.94 566.8801 Tm (I)Tj /TT4 1 Tf 9.9626 0 0 9.9626 316.62 568.3801 Tm [(and)-319.2(tw)12(o)-319.2(consecuti)24.1(v)12(e)-301.1(global)-319.2(states)-307.1(in)-319.2(this)]TJ -18.2542 -1.2045 TD [(sequence)-331.2(are)-337.3(connected)-331.2(via)-337.3(one)-337.3(of)-343.3(the)-337.3(abo)12(v)12(e)-331.2(transitions.)-337.3(W)78.3(e)-331.2(say)-337.3(that)-337.3(a)-337.3(trace)-337.3(is)]TJ /TT7 1 Tf 32.6748 0 TD (valid)Tj /TT4 1 Tf -32.6748 -1.5899 TD [(if)-283.1(e)24.1(v)12(ery)-277(send)-277(transition)]TJ /F6 1 Tf 9.5199 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.5(,)]TJ /F6 1 Tf 2.0898 0 TD 0 Tc (\))Tj /F19 1 Tf 6.9739 0 0 6.9739 277.44 547.02 Tm 0.0027 Tc [(sen)6.8(d)]TJ /F2 1 Tf 2.5383 0 TD 0 Tc (\()Tj /F11 1 Tf 0.4474 0 TD -0.0034 Tc (sid)Tj /F9 1 Tf 1.2132 0 TD -0.0037 Tc (,m)Tj /F2 1 Tf 1.3509 0 TD 0 Tc (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 274.92 540.54 Tm -0.2237 Tc [()18.1()-6()]TJ 3.8364 0 TD 0 Tc ()Tj /F6 1 Tf 1.337 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.343 0 TD 0.1679 Tc (,f)Tj /F7 1 Tf 6.9739 0 0 6.9739 354.12 544.14 Tm 0 Tc ()Tj /F5 1 Tf 9.9626 0 0 9.9626 356.94 540.54 Tm 0.1679 Tc (,)Tj /F7 1 Tf 6.9739 0 0 6.9739 367.92 544.14 Tm 0 Tc ()Tj /F6 1 Tf 9.9626 0 0 9.9626 370.68 540.54 Tm (\))Tj /TT4 1 Tf 0.6685 0 TD [(v)12(eri)]TJ /TT5 1 Tf 1.5426 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(es)-277(that)-277(the)-283.1(adv)12(ersary)]TJ -26.4478 -1.2045 TD [(could)-246.9(actually)-240.9(deduce)]TJ /F5 1 Tf 8.947 0 TD (m)Tj /TT4 1 Tf 0.8793 0 TD [(,)-234.9(that)-246.9(is)]TJ /F5 1 Tf 3.1392 0 TD ()Tj /F10 1 Tf 0.9335 0 TD ()Tj /F5 1 Tf 0.8913 0 TD (m)Tj /TT4 1 Tf 0.8793 0 TD [(.)-240.9(The)-240.9(set)-240.9(of)-246.9(v)24.1(alid)-246.9(symbolic)-240.9(e)12(x)12(ecution)-234.9(traces)-240.9(\(for)]TJ -15.6696 -1.1985 TD [(a)-295.1(protocol)]TJ /F5 1 Tf 4.3726 0 TD ()Tj /TT4 1 Tf 0.9094 0 TD [(\))-295.1(i)0(s)-295.1(denoted)-295.1(by)]TJ /F8 1 Tf 6.3459 0 TD 0.001 Tc (Exec)Tj /F9 1 Tf 6.9739 0 0 6.9739 270.06 521.04 Tm 0 Tc (s)Tj /F6 1 Tf 9.9626 0 0 9.9626 274.32 516.6 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.9094 0 TD (\))Tj /TT4 1 Tf 0.3915 0 TD [(.)-289.1(The)-295.1(set)-295.1(of)-295.1(v)24.1(alid)-301.1(set)-289.1(of)-301.1(messages)-283.1(is)-295.1(de)]TJ /TT5 1 Tf 15.6994 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-295.1(by)]TJ /F8 1 Tf -31.9562 -1.1985 TD 0.0002 Tc (Msg)Tj /F9 1 Tf 6.9739 0 0 6.9739 152.4 509.1001 Tm 0 Tc (s)Tj /F6 1 Tf 9.9626 0 0 9.9626 156.66 504.6601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.9094 0 TD 0.2796 Tc (\)=)Tj /F10 1 Tf 1.7225 0 TD 0 Tc ({)Tj /F5 1 Tf 0.4999 0 TD ()Tj /F10 1 Tf 0.9335 0 TD (|)Tj /F6 1 Tf 0.5541 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.5(,)]TJ /F6 1 Tf 2.0898 0 TD 0 Tc (\))Tj /TT4 1 Tf 0.6324 0 TD [(is)-252.9(the)-246.9(last)-246.9(state)-246.9(of)-252.9(a)-246.9(v)24.1(alid)-252.9(e)12(x)12(ecution)-240.9(trace)]TJ /F10 1 Tf 16.1491 0 TD (})Tj /TT4 1 Tf 0.4999 0 TD (.)Tj /TT2 1 Tf -28.3206 -3.1317 TD [(2.2)-999.7(The)-246.9(Concr)18.1(ete)-246.9(Model)]TJ /TT4 1 Tf 0 -2.132 TD [(The)-216.8(concrete)-204.8(model)-210.8(is)-210.8(de)]TJ /TT5 1 Tf 9.8944 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-216.8(w)66.2(.)0(r)54.2(.t.)-204.8(an)-210.8(encryption)-210.8(scheme)]TJ /F10 1 Tf 12.6731 0 TD 0.0025 Tc (AE)Tj /F6 1 Tf 1.6984 0 TD 0.2762 Tc (=\()Tj /F8 1 Tf 1.4454 0 TD 0 Tc (K)Tj /F11 1 Tf 6.9739 0 0 6.9739 403.56 450.7201 Tm (e)Tj /F5 1 Tf 9.9626 0 0 9.9626 407.34 452.2201 Tm (,)Tj /F8 1 Tf 0.4457 0 TD 0.0002 Tc (Enc)Tj /F5 1 Tf 1.5538 0 TD 0 Tc (,)Tj /F8 1 Tf 0.4457 0 TD 0.0009 Tc (Dec)Tj /F6 1 Tf 1.6141 0 TD 0 Tc (\))Tj /TT4 1 Tf 0.3915 0 TD [(,)-204.8(which)]TJ -31.8109 -1.2045 TD [(we)-246.9(no)24.1(w)]TJ /TT5 1 Tf 3.3579 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(x)-252.9(once)-246.9(and)-252.9(for)-252.9(all.)-246.9(Hashing)-246.9(is)-246.9(modeled)-246.9(by)-252.9(the)-246.9(random)-252.9(oracle.)]TJ -3.89 -1.5056 TD (C)Tj 7.9701 0 0 7.9701 142.125 425.2201 Tm 0.0602 Tc (ONCRETE)Tj 9.9626 0 0 9.9626 185.1738 425.2201 Tm 0 Tc (M)Tj 7.9701 0 0 7.9701 194.5122 425.2201 Tm 0.0602 Tc [(ESSA)37.6(GES)]TJ 9.9626 0 0 9.9626 232.1184 425.2201 Tm 0 Tc (.)Tj /TT7 1 Tf 0.5632 0 TD [(Concr)36.1(ete)-283.1(messa)12(g)12(e)0(s)]TJ /TT4 1 Tf 7.9488 0 TD [(are)-289.1(bit)-289.1(strings)-289.1(which)-289.1(carry)-289.1(type)-289.1(informa-)]TJ -18.2843 -1.2045 TD [(tionwhich)-277(can)-271(be)-271(ef)]TJ /TT5 1 Tf 7.9029 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ciently)-277(computed.)-271(In)-271(bit)-277(strings)-277(of)-277(type)]TJ /F8 1 Tf 15.9461 0 TD -0.0306 Tc [(Pa)-31.9(i)-32.6(r)]TJ /TT4 1 Tf 1.6863 0 TD 0 Tc [(,)-271(the)-271(tw)12(o)-277(components)]TJ -26.0914 -1.1985 TD [(can)-259(be)-265(ef)]TJ /TT5 1 Tf 3.6083 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ciently)-265(retrie)24.1(v)12(edand)-259(strings)-259(of)-271(type)]TJ /F8 1 Tf 14.2167 0 TD 0.0012 Tc (Ciphertext)Tj /TT4 1 Tf 4.5892 0 TD 0 Tc [(carry)-265(the)-265(public)-265(k)12(e)12(y)-259(that)-265(sup-)]TJ -22.9703 -1.1985 TD [(posedly)-271(w)12(a)0(s)-265(used)-265(to)-277(encrypt)-271(the)-265(plainte)12(xt.)-271(The)-271(set)-265(of)-277(bit)-271(strings)-271(is)-265(denoted)-271(by)]TJ /F10 1 Tf 31.3228 0 TD (C)Tj /F9 1 Tf 6.9739 0 0 6.9739 452.82 392.9401 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 457.68 389.3401 Tm [(.)-271(This)]TJ -32.4131 -1.2045 TD [(set)-210.8(depends)-210.8(on)-216.8(the)-216.8(security)-210.8(parameter)]TJ /F5 1 Tf 15.0548 0 TD ( )Tj /TT4 1 Tf 0.7468 0 TD [(as)-216.8(this)-210.8(parameter)-216.8(determines)-210.8(the)-216.8(length)-216.8(of)-216.8(agent)]TJ -15.8016 -1.1985 TD [(names,)-295.1(nonces,)-301.1(and)-301.1(k)12(e)12(ys.)-295.1(Substitutions)-307.1(no)24.1(w)-301.1(map)-307.1(v)24.1(ariables)-301.1(\(of)-307.1(some)-301.1(type\))-307.1(to)-301.1(concrete)]TJ T* [(messages)-240.9(\(of)-252.9(the)-246.9(same)-246.9(type\).)]TJ 0.0241 -1.5116 TD (C)Tj 7.9701 0 0 7.9701 142.125 338.4001 Tm 0.0602 Tc (ONCRETE)Tj 9.9626 0 0 9.9626 184.4538 338.4001 Tm 0 Tc (E)Tj 7.9701 0 0 7.9701 191.0194 338.4001 Tm 0.0602 Tc [(XECUTION)-286.1(OF)-271(A)]TJ 9.9626 0 0 9.9626 259.5735 338.4001 Tm 0 Tc (P)Tj 7.9701 0 0 7.9701 265.5943 338.4001 Tm 0.0602 Tc [(R)37.6(O)37.6(T)15(OCOL)]TJ 9.9626 0 0 9.9626 305.8704 338.4001 Tm 0.2409 Tc (.A)Tj /TT7 1 Tf 1.4299 0 TD 0 Tc [(concr)36.1(ete)-210.8(global)-216.8(state)]TJ /TT4 1 Tf 8.495 0 TD [(is)-210.8(a)-216.8(4-tuple)]TJ /F6 1 Tf 4.5878 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.5(,)]TJ -33.4284 -1.1985 TD 0.0023 Tc (,)Tj /F10 1 Tf 1.1021 0 TD 0 Tc (H)Tj /F6 1 Tf 0.8552 0 TD (\))Tj /TT4 1 Tf 0.6504 0 TD (where)Tj /F5 1 Tf 2.7018 0 TD ()Tj /TT4 1 Tf 0.9154 0 TD [(is)-265(a)]TJ /TT5 1 Tf 1.6348 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-271(set)-259(of)-265(bit)-265(strings,)]TJ /F8 1 Tf 8.735 0 TD -0.0011 Tc (SId)Tj /TT4 1 Tf 1.614 0 TD 0 Tc [(is)-259(a)]TJ /TT5 1 Tf 1.6348 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-265(set)-259(of)-265(session)-259(ids,)-259(and)]TJ /F5 1 Tf 10.7592 0 TD (f)Tj /TT4 1 Tf 0.8612 0 TD (maps)Tj -32.5764 -1.1985 TD [(e)24.1(v)12(ery)-313.2(session)-313.2(id)-319.2(in)]TJ /F8 1 Tf 7.8941 0 TD -0.0011 Tc (SId)Tj /TT4 1 Tf 1.6682 0 TD 0 Tc [(to)-319.2(the)-319.2(current)-319.2(state)-319.2(of)-319.2(the)-319.2(corresponding)-319.2(session)-307.1(\(the)-319.2(concrete)]TJ -9.5624 -1.2045 TD [(local)-283.1(states\).)-283.1(A)]TJ /TT7 1 Tf 6.3194 0 TD [(concr)36.1(ete)-277(local)-289.1(state)]TJ /TT4 1 Tf 8.1436 0 TD [(is)-283.1(de)]TJ /TT5 1 Tf 1.8939 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-289.1(just)-283.1(as)-283.1(a)-283.1(symbolic)-289.1(one,)-277(e)12(xcept)-283.1(that)-289.1(v)24.1(ari-)]TJ -16.913 -1.1985 TD [(ables)-337.3(are)-337.3(no)24.1(w)-337.3(mapped)-337.3(to)-343.3(bit)-343.3(strings)-337.3(and)-343.3(agent)-337.3(names)-331.2(are)-343.3(also)-337.3(bit)-343.3(strings.)-331.2(The)-343.3(fourth)]TJ T* [(component)-307.1(carries)-307.1(the)-307.1(state)-307.1(of)-313.2(the)-307.1(random)-307.1(oracle:)]TJ /F10 1 Tf 20.4549 0 TD (H)Tj /TT4 1 Tf 1.1684 0 TD [(is)-307.1(a)-307.1(set)-301.1(of)-313.2(couples)]TJ /F6 1 Tf 7.6451 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD 0.0013 Tc [(m,)-166.6(h)]TJ /F6 1 Tf 1.9031 0 TD 0 Tc (\))Tj /TT4 1 Tf 0.6866 0 TD (where)Tj /F5 1 Tf -32.2496 -1.1985 TD (m)Tj /TT4 1 Tf 1.1383 0 TD [(is)-252.9(a)-259(bit)-259(string)-259(and)]TJ /F5 1 Tf 7.171 0 TD (h)Tj /TT4 1 Tf 0.8371 0 TD [(its)-259(corresponding)-252.9(hash)-252.9(v)24.1(alue.)-252.9(A)-259(protocol)-259(is)-259(e)12(x)12(ecuted)-240.9(by)-259(running)]TJ -9.1464 -1.2045 TD [(a)-301.1(ppt)-307.1(T)42.2(uring)-313.2(machine,)-295.1(the)-307.1(\(concrete\))-307.1(adv)12(ersary)66.2(,)-295.1(which)-301.1(may)-307.1(mak)12(e)-307.1(queries)-301.1(correspond-)]TJ 0 -1.1985 TD [(ing)-228.9(to)-228.9(the)-228.9(transitions)-222.8(in)-228.9(the)-228.9(symbolic)-222.8(model.)-228.9(W)78.3(e)-222.8(allo)24.1(w)-222.8(four)-228.9(kinds)-228.9(of)-228.9(transitions)-228.9(between)]TJ T* [(global)-210.8(states,)-198.7(which)-210.8(we)-210.8(will)-210.8(refer)-210.8(to)-210.8(by)]TJ /TT7 1 Tf 15.4755 0 TD (corrupt)Tj /TT4 1 Tf 3 0 TD (,)Tj /TT7 1 Tf 0.4487 0 TD [(ne)12(w)]TJ /TT4 1 Tf 1.5988 0 TD (,)Tj /TT7 1 Tf 0.4548 0 TD [(send)-204.8(tr)12(ansitions)]TJ /TT4 1 Tf 6.3045 0 TD [(,)-198.7(and)]TJ /TT7 1 Tf 2.1034 0 TD [(hash)-210.8(queries)]TJ /TT4 1 Tf 5.0438 0 TD (.)Tj -34.4295 -1.1985 TD [(The)-331.2(semantics)-325.2(of)-331.2(the)]TJ /TT5 1 Tf 8.8717 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(rst)-337.3(three)-331.2(queries)-325.2(is)-331.2(de)]TJ /TT5 1 Tf 8.822 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-331.2(by)-331.2(analogy)-331.2(with)-331.2(the)-331.2(formal)-331.2(e)12(x)12(ecu-)]TJ -18.806 -1.2045 TD [(tion)-373.4(model.)-367.4(In)-367.4(addition,)-367.4(the)-373.4(adv)12(ersary)-361.4(may)-367.4(also)-367.4(mak)12(e)-367.4(queries)-367.4(to)-367.4(the)-373.4(random)-367.4(oracle:)]TJ /F6 1 Tf 0 -1.5899 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.5(,)165.6(,)]TJ /F10 1 Tf 2.5355 0 TD 0 Tc (H)Tj /F6 1 Tf 0.8552 0 TD (\))Tj /F19 1 Tf 6.9739 0 0 6.9739 195.9 197.5201 Tm -0.0027 Tc [(has)-6.7(h)]TJ /F2 1 Tf 2.5727 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (m)Tj /F2 1 Tf 1.0153 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 193.38 191.0401 Tm -0.2237 Tc [()-6()]TJ /F6 1 Tf 4.1496 0 TD 0 Tc (\()Tj /F8 1 Tf 0.3915 0 TD -0.0011 Tc (SId)Tj /F5 1 Tf 1.3491 0 TD 0.1679 Tc [(,f)115.5(,)165.6(,)]TJ /F10 1 Tf 2.5355 0 TD 0 Tc (H)Tj /F7 1 Tf 6.9739 0 0 6.9739 285.84 194.6401 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 288.54 191.0401 Tm (\))Tj /TT4 1 Tf 0.6926 0 TD (where)Tj /F10 1 Tf 2.744 0 TD (H)Tj /F7 1 Tf 6.9739 0 0 6.9739 331.32 194.6401 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 337.08 191.0401 Tm [(is)-301.1(de)]TJ /TT5 1 Tf 1.912 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-301.1(as)-295.1(follo)24.1(ws.)-301.1(If)-301.1(there)-301.1(e)12(xists)]TJ /F5 1 Tf -22.776 -1.2045 TD (n)Tj /TT4 1 Tf 0.9154 0 TD [(such)-319.2(that)]TJ /F6 1 Tf 3.9649 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD 0.0013 Tc [(m,)-166.6(n)]TJ /F6 1 Tf 1.9272 0 TD 0 Tc (\))Tj /F10 1 Tf 0.789 0 TD 0.3993 Tc (H)Tj /TT4 1 Tf 1.9212 0 TD 0 Tc [(,)-313.2(then)]TJ /F10 1 Tf 2.604 0 TD (H)Tj /F7 1 Tf 6.9739 0 0 6.9739 268.02 182.7001 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 274.8 179.0401 Tm (=)Tj /F10 1 Tf 1.1804 0 TD (H)Tj /TT4 1 Tf 1.1744 0 TD [(and)-313.2(we)-313.2(de)]TJ /TT5 1 Tf 4.1801 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD (ne)Tj /F5 1 Tf 1.263 0 TD (h)Tj /F6 1 Tf 0.9757 0 TD (=)Tj /F5 1 Tf 1.1804 0 TD (n)Tj /TT4 1 Tf 0.6023 0 TD [(.)-313.2(Else)-319.2(a)-313.2(hash)-319.2(v)24.1(alue)]TJ /F5 1 Tf 7.9679 0 TD (h)Tj /TT4 1 Tf 0.8913 0 TD (is)Tj -16.9242 -2.9992 TD (5)Tj ET endstream endobj 41 0 obj << /ProcSet [/PDF /Text ] /Font << /F2 5 0 R /F5 16 0 R /F6 17 0 R /F7 18 0 R /F8 23 0 R /F9 24 0 R /F10 25 0 R /F11 26 0 R /F12 27 0 R /F13 31 0 R /F19 37 0 R /TT2 8 0 R /TT4 9 0 R /TT5 10 0 R /TT7 19 0 R >> /ExtGState << /GS1 11 0 R >> >> endobj 43 0 obj << /Length 16463 >> stream BT /TT4 1 Tf 9.9626 0 0 9.9626 134.76 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw [(generated)-216.8(at)-222.8(random)-222.8(for)]TJ /F5 1 Tf 9.7139 0 TD (m)Tj /TT4 1 Tf 1.1021 0 TD (and)Tj /F10 1 Tf 1.6667 0 TD (H)Tj /F7 1 Tf 6.9739 0 0 6.9739 267.66 719.8201 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 273.18 716.16 Tm (=)Tj /F10 1 Tf 1.0539 0 TD 0.1251 Tc [(H)8.8({)]TJ /F6 1 Tf 2.2524 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD 0.0013 Tc [(m,)-166.6(h)]TJ /F6 1 Tf 1.9031 0 TD 0 Tc (\))Tj /F10 1 Tf 0.3915 0 TD (})Tj /TT4 1 Tf 0.4999 0 TD [(.)-216.8(I)0(n)-222.8(a)0(n)12(y)-216.8(case,)]TJ /F5 1 Tf 5.3528 0 TD (h)Tj /TT4 1 Tf 0.795 0 TD [(is)-222.8(returned)-222.8(to)-222.8(the)-222.8(ad-)]TJ -26.534 -1.1985 TD [(v)12(ersary)66.2(.)-259(A)]TJ /TT5 1 Tf 4.3607 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nite)-271(sequence)-252.9(of)-271(concrete)-259(global)-271(states)-259(is)-265(called)-259(a)]TJ /TT7 1 Tf 19.9754 0 TD [(concr)36.1(ete)-259(e)18.1(xecution)-259(tr)12(ace)]TJ /TT4 1 Tf -24.8923 -1.1985 TD [(if)-331.2(it)-337.3(starts)-325.2(with)-331.2(the)-331.2(initial)-337.3(global)-331.2(state.)-325.2(Ob)12(viously)66.2(,)-325.2(since)-325.2(the)-331.2(adv)12(ersary)-325.2(is)-325.2(a)-331.2(ppt)-331.2(T)42.2(uring)]TJ T* [(machine)-234.9(the)-234.9(length)-234.9(of)-240.9(the)-234.9(trace)-234.9(is)-234.9(bounded)-234.9(by)-240.9(a)-234.9(polynomial)-234.9(in)-240.9(the)-234.9(security)-234.9(parameter)]TJ /F5 1 Tf 33.9187 0 TD ( )Tj /TT4 1 Tf 0.53 0 TD (.)Tj -34.4487 -1.2045 TD [(Also,)-240.9(the)-240.9(sequence)-234.9(of)-240.9(random)-246.9(coins)]TJ /F5 1 Tf 14.4693 0 TD (R)Tj /F9 1 Tf 6.9739 0 0 6.9739 286.62 666.84 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 296.58 668.34 Tm [(used)-240.9(in)-246.9(the)-240.9(e)12(x)12(ecution)-234.9(by)-240.9(the)-246.9(honest)-234.9(agents)-240.9(and)]TJ -16.2427 -1.1985 TD [(the)-289.1(random)-289.1(oracle)-289.1(as)-283.1(well)-289.1(as)-289.1(the)-289.1(sequence)-277(of)-295.1(random)-289.1(coins)]TJ /F5 1 Tf 24.153 0 TD (R)Tj /F7 1 Tf 6.9739 0 0 6.9739 383.16 654.9 Tm (A)Tj /TT4 1 Tf 9.9626 0 0 9.9626 393 656.4 Tm [(used)-283.1(by)-289.1(the)-289.1(adv)12(ersary)]TJ -25.9208 -1.1985 TD [(can)-210.8(be)-216.8(bounded)-210.8(in)-216.8(length)-216.8(by)-216.8(polynomials)]TJ /F5 1 Tf 16.5027 0 TD (g)Tj /F7 1 Tf 6.9739 0 0 6.9739 303.96 642.96 Tm (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 310.86 644.46 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ( )Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT4 1 Tf 0.6023 0 TD (and)Tj /F5 1 Tf 1.6607 0 TD (p)Tj /F7 1 Tf 6.9739 0 0 6.9739 347.64 642.96 Tm (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 354.48 644.46 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ( )Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT4 1 Tf 0.3915 0 TD [(,)-210.8(respecti)24.1(v)12.1(ely)66.2(.)-204.8(Clearly)66.2(,)-216.8(i)0(f)]TJ /F5 1 Tf 9.8158 0 TD (R)Tj /F9 1 Tf 6.9739 0 0 6.9739 473.04 642.96 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 134.76 632.52 Tm (and)Tj /F5 1 Tf 1.6847 0 TD (R)Tj /F7 1 Tf 6.9739 0 0 6.9739 159.12 631.02 Tm (A)Tj /TT4 1 Tf 9.9626 0 0 9.9626 168.42 632.52 Tm (are)Tj /TT5 1 Tf 1.4616 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(x)12(ed,)-240.9(we)-240.9(obtain)-240.9(a)-240.9(uniquely)-246.9(determined)-240.9(concrete)-234.9(trace,)-240.9(which)-240.9(we)-240.9(denote)-240.9(by)]TJ /F8 1 Tf -5.3964 -1.2045 TD 0.001 Tc (Exec)Tj /F9 1 Tf 6.9739 0 0 6.9739 154.14 618.72 Tm 0 Tc ()Tj /F2 1 Tf 1.0153 0 TD (\()Tj /F9 1 Tf 0.4474 0 TD (R)Tj /F12 1 Tf 4.9813 0 0 4.9813 170.34 617.7001 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 176.76 618.72 Tm (\))Tj /F9 1 Tf 0.4474 0 TD (,)Tj /F7 1 Tf 0.3356 0 TD (A)Tj /F2 1 Tf 0.9207 0 TD (\()Tj /F9 1 Tf 0.4474 0 TD (R)Tj /F14 1 Tf 4.9813 0 0 4.9813 197.76 617.7001 Tm (A)Tj /F2 1 Tf 6.9739 0 0 6.9739 203.76 618.72 Tm (\))Tj /F6 1 Tf 9.9626 0 0 9.9626 207.36 620.52 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ( )Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT4 1 Tf 0.3915 0 TD (.)Tj /TT2 1 Tf 11.9552 0 0 11.9552 134.76 590.3401 Tm [(3)-998.7(Symbolic)-250.9(and)-245.9(Computational)-245.9(Secr)20.1(ecy)-261(Pr)20.1(operties)]TJ /TT4 1 Tf 9.9626 0 0 9.9626 134.76 568.0801 Tm [(In)-265(this)-265(section)-259(we)-259(recall)-265(the)-265(computational)-259(de)]TJ /TT5 1 Tf 18.2197 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nition)-271(of)-265(secrec)12(y)-252.9(and)-259(introduce)-265(our)-265(ne)24.1(w)]TJ -18.7758 -1.1985 TD [(symbolic)-246.9(de)]TJ /TT5 1 Tf 4.8573 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nition)-259(for)-252.9(secrec)12(y)66.2(.)]TJ -5.3893 -1.4876 TD (C)Tj 7.9701 0 0 7.9701 142.125 541.3201 Tm 0.0602 Tc [(OMPUT)90.3(A)112.9(TION)30.1(AL)]TJ 9.9626 0 0 9.9626 212.3383 541.3201 Tm 0 Tc (S)Tj 7.9701 0 0 7.9701 218.359 541.3201 Tm 0.0602 Tc (ECRECY)Tj 9.9626 0 0 9.9626 251.5396 541.3201 Tm 0 Tc [(.)-313.2(Computational)-283.1(secrec)12(y)-277(requires)-289.1(that)-283.1(no)-289.1(partial)-289.1(informa-)]TJ -11.7218 -1.1985 TD [(tion)-277(is)-277(leak)12(ed)-271(to)-277(the)-271(adv)12(ersary)66.2(.)-271(The)-277(typical)-271(w)12(a)0(y)-277(t)0(o)-277(formalize)-277(this)-271(idea)-277(is)-271(to)-277(require)-277(that)]TJ T* [(the)-265(secret)]TJ /F5 1 Tf 4.0772 0 TD (s)Tj /TT4 1 Tf 0.7347 0 TD [(is)-265(indistinguishable)-259(from)-271(an)-265(unrelated)-265(random)-265(bitstring)]TJ /F5 1 Tf 22.3571 0 TD (s)Tj /F7 1 Tf 6.9739 0 0 6.9739 410.16 521.04 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 415.56 517.4401 Tm [(chosen)-259(\(from)-271(an)]TJ -28.1853 -1.1985 TD [(appropriate)-313.2(distrib)18.1(ution\).)-307.1(The)-313.2(secrec)12(y)-295.1(o)0(f)-313.2(nonce)-307.1(v)24.1(ariable)]TJ /F5 1 Tf 22.8426 0 TD (X)Tj /F9 1 Tf 6.9739 0 0 6.9739 370.68 504.0001 Tm (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 376.68 502.9801 Tm (i)Tj /TT4 1 Tf 9.9626 0 0 9.9626 383.4 505.5001 Tm [(\(the)-307.1(nonce)-307.1(generated)-307.1(by)]TJ /F5 1 Tf -24.9572 -1.2045 TD (A)Tj /F9 1 Tf 6.9739 0 0 6.9739 142.26 492.0001 Tm (i)Tj /TT4 1 Tf 9.9626 0 0 9.9626 148.02 493.5001 Tm [(in)-252.9(the)]TJ /F5 1 Tf 2.5054 0 TD (i)Tj /TT4 1 Tf 0.3433 0 TD [(th)-246.9(role)-252.9(of)-252.9(the)-246.9(protocol\))-259(in)-246.9(protocol)]TJ /F5 1 Tf 13.9217 0 TD ()Tj /TT4 1 Tf 1.1623 0 TD [(is)-246.9(de)]TJ /TT5 1 Tf 1.8578 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ned)-252.9(as)-246.9(follo)24.1(ws.)]TJ /TT2 1 Tf -21.6776 -1.7285 TD (De)Tj /TT8 1 Tf 1.166 0 TD ()Tj /TT2 1 Tf 0.5562 0 TD [(nition)-259(1.)]TJ /TT7 1 Tf 4.0038 0 TD [(Consider)-391.5(the)-403.5(e)18.1(xperiment)]TJ /F21 1 Tf 10.4934 0 TD -0.0007 Tc (Exp)Tj /F2 1 Tf 6.9739 0 0 6.9739 316.38 480.6601 Tm 0.0016 Tc (sec)Tj ET 327.06 481.08 2.1 -0.42 re f BT /F9 1 Tf 6.9739 0 0 6.9739 329.1609 480.6601 Tm 0 Tc (b)Tj /F11 1 Tf -1.8327 -0.9808 TD 0.0006 Tc (Exec)Tj /F12 1 Tf 4.9813 0 0 4.9813 330.84 472.8 Tm -0.0025 Tc (,)Tj /F14 1 Tf 1.5656 0 TD 0 Tc (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 345.24 476.2801 Tm (\()Tj /F5 1 Tf 0.3915 0 TD -0.0012 Tc [(i,)-169.1(j)]TJ /F6 1 Tf 1.2587 0 TD 0.0026 Tc (\)\()Tj /F5 1 Tf 0.7829 0 TD 0 Tc ( )Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT7 1 Tf 0.7829 0 TD [(par)12(ametrized)-385.4(by)-397.5(a)-397.5(bit)]TJ /F5 1 Tf 9.4044 0 TD (b)Tj /TT7 1 Tf -34.2774 -1.1985 TD [(and)-271(that)-271(in)42.2(volves)-265(an)-271(adver)12(sary)]TJ /F10 1 Tf 12.6139 0 TD (A)Tj /TT7 1 Tf 1.072 0 TD [(a)12(gainst)-271(pr)42.2(otocol)]TJ /F5 1 Tf 6.8153 0 TD ()Tj /TT7 1 Tf 0.9094 0 TD [(.)-271(The)-271(e)18.1(xperiment)-259(tak)12(es)-265(as)-271(input)-271(a)]TJ -21.4106 -1.2045 TD [(security)-277(par)12(ameter)]TJ /F5 1 Tf 7.8736 0 TD ( )Tj /TT7 1 Tf 0.8191 0 TD [(and)-283.1(starts)-277(by)-289.1(g)12(ener)12(ating)-277(two)-289.1(r)12(andom)-277(nonces)]TJ /F5 1 Tf 18.2658 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 409.68 450.8401 Tm (0)Tj /TT7 1 Tf 9.9626 0 0 9.9626 417 452.3401 Tm (and)Tj /F5 1 Tf 1.7831 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 440.76 450.8401 Tm (1)Tj /TT7 1 Tf 9.9626 0 0 9.9626 448.08 452.3401 Tm (in)Tj /F10 1 Tf 1.0669 0 TD (C)Tj /F9 1 Tf 6.9739 0 0 6.9739 464.52 456.0001 Tm ()Tj /F5 1 Tf 9.9626 0 0 9.9626 469.38 452.3401 Tm -0.0007 Tc (.n)Tj /TT7 1 Tf 0.8793 0 TD 0 Tc (.)Tj -34.4668 -1.1985 TD [(Then)-355.3(the)-349.3(adver)12(sary)]TJ /F10 1 Tf 8.2566 0 TD (A)Tj /TT7 1 Tf 1.1503 0 TD [(starts)-343.3(inter)12(acting)-349.3(with)-349.3(the)-355.3(pr)42.2(otocol)]TJ /F5 1 Tf 14.6306 0 TD ()Tj /TT7 1 Tf 1.2647 0 TD [(as)-349.3(in)-355.3(the)-349.3(e)18.1(xecution)-349.3(de-)]TJ -25.3023 -1.1985 TD [(scribed)-228.9(by)]TJ /F8 1 Tf 4.3575 0 TD 0.001 Tc (Exec)Tj /F9 1 Tf 6.9739 0 0 6.9739 197.64 426.9601 Tm 0.0195 Tc (,)Tj /F7 1 Tf 1.2906 0 TD 0 Tc (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 213.54 428.4601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ( )Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT7 1 Tf 0.3915 0 TD [(.)-228.9(A)0(t)-240.9(some)-234.9(point)-240.9(in)-234.9(the)-240.9(e)18.1(xecution)-228.9(the)-234.9(adver)12(sary)-228.9(initiates)-240.9(a)-234.9(session)]TJ /F5 1 Tf -9.2205 -1.1985 TD (s)Tj /TT7 1 Tf 0.8191 0 TD [(in)-349.3(whic)12(h)-343.3(the)-349.3(r)42.2(ole)-343.3(of)]TJ /F5 1 Tf 8.4571 0 TD (A)Tj /F9 1 Tf 6.9739 0 0 6.9739 234.72 415.0201 Tm (i)Tj /TT7 1 Tf 9.9626 0 0 9.9626 241.44 416.5201 Tm [(is)-349.3(e)18.1(xecuted,)-337.3(and)-349.3(declar)36.1(es)-337.3(this)-349.3(session)-343.3(under)-343.3(attac)18.1(k.)-343.3(In)-349.3(this)]TJ -10.708 -1.2045 TD [(session,)-234.9(the)-246.9(variable)]TJ /F5 1 Tf 8.4221 0 TD (X)Tj /F9 1 Tf 6.9739 0 0 6.9739 227.88 409.3201 Tm (j)Tj -0.1118 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 233.1 400.5601 Tm (i)Tj /TT7 1 Tf 9.9626 0 0 9.9626 239.16 404.5201 Tm [(is)-246.9(instantiated)-252.9(with)]TJ /F5 1 Tf 7.8586 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 323.46 403.0201 Tm (b)Tj /TT7 1 Tf 9.9626 0 0 9.9626 327.42 404.5201 Tm [(.)-246.9(The)-246.9(r)36.1(est)-240.9(of)-246.9(the)-246.9(e)18.1(xecution)-240.9(is)-246.9(e)18.1(xactly)-240.9(as)]TJ -19.3382 -1.1985 TD (in)Tj /F8 1 Tf 1.0067 0 TD 0.001 Tc (Exec)Tj /F9 1 Tf 6.9739 0 0 6.9739 164.22 391.08 Tm 0.0195 Tc (,)Tj /F7 1 Tf 1.2906 0 TD 0 Tc (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 180.06 392.58 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ( )Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT7 1 Tf 0.3915 0 TD [(.)-222.8(A)0(t)-234.9(some)-222.8(point)-234.9(the)-228.9(adver)12(sary)-216.8(r)36.1(equir)36.1(es)-216.8(the)-228.9(two)-228.9(nonces)]TJ /F5 1 Tf 21.4207 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 412.86 391.08 Tm (0)Tj /TT7 1 Tf 9.9626 0 0 9.9626 419.58 392.58 Tm (and)Tj /F5 1 Tf 1.7289 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 442.8 391.08 Tm (1)Tj /TT7 1 Tf 9.9626 0 0 9.9626 449.52 392.58 Tm [(and)-228.9(has)]TJ -31.594 -1.1985 TD [(to)-240.9(output)-240.9(a)-234.9(guess)]TJ /F5 1 Tf 7.0072 0 TD (d)Tj /TT7 1 Tf 0.5179 0 TD [(.)-234.9(The)-240.9(bit)]TJ /F5 1 Tf 3.5223 0 TD (d)Tj /TT7 1 Tf 0.7588 0 TD [(is)-234.9(the)-240.9(r)36.1(esult)-228.9(of)-240.9(the)-234.9(e)18.1(xperiment.)-228.9(W)90.3(e)-234.9(de)]TJ /TT9 1 Tf 14.5787 0 TD ()Tj /TT7 1 Tf 0.5 0 TD [(ne)-234.9(the)-240.9(advanta)12(g)12.1(e)-240.9(of)]TJ -26.8851 -1.1985 TD [(the)-246.9(adver)12(sary)]TJ /F10 1 Tf 5.6965 0 TD (A)Tj /TT7 1 Tf 1.0479 0 TD (by:)Tj /F21 1 Tf -6.5517 -2.2524 TD -0.0014 Tc (Adv)Tj /F2 1 Tf 6.9739 0 0 6.9739 157.92 350.7601 Tm 0.0016 Tc (sec)Tj /F11 1 Tf 0 -0.998 TD 0.0006 Tc (Exec)Tj /F12 1 Tf 4.9813 0 0 4.9813 172.32 342.7801 Tm -0.0025 Tc (,)Tj /F14 1 Tf 1.5656 0 TD 0 Tc (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 186.72 346.2601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD -0.0012 Tc [(i,)-169.1(j)]TJ /F6 1 Tf 1.2587 0 TD 0.0026 Tc (\)\()Tj /F5 1 Tf 0.7829 0 TD 0 Tc ( )Tj /F6 1 Tf 0.53 0 TD 0.2749 Tc [(\)=P)274.9(r)]TJ /F22 1 Tf 2.957 1.1142 TD 0 Tc ()Tj /F21 1 Tf 0.4698 -1.1142 TD -0.0007 Tc (Exp)Tj /F2 1 Tf 6.9739 0 0 6.9739 270.36 350.64 Tm 0.0016 Tc (sec)Tj ET 280.98 351.06 2.1 -0.42 re f BT 6.9739 0 0 6.9739 283.0809 350.64 Tm 0 Tc (1)Tj /F11 1 Tf -1.8241 -0.9808 TD 0.0006 Tc (Exec)Tj /F12 1 Tf 4.9813 0 0 4.9813 284.76 342.7801 Tm -0.0025 Tc (,)Tj /F14 1 Tf 1.5656 0 TD 0 Tc (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 299.16 346.2601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD -0.0012 Tc [(i,)-169.1(j)]TJ /F6 1 Tf 1.2587 0 TD 0.0026 Tc (\)\()Tj /F5 1 Tf 0.7829 0 TD 0 Tc ( )Tj /F6 1 Tf 0.53 0 TD 0.0026 Tc [(\)=)9.5(1)]TJ /F22 1 Tf 1.6622 1.1142 TD 0 Tc ()Tj /F10 1 Tf 0.6926 -1.1142 TD ()Tj /F6 1 Tf 0.9997 0 TD (Pr)Tj /F22 1 Tf 1.2406 1.1142 TD ()Tj /F21 1 Tf 0.4698 -1.1142 TD -0.0007 Tc (Exp)Tj /F2 1 Tf 6.9739 0 0 6.9739 399.12 350.64 Tm 0.0016 Tc (sec)Tj ET 409.74 351.06 2.1 -0.42 re f BT 6.9739 0 0 6.9739 411.8409 350.64 Tm 0 Tc (0)Tj /F11 1 Tf -1.8241 -0.9808 TD 0.0006 Tc (Exec)Tj /F12 1 Tf 4.9813 0 0 4.9813 413.52 342.7801 Tm -0.0025 Tc (,)Tj /F14 1 Tf 1.5656 0 TD 0 Tc (A)Tj /F6 1 Tf 9.9626 0 0 9.9626 427.92 346.2601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD -0.0012 Tc [(i,)-169.1(j)]TJ /F6 1 Tf 1.2587 0 TD 0.0026 Tc (\)\()Tj /F5 1 Tf 0.7829 0 TD 0 Tc ( )Tj /F6 1 Tf 0.53 0 TD 0.0026 Tc [(\)=)9.5(1)]TJ /F22 1 Tf 1.6622 1.1142 TD 0 Tc ()Tj /TT7 1 Tf -34.0512 -3.5954 TD [(W)90.3(e)-313.2(say)-313.2(that)-313.2(nonce)]TJ /F5 1 Tf 7.7156 0 TD (X)Tj /F9 1 Tf 6.9739 0 0 6.9739 220.74 326.3401 Tm (j)Tj -0.1118 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 225.96 317.58 Tm (i)Tj /TT7 1 Tf 9.9626 0 0 9.9626 232.74 321.54 Tm [(is)-313.2(computationally)-313.2(secr)36.1(et)-307.1(in)-313.2(pr)42.2(otocol)]TJ /F5 1 Tf 15.2018 0 TD ()Tj /TT7 1 Tf 0.9094 0 TD [(,)-313.2(and)-313.2(we)-313.2(write)]TJ /F5 1 Tf 6.1692 0 TD ()Tj /F10 1 Tf 1.3069 0 TD (|)Tj /F6 1 Tf 0.1084 0 TD (=)Tj /F11 1 Tf 6.9739 0 0 6.9739 476.76 325.14 Tm (c)Tj /F8 1 Tf 9.9626 0 0 9.9626 134.76 309.6 Tm 0.0009 Tc (SecNonce)Tj /F6 1 Tf 4.0592 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD -0.0012 Tc [(i,)-169.1(j)]TJ /F6 1 Tf 1.2587 0 TD 0 Tc (\))Tj /TT7 1 Tf 0.6324 0 TD [(if)-252.9(for)-252.9(e)12(very)-234.9(p.p.t.)-240.9(adver)12(sary)]TJ /F10 1 Tf 11.1125 0 TD (A)Tj /TT7 1 Tf 1.0479 0 TD [(its)-252.9(advanta)12(g)12(e)-252.9(is)-246.9(ne)42.2(gligible)12(.)]TJ /TT4 1 Tf -18.4781 -2.3006 TD (S)Tj 7.9701 0 0 7.9701 141.0207 286.6801 Tm 0.0602 Tc [(YMBOLIC)-361.4(SECRECY)]TJ 9.9626 0 0 9.9626 222.1067 286.6801 Tm 0 Tc [(.)-307.1(A)0(s)-277(e)12(xplained)-271(in)-283.1(the)-277(introduction,)-283.1(weak)-277(secrec)12(y)-271(i)0(s)-277(not)-283.1(suf)]TJ /TT5 1 Tf 23.4189 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD (cient)Tj -32.7425 -1.2045 TD [(to)-204.8(capture)-204.8(the)-204.8(standard)-204.8(indistinguishability-based)-204.8(notion)-210.8(used)-198.7(in)-210.8(computational)-204.8(settings.)]TJ 0 -1.1985 TD [(The)-283.1(ne)24.1(w)-277(notion)-277(of)-283.1(secrec)12(y)-271(w)0(e)-277(propose)-277(here)-277(relies)-277(on)-283.1(the)-277(intuiti)24.1(v)12(ely)-277(appealing)-277(concept)]TJ T* [(of)-289.1(patterns)-283.1([1].)-283.1(Roughly)66.2(,)-283.1(the)-289.1(pattern)-283.1(of)-289.1(an)-283.1(e)12(xpression)-277(is)-283.1(obtained)-283.1(by)-283.1(replacing)-289.1(with)]TJ /F23 1 Tf 33.6721 0 TD ()Tj /TT4 1 Tf 0.7769 0 TD (,)Tj -34.449 -1.1985 TD [(all)-216.8(the)-216.8(subterms)-210.8(of)-222.8(the)-216.8(e)12(xpression)-204.8(that)-216.8(are)-216.8(secret.)-210.8(In)-216.8(our)-216.8(case,)-204.8(a)-216.8(subterm)]TJ /F5 1 Tf 28.2608 0 TD (T)Tj /TT4 1 Tf 0.9395 0 TD (of)Tj /F5 1 Tf 1.0498 0 TD (T)Tj /F7 1 Tf 6.9739 0 0 6.9739 443.58 242.4601 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 448.56 238.8601 Tm [(is)-216.8(secret)]TJ -31.4977 -1.2045 TD [(if,)-240.9(e)24.1(v)12(en)-228.9(when)-240.9(gi)24.1(v)12(e)0(n)]TJ /F5 1 Tf 8.0095 0 TD (T)Tj /TT4 1 Tf 0.9576 0 TD [(the)-240.9(adv)12(ersary)-234.9(cannot)-234.9(v)12(erify)-240.9(that)]TJ /F5 1 Tf 12.8235 0 TD (T)Tj /TT4 1 Tf 0.9636 0 TD [(has)-234.9(been)-234.9(used)-234.9(to)-240.9(construct)]TJ /F5 1 Tf 10.6835 0 TD (T)Tj /F7 1 Tf 6.9739 0 0 6.9739 475.32 230.5201 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 478.08 226.8601 Tm (.)Tj -34.4607 -1.1985 TD [(F)12(ormally)66.2(,)-259(w)0(e)-259(add)]TJ /F5 1 Tf 7.225 0 TD (T)Tj /TT4 1 Tf 0.9817 0 TD [(to)-259(the)-259(kno)24.1(wledge)-259(set)]TJ /F5 1 Tf 8.5038 0 TD ()Tj /TT4 1 Tf 0.8552 0 TD [(in)-265(the)-259(deduction)-252.9(relation.)-259(The)-265(ideas)-252.9(behind)]TJ -17.5657 -1.1985 TD [(our)-349.3(de)]TJ /TT5 1 Tf 2.6262 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nition)-355.3(of)-349.3(patterns)-343.3(are)-349.3(related)-343.3(to)-349.3(of)]TJ /TT5 1 Tf 13.9495 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(ine)-349.3(guessing)-343.3(attacks,)-343.3(where)-343.3(the)-349.3(adv)12(ersary)]TJ -17.688 -1.1985 TD [(is)-283.1(gi)24.1(v)12(e)0(n)-283.1(the)-289.1(weak)-277(secret)-283.1(and)-283.1(should)-289.1(be)-283.1(unable)-283.1(to)-289.1(test)-283.1(whether)-283.1(the)-289.1(gi)24.1(v)12(e)0(n)-283.1(weak)-277(secret)-283.1(is)]TJ 0 -1.2045 TD [(indeed)-246.9(the)-252.9(one)-246.9(used)-246.9(in)-252.9(the)-246.9(observ)12(ed)-240.9(messages.)]TJ 17.1039 -2.9992 TD (6)Tj ET endstream endobj 44 0 obj << /ProcSet [/PDF /Text ] /Font << /F2 5 0 R /F5 16 0 R /F6 17 0 R /F7 18 0 R /F8 23 0 R /F9 24 0 R /F10 25 0 R /F11 26 0 R /F12 27 0 R /F14 32 0 R /F21 45 0 R /F22 46 0 R /F23 47 0 R /TT2 8 0 R /TT4 9 0 R /TT5 10 0 R /TT7 19 0 R /TT8 48 0 R /TT9 49 0 R >> /ExtGState << /GS1 11 0 R >> >> endobj 51 0 obj << /Length 30827 >> stream BT /TT2 1 Tf 9.9626 0 0 9.9626 134.76 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw (De)Tj /TT8 1 Tf 1.166 0 TD ()Tj /TT2 1 Tf 0.5562 0 TD [(nition)-259(2)-499.9(\()0(P)12(atter)12(ns\).)]TJ /TT7 1 Tf 8.5928 0 TD [(Given)-331.2(a)-331.2(set)-331.2(of)-331.2(closed)-325.2(terms)]TJ /F5 1 Tf 11.5286 0 TD ()Tj /F6 1 Tf 1.0238 0 TD (=)Tj /F10 1 Tf 1.2105 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (M)Tj /F2 1 Tf 6.9739 0 0 6.9739 389.34 714.66 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 393.78 716.16 Tm 0.1679 Tc (,M)Tj /F2 1 Tf 6.9739 0 0 6.9739 407.88 714.66 Tm 0 Tc (2)Tj /F5 1 Tf 9.9626 0 0 9.9626 412.38 716.16 Tm 0.1679 Tc [(,...)6(,M)]TJ /F9 1 Tf 6.9739 0 0 6.9739 444.18 714.66 Tm 0 Tc (k)Tj /F10 1 Tf 9.9626 0 0 9.9626 449.1 716.16 Tm (})Tj /TT7 1 Tf 0.8311 0 TD [(and)-331.2(a)]TJ -32.383 -1.3129 TD (term)Tj /F5 1 Tf 2.0197 0 TD (T)Tj /TT7 1 Tf 0.7227 0 TD 0.1867 Tc [(,w)186.7(ed)186.7(e)]TJ /TT9 1 Tf 2.6781 0 TD 0 Tc ()Tj /TT7 1 Tf 0.5 0 TD (ne)Tj /F8 1 Tf 1.1305 0 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 219.6 701.5801 Tm 0 Tc (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 225.9 703.0801 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.5962 0 TD 0.2736 Tc (\)=)Tj /F10 1 Tf 1.7225 0 TD 0 Tc ({)Tj /F8 1 Tf 0.4999 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 272.34 707.88 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 278.58 703.0801 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F2 1 Tf 6.9739 0 0 6.9739 292.14 701.5801 Tm (1)Tj /F6 1 Tf 9.9626 0 0 9.9626 296.64 703.0801 Tm (\))Tj /F5 1 Tf 0.3915 0 TD (,)Tj /F8 1 Tf 0.4457 0 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 319.38 707.88 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 325.68 703.0801 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F2 1 Tf 6.9739 0 0 6.9739 339.24 701.5801 Tm (2)Tj /F6 1 Tf 9.9626 0 0 9.9626 343.68 703.0801 Tm (\))Tj /F5 1 Tf 0.3915 0 TD 0.1679 Tc [(,...)6(,)]TJ /F8 1 Tf 2.2223 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 384.18 707.88 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 390.42 703.0801 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F9 1 Tf 6.9739 0 0 6.9739 403.98 701.5801 Tm (k)Tj /F6 1 Tf 9.9626 0 0 9.9626 408.9 703.0801 Tm (\))Tj /F10 1 Tf 0.3915 0 TD (})Tj /TT7 1 Tf 0.4999 0 TD [(,)-180.7(wher)36.1(e)]TJ /F8 1 Tf 3.0191 0 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 462.48 707.88 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 468.72 703.0801 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F6 1 Tf 1.078 0 TD (\))Tj /TT7 1 Tf -34.9907 -1.2045 TD (de)Tj /TT9 1 Tf 0.9438 0 TD ()Tj /TT7 1 Tf 0.5 0 TD [(ned)-246.9(r)36.1(ecur)12(sively)-240.9(by:)]TJ /F8 1 Tf 4.392 -3.487 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 207.36 661.14 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 213.6 656.34 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD 0.2796 Tc (\)=)Tj /F22 1 Tf 1.7224 1.4093 TD 0 Tc ()Tj /F5 1 Tf 0.8913 -0.801 TD (a)Tj /TT7 1 Tf 1.3069 0 TD (if)Tj /F5 1 Tf 0.8086 0 TD 0.0004 Tc [(,)-167.5(T)]TJ /F10 1 Tf 2.0416 0 TD 0 Tc ()Tj /F5 1 Tf 0.8913 0 TD (a)Tj /F23 1 Tf -5.0485 -1.1985 TD ()Tj /TT7 1 Tf 1.3069 0 TD (otherwise)Tj /F8 1 Tf -10.4551 -1.3249 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 172.14 642.0601 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 178.44 637.2601 Tm (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F2 1 Tf 6.9739 0 0 6.9739 195.9 635.7601 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 200.34 637.2601 Tm 0.1679 Tc (,M)Tj /F2 1 Tf 6.9739 0 0 6.9739 214.44 635.7601 Tm 0 Tc (2)Tj /F10 1 Tf 9.9626 0 0 9.9626 218.88 637.2601 Tm ()Tj /F6 1 Tf 0.3915 0 TD 0.2796 Tc (\)=)Tj /F10 1 Tf 1.7225 0 TD 0 Tc ()Tj /F8 1 Tf 0.3915 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 258.3 642.0601 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 264.6 637.2601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F2 1 Tf 6.9739 0 0 6.9739 278.16 635.7601 Tm (1)Tj /F6 1 Tf 9.9626 0 0 9.9626 282.6 637.2601 Tm (\))Tj /F5 1 Tf 0.3915 0 TD (,)Tj /F8 1 Tf 0.4457 0 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 305.4 642.0601 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 311.64 637.2601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F2 1 Tf 6.9739 0 0 6.9739 325.2 635.7601 Tm (2)Tj /F6 1 Tf 9.9626 0 0 9.9626 329.64 637.2601 Tm (\))Tj /F10 1 Tf 0.3915 0 TD ()Tj /F8 1 Tf -17.4713 -1.9453 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 173.94 622.6801 Tm 0 Tc ()Tj 0 -1.1013 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 180.24 617.8801 Tm (\()Tj /F10 1 Tf 0.3915 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (M)Tj /F10 1 Tf 1.078 0 TD (})Tj /F9 1 Tf 6.9739 0 0 6.9739 204.84 621.54 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F6 1 Tf 9.9626 0 0 9.9626 222.78 617.8801 Tm 0.2796 Tc (\)=)Tj /F22 1 Tf 1.7224 1.4093 TD 0 Tc ()Tj /F10 1 Tf 0.8913 -0.7889 TD ({)Tj /F8 1 Tf 0.4999 0 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 268.26 628.8 Tm 0 Tc ()Tj 0 -1.1012 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 274.56 624.0601 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F6 1 Tf 1.078 0 TD (\))Tj /F10 1 Tf 0.3915 0 TD (})Tj /F9 1 Tf 6.9739 0 0 6.9739 298.08 627.66 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /TT7 1 Tf 9.9626 0 0 9.9626 321.3 624.0601 Tm (if)Tj /F5 1 Tf 0.8086 0 TD 0.0004 Tc [(,)-167.5(T)]TJ /F10 1 Tf 2.0416 0 TD 0 Tc ()Tj /F8 1 Tf 0.8853 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 1.0058 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD (\))Tj /TT7 1 Tf 0.6324 0 TD [(or)-252.9(if)]TJ /F5 1 Tf 1.9447 0 TD (r)Tj /F10 1 Tf 0.7588 0 TD ()Tj /F8 1 Tf 0.9455 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 441.9 622.5601 Tm -0.0006 Tc (adv)Tj /F23 1 Tf 9.9626 0 0 9.9626 248.82 610.6801 Tm 0 Tc ()Tj /TT7 1 Tf 7.2752 0 TD (otherwise)Tj /F8 1 Tf -14.7973 -1.873 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 188.4 596.8201 Tm 0 Tc ()Tj 0 -1.1013 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 194.64 592.02 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F6 1 Tf 1.078 0 TD 0.0026 Tc [(\)\))-271(=)]TJ /F22 1 Tf 2.1078 1.4153 TD 0 Tc ()Tj /F5 1 Tf 0.8913 -0.8672 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F8 1 Tf 0.3915 0 TD -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 272.94 602.28 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 279.18 597.48 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (M)Tj /F6 1 Tf 1.078 0 TD 0.0026 Tc (\)\))Tj /TT7 1 Tf 1.3069 0 TD 0 Tc (if)Tj /F5 1 Tf 0.8086 0 TD 0.0004 Tc [(,)-167.5(T)]TJ /F10 1 Tf 2.0416 0 TD 0 Tc ()Tj /F5 1 Tf 0.8913 0 TD (M)Tj /F23 1 Tf -9.5654 -1.1985 TD ()Tj /TT7 1 Tf 5.8238 0 TD (otherwise)Tj /F8 1 Tf -17.2725 -2.1681 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 149.22 568.7401 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /TT7 1 Tf 9.9626 0 0 9.9626 157.98 563.9401 Tm [(is)-252.9(e)18.1(xtended)-240.9(to)-252.9(set)-246.9(of)-246.9(messa)12(g)12(e)0(s)-246.9(a)0(s)-246.9(e)18.1(xpected:)]TJ /F8 1 Tf 17.2985 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 345.06 568.7401 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 351.36 563.9401 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (S)Tj /F6 1 Tf 0.6745 0 TD 0.2736 Tc (\)=)Tj /F22 1 Tf 1.7164 0.7528 TD 0 Tc ()Tj /F9 1 Tf 6.9739 0 0 6.9739 387.36 560.9401 Tm (t)Tj /F7 1 Tf 0.4302 0 TD ()Tj /F9 1 Tf 0.7658 0 TD (S)Tj /F8 1 Tf 9.9626 0 0 9.9626 403.2 563.9401 Tm -0.0306 Tc [(Pa)-31.8(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 417.66 568.7401 Tm 0 Tc ()Tj 0 -1.1099 TD (T)Tj /F6 1 Tf 9.9626 0 0 9.9626 423.96 563.9401 Tm (\()Tj /F5 1 Tf 0.3915 0 TD (t)Tj /F6 1 Tf 0.3614 0 TD (\))Tj /TT7 1 Tf 0.3854 0 TD (.)Tj /TT4 1 Tf -28.6671 -1.8369 TD [(The)-325.2(messages)-307.1(of)]TJ /F5 1 Tf 7.1221 0 TD ()Tj /TT4 1 Tf 0.9154 0 TD [(may)-325.2(contain)-319.2(some)-319.2(subterms)-319.2(of)-325.2(the)-319.2(form)]TJ /F10 1 Tf 16.6377 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (M)Tj /F10 1 Tf 1.078 0 TD (})Tj /F9 1 Tf 6.9739 0 0 6.9739 416.34 549.2401 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9981 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /TT4 1 Tf 9.9626 0 0 9.9626 437.52 545.64 Tm (where)Tj /F5 1 Tf 2.7621 0 TD (r)Tj /F10 1 Tf 0.8913 0 TD ()Tj /F8 1 Tf -34.0429 -1.1985 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 156.3 532.2001 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 169.5 533.7001 Tm 0 Tc [(.)-367.4(Because)-367.4(of)-373.4(the)-379.4(random)-373.4(coins)-373.4(such)-367.4(messages)-367.4(must)-373.4(ha)18.1(v)12(e)-367.4(been)-367.4(b)18.1(uild)-379.4(by)-373.4(the)]TJ -3.487 -1.2045 TD [(adv)12(ersary)-259(and)]TJ /F5 1 Tf 5.8485 0 TD (M)Tj /TT4 1 Tf 1.343 0 TD [(should)-265(be)-265(deducible.)-265(Thus)-265(we)-265(consider)]TJ /F5 1 Tf 15.8917 0 TD ()Tj /TT4 1 Tf 0.8672 0 TD [(augmented)-265(with)-265(such)-265(mes-)]TJ -23.9505 -1.1985 TD (sages:)Tj ET 162.48 518.28 5.94 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 162.4072 509.7601 Tm ()Tj /F6 1 Tf 1.0359 0 TD (=)Tj /F5 1 Tf 1.2166 0 TD ()Tj /F10 1 Tf 0.8853 0 TD 0.2849 Tc ({)Tj /F5 1 Tf 1.4514 0 TD 0 Tc (M)Tj /F10 1 Tf 1.5177 0 TD 0.4389 Tc (|{)Tj /F5 1 Tf 1.2166 0 TD 0 Tc (M)Tj /F10 1 Tf 1.078 0 TD (})Tj /F9 1 Tf 6.9739 0 0 6.9739 251.16 513.36 Tm (r)Tj /F11 1 Tf 0 -0.9722 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9981 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /TT4 1 Tf 9.9626 0 0 9.9626 271.62 509.7601 Tm [(subterm)-252.9(of)]TJ /F5 1 Tf 4.5606 0 TD ()Tj /F10 1 Tf 0.5962 0 TD (})Tj /TT4 1 Tf 0.4999 0 TD [(.)-331.2(F)12(or)-337.3(an)12(y)-337.3(v)24.1(alid)-337.3(message)-325.2(set)]TJ /F5 1 Tf 11.5384 0 TD ()Tj /TT4 1 Tf 0.9335 0 TD [(\(that)-337.3(is)]TJ /F5 1 Tf -31.8659 -1.4936 TD ()Tj /F10 1 Tf 0.8733 0 TD ()Tj /F8 1 Tf 0.9455 0 TD 0.0002 Tc (Msg)Tj /F9 1 Tf 6.9739 0 0 6.9739 170.52 499.3801 Tm 0 Tc (s)Tj /F6 1 Tf 9.9626 0 0 9.9626 174.78 494.8801 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.9094 0 TD (\))Tj /TT4 1 Tf 0.6384 0 TD [(for)-252.9(some)-252.9(protocol)]TJ /F5 1 Tf 7.3622 0 TD ()Tj /TT4 1 Tf 0.9094 0 TD [(\),)-252.9(we)-246.9(can)-246.9(sho)24.1(w)-246.9(that)]TJ /F5 1 Tf 7.9701 0 TD ()Tj /F10 1 Tf 0.8733 0 TD ()Tj /F5 1 Tf 0.8853 0 TD (M)Tj /TT4 1 Tf 1.331 0 TD [(for)-252.9(e)24.1(v)12(ery)]TJ /F5 1 Tf 3.8505 0 TD (M)Tj /F10 1 Tf 1.3551 0 TD ()Tj ET 448.02 503.46 5.94 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 447.9718 494.8801 Tm ()Tj /TT4 1 Tf 0.5962 0 TD (.)Tj /TT2 1 Tf -32.0349 -1.8369 TD (De)Tj /TT8 1 Tf 1.166 0 TD ()Tj /TT2 1 Tf 0.5562 0 TD [(nition)-259(3)-499.9(\(Nonce)-289.1(secr)18.1(ecy\).)]TJ /TT7 1 Tf 10.9983 0 TD (Let)Tj /F5 1 Tf 1.5729 0 TD ()Tj /TT7 1 Tf 1.1985 0 TD [(be)-289.1(a)-289.1(p)0(r)42.2(otocol)-289.1(and)]TJ /F5 1 Tf 7.4467 0 TD (X)Tj /F9 1 Tf 6.9739 0 0 6.9739 372.42 481.3801 Tm (j)Tj -0.1118 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 377.64 472.6201 Tm (i)Tj /TT7 1 Tf 9.9626 0 0 9.9626 384.12 476.5801 Tm [(a)-295.1(nonce)-283.1(variable)-289.1(occur)18.1(-)]TJ -25.0295 -1.4394 TD [(ring)-186.7(in)-192.7(some)-186.7(r)42.2(ole)]TJ /F5 1 Tf 6.8155 0 TD (A)Tj /F9 1 Tf 6.9739 0 0 6.9739 210.24 460.7401 Tm (i)Tj /TT7 1 Tf 9.9626 0 0 9.9626 213.54 462.2401 Tm [(.)-186.7(W)90.3(e)-192.7(say)-186.7(that)]TJ /F5 1 Tf 5.078 0 TD (X)Tj /F9 1 Tf 6.9739 0 0 6.9739 273.24 467.0401 Tm (j)Tj -0.1118 -1.1099 TD (A)Tj /F12 1 Tf 4.9813 0 0 4.9813 278.46 458.2801 Tm (i)Tj /TT7 1 Tf 9.9626 0 0 9.9626 283.98 462.2401 Tm [(is)-192.7(secr)36.1(et)-180.7(in)]TJ /F5 1 Tf 4.3565 0 TD ()Tj /TT7 1 Tf 1.1021 0 TD [(and)-192.7(we)-186.7(write)]TJ /F5 1 Tf 5.2326 0 TD ()Tj /F10 1 Tf 1.1925 0 TD (|)Tj /F6 1 Tf 0.1084 0 TD (=)Tj /F9 1 Tf 6.9739 0 0 6.9739 411.36 465.8401 Tm (s)Tj /F8 1 Tf 9.9626 0 0 9.9626 418.38 462.2401 Tm 0.0009 Tc (SecNonce)Tj /F6 1 Tf 4.0592 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD -0.0012 Tc [(i,)-169.1(j)]TJ /F6 1 Tf 1.2587 0 TD 0 Tc (\))Tj /TT7 1 Tf 0.3915 0 TD (,)Tj -34.5692 -1.1985 TD [(if)-277(for)-277(e)12(very)-259(valid)-277(set)-271(of)-277(messa)12(g)12(e)0(s)]TJ /F5 1 Tf 13.4257 0 TD ()Tj /F10 1 Tf 0.9154 0 TD ()Tj /F8 1 Tf 0.9937 0 TD 0.0002 Tc (Msg)Tj /F9 1 Tf 6.9739 0 0 6.9739 305.4 454.7401 Tm 0 Tc (s)Tj /F6 1 Tf 9.9626 0 0 9.9626 309.66 450.3 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ()Tj /F6 1 Tf 0.9094 0 TD (\))Tj /TT7 1 Tf 0.6685 0 TD [(it)-277(holds)-271(that)-277(for)-277(e)12(very)-259(session)-271(number)]TJ /F5 1 Tf -19.525 -1.1985 TD (s)Tj /TT7 1 Tf 0.4698 0 TD [(,)-246.9(the)-246.9(symbolic)-246.9(nonce)]TJ /F5 1 Tf 8.4018 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 229.26 441.9601 Tm (a)Tj /F12 1 Tf 4.9813 0 0 4.9813 233.58 440.9401 Tm (i)Tj /F9 1 Tf 6.9739 0 0 6.9739 236.7 441.9601 Tm -0.0027 Tc (,j,s)Tj /TT7 1 Tf 9.9626 0 0 9.9626 251.46 438.36 Tm 0 Tc [(does)-246.9(not)-252.9(occur)-240.9(in)]TJ /F8 1 Tf 7.1592 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 337.32 436.08 Tm 0 Tc (n)Tj /F12 1 Tf 4.9813 0 0 4.9813 342.24 438.4801 Tm (a)Tj 0.7709 -0.3252 TD (i)Tj 0.6384 0.3252 TD -0.0007 Tc [(,j)9.4(,s)]TJ /F6 1 Tf 9.9626 0 0 9.9626 361.08 438.36 Tm 0 Tc (\()Tj ET 364.98 446.88 5.94 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 364.98 438.36 Tm ()Tj /F6 1 Tf 0.5902 0 TD (\))Tj /TT7 1 Tf 0.3915 0 TD (.)Tj /TT4 1 Tf -24.09 -1.8429 TD [(T)78.3(o)-252.9(better)-246.9(appreciate)-246.9(these)-246.9(de)]TJ /TT5 1 Tf 11.4091 0 TD ()Tj /TT4 1 Tf 0.5562 0 TD [(nitions,)-246.9(consider)-246.9(the)-252.9(follo)24.1(wing)-252.9(e)12(xamples.)]TJ -11.5135 -1.7405 TD [(1.)-493.8(Let)]TJ /F5 1 Tf 2.8594 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 173.7 401.1601 Tm (1)Tj /F6 1 Tf 9.9626 0 0 9.9626 181.44 402.6601 Tm (=)Tj /F10 1 Tf 1.1082 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 217.02 401.1601 Tm (b)Tj /F5 1 Tf 9.9626 0 0 9.9626 220.92 402.6601 Tm 0.1679 Tc (,n)Tj /F7 1 Tf 6.9739 0 0 6.9739 231.36 406.3201 Tm 0 Tc ()Tj /F10 1 Tf 9.9626 0 0 9.9626 234.12 402.6601 Tm ()Tj /F6 1 Tf 0.3915 0 TD (\))Tj /F10 1 Tf 0.3915 0 TD (})Tj /F6 1 Tf 0.8251 0 TD (=)Tj ET 261.12 411.24 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 261.1202 402.6601 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 267.06 401.1601 Tm (1)Tj /TT4 1 Tf 9.9626 0 0 9.9626 271.56 402.6601 Tm [(.)-277(Then)]TJ /F8 1 Tf 2.8588 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 314.52 401.1601 Tm 0 Tc (n)Tj /F12 1 Tf 4.9813 0 0 4.9813 319.44 400.08 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 323.58 402.6601 Tm (\()Tj ET 327.48 411.24 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 327.48 402.6601 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 333.42 401.1601 Tm (1)Tj /F6 1 Tf 9.9626 0 0 9.9626 337.86 402.6601 Tm 0.3338 Tc (\)=)Tj /F10 1 Tf 1.8248 0 TD 0 Tc ({)Tj /F23 1 Tf 0.4999 0 TD ()Tj /F10 1 Tf 0.7769 0 TD (})Tj /TT4 1 Tf 0.4999 0 TD (.)Tj /F5 1 Tf 0.527 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 384.96 401.1601 Tm (1)Tj /TT4 1 Tf 9.9626 0 0 9.9626 392.22 402.6601 Tm [(preserv)12(es)-265(the)-277(indistin-)]TJ -24.1442 -1.1985 TD [(guishability)-252.9(of)]TJ /F5 1 Tf 6.0611 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 218.04 389.2201 Tm (b)Tj /TT4 1 Tf 9.9626 0 0 9.9626 224.52 390.7201 Tm [(since,)-240.9(intuiti)24.1(v)12(ely)66.2(,)]TJ /F5 1 Tf 7.051 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 300.84 389.2201 Tm (b)Tj /TT4 1 Tf 9.9626 0 0 9.9626 307.32 390.7201 Tm [(is)-246.9(hidden)-252.9(by)-252.9(the)-246.9(secret)-246.9(nonce)]TJ /F5 1 Tf 11.8232 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 431.22 394.3201 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 433.98 390.7201 Tm (.)Tj -29.5825 -1.1443 TD [(2.)-493.8(Let)]TJ /F5 1 Tf 3.0281 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 175.38 377.8201 Tm (2)Tj /F6 1 Tf 9.9626 0 0 9.9626 186.3 379.3201 Tm (=)Tj /F10 1 Tf 1.4273 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 225.06 377.8201 Tm (b)Tj /F5 1 Tf 9.9626 0 0 9.9626 228.96 379.3201 Tm (,)Tj /F10 1 Tf 0.4457 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 244.38 382.92 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 247.14 379.3201 Tm (})Tj /F9 1 Tf 6.9739 0 0 6.9739 252.12 382.92 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 270.06 379.3201 Tm ()Tj /F6 1 Tf 0.3915 0 TD (\))Tj /F5 1 Tf 0.3915 0 TD 0.1679 Tc (,n)Tj /F7 1 Tf 6.9739 0 0 6.9739 288.3 382.92 Tm 0 Tc ()Tj /F10 1 Tf 9.9626 0 0 9.9626 291.06 379.3201 Tm (})Tj /TT4 1 Tf 0.9455 0 TD (where)Tj /F5 1 Tf 2.8946 0 TD (r)Tj /F10 1 Tf 1.1262 0 TD ()Tj T* ()Tj /F8 1 Tf 1.3129 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 375.12 377.8201 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 388.32 379.3201 Tm 0 Tc [(.)-451.7(Then)]TJ ET 420.24 387.84 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 420.2208 379.3201 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 426.18 377.8201 Tm (2)Tj /F6 1 Tf 9.9626 0 0 9.9626 437.1 379.3201 Tm (=)Tj /F5 1 Tf 1.4273 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 457.26 377.8201 Tm (2)Tj /TT4 1 Tf 9.9626 0 0 9.9626 466.2 379.3201 Tm (and)Tj /F8 1 Tf -31.5699 -1.4936 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 166.2 362.9401 Tm 0 Tc (n)Tj /F12 1 Tf 4.9813 0 0 4.9813 171.12 361.86 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 175.26 364.4401 Tm (\()Tj ET 179.16 372.96 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 179.16 364.4401 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 185.1 362.9401 Tm (2)Tj /F6 1 Tf 9.9626 0 0 9.9626 189.54 364.4401 Tm 0.2796 Tc (\)=)Tj /F10 1 Tf 1.7225 0 TD 0 Tc ({)Tj /F23 1 Tf 0.4999 0 TD ()Tj /F5 1 Tf 0.7769 0 TD 0.1679 Tc (,n)Tj /F7 1 Tf 6.9739 0 0 6.9739 229.86 368.0401 Tm 0 Tc ()Tj /F10 1 Tf 9.9626 0 0 9.9626 232.62 364.4401 Tm (})Tj /TT4 1 Tf 0.4999 0 TD [(.)-246.9(I)0(n)-252.9(this)-246.9(e)12(xample,)-240.9(the)-252.9(encryption)-246.9(of)]TJ /F5 1 Tf 14.2246 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 385.38 368.0401 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 390.66 364.4401 Tm [(does)-246.9(hide)]TJ /F5 1 Tf 4.0485 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 437.04 362.9401 Tm (b)Tj /TT4 1 Tf 9.9626 0 0 9.9626 441.06 364.4401 Tm (.)Tj -30.2932 -1.1503 TD [(3.)-493.8(Let)]TJ /F5 1 Tf 2.9257 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 174.36 351.48 Tm (3)Tj /F6 1 Tf 9.9626 0 0 9.9626 183.3 352.98 Tm (=)Tj /F10 1 Tf 1.2286 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 220.08 351.48 Tm (b)Tj /F5 1 Tf 9.9626 0 0 9.9626 224.04 352.98 Tm (,)Tj /F10 1 Tf 0.4457 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 239.46 356.64 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 242.22 352.98 Tm (})Tj /F9 1 Tf 6.9739 0 0 6.9739 247.2 356.64 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 265.14 352.98 Tm ()Tj /F6 1 Tf 0.3915 0 TD (\))Tj /F10 1 Tf 0.3915 0 TD (})Tj /TT4 1 Tf 0.8371 0 TD (where)Tj /F5 1 Tf 2.7862 0 TD (r)Tj /F10 1 Tf 0.9335 0 TD ()Tj /F8 1 Tf 1.1142 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 351 351.48 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 364.2 352.98 Tm 0 Tc [(.)-343.3(Then)]TJ ET 394.02 361.56 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 394.0007 352.98 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 399.96 351.48 Tm (3)Tj /F6 1 Tf 9.9626 0 0 9.9626 408.9 352.98 Tm (=)Tj /F5 1 Tf 1.2346 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 427.14 351.48 Tm (3)Tj /F10 1 Tf 9.9626 0 0 9.9626 434.52 352.98 Tm 0.2909 Tc ({)Tj /F5 1 Tf 1.4575 0 TD 0 Tc (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 455.04 356.64 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 457.8 352.98 Tm (})Tj /TT4 1 Tf 0.8431 0 TD (and)Tj /F8 1 Tf -31.5699 -1.4876 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 166.2 336.6601 Tm 0 Tc (n)Tj /F12 1 Tf 4.9813 0 0 4.9813 171.12 335.58 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 175.26 338.1601 Tm (\()Tj ET 179.16 346.68 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 179.16 338.1601 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 185.1 336.6601 Tm (3)Tj /F6 1 Tf 9.9626 0 0 9.9626 189.54 338.1601 Tm 0.3398 Tc (\)=)Tj /F10 1 Tf 1.8429 0 TD 0 Tc ({)Tj /F5 1 Tf 0.4999 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 232.44 336.6601 Tm (b)Tj /F5 1 Tf 9.9626 0 0 9.9626 236.4 338.1601 Tm (,)Tj /F10 1 Tf 0.4457 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 251.82 341.7601 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 254.58 338.1601 Tm (})Tj /F9 1 Tf 6.9739 0 0 6.9739 259.56 341.7601 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 277.5 338.1601 Tm ()Tj /F6 1 Tf 0.3915 0 TD (\))Tj /F5 1 Tf 0.3915 0 TD 0.1679 Tc (,n)Tj /F7 1 Tf 6.9739 0 0 6.9739 295.74 341.7601 Tm 0 Tc ()Tj /F10 1 Tf 9.9626 0 0 9.9626 298.44 338.1601 Tm (})Tj /TT4 1 Tf 0.4999 0 TD [(.)-283.1(W)78.3(e)-277(h)0(a)18.1(v)12(e)-277(that)]TJ /F5 1 Tf 6.0367 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 369.66 336.6601 Tm (b)Tj /TT4 1 Tf 9.9626 0 0 9.9626 376.44 338.1601 Tm [(occurs)-283.1(in)]TJ /F8 1 Tf 3.9538 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 430.32 336.6601 Tm 0 Tc (n)Tj /F12 1 Tf 4.9813 0 0 4.9813 435.24 335.58 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 439.38 338.1601 Tm (\()Tj ET 443.28 346.68 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 443.28 338.1601 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 449.22 336.6601 Tm (3)Tj /F6 1 Tf 9.9626 0 0 9.9626 453.66 338.1601 Tm (\))Tj /TT4 1 Tf 0.3915 0 TD [(.)-283.1(This)]TJ -30.7027 -1.349 TD [(corresponds)-222.8(indeed)-222.8(to)-222.8(an)-222.8(attack.)-216.8(As)]TJ /F5 1 Tf 14.2927 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 300.24 328.3201 Tm ()Tj /TT4 1 Tf 9.9626 0 0 9.9626 305.28 324.7201 Tm [(has)-216.8(been)-222.8(encrypted)-222.8(by)-222.8(the)-222.8(adv)12(ersary)-216.8(himself)]TJ -15.4176 -1.2045 TD [(he)-228.9(kno)24.1(ws)-228.9(the)-234.9(cipherte)12(xt.)-222.8(Gi)24.1(v)12(e)0(n)]TJ /F5 1 Tf 12.5347 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 282.66 311.2201 Tm (0)Tj /TT4 1 Tf 9.9626 0 0 9.9626 289.44 312.7201 Tm (and)Tj /F5 1 Tf 1.6727 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 312.12 311.2201 Tm (1)Tj /TT4 1 Tf 9.9626 0 0 9.9626 318.9 312.7201 Tm [(he)-228.9(computes)-228.9(both)]TJ /F5 1 Tf 7.2408 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 410.64 311.2201 Tm (0)Tj /F5 1 Tf 9.9626 0 0 9.9626 415.02 312.7201 Tm (,)Tj /F10 1 Tf 0.4457 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 430.44 316.3801 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 433.2 312.7201 Tm (})Tj /F9 1 Tf 6.9739 0 0 6.9739 438.18 316.3801 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 456.18 312.7201 Tm ()Tj /F6 1 Tf 0.3915 0 TD (\))Tj /TT4 1 Tf 0.6143 0 TD (and)Tj /F5 1 Tf -31.57 -1.349 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 171.24 297.7801 Tm (1)Tj /F5 1 Tf 9.9626 0 0 9.9626 175.62 299.2801 Tm (,)Tj /F10 1 Tf 0.4457 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 191.04 302.9401 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 193.8 299.2801 Tm (})Tj /F9 1 Tf 6.9739 0 0 6.9739 198.78 302.9401 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9981 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F10 1 Tf 9.9626 0 0 9.9626 216.78 299.2801 Tm ()Tj /F6 1 Tf 0.3915 0 TD (\))Tj /TT4 1 Tf 0.6324 0 TD [(and)-252.9(compares)-240.9(them)-252.9(to)]TJ /F5 1 Tf 9.0525 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F10 1 Tf 0.3915 0 TD ()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 336.78 297.7801 Tm (b)Tj /F5 1 Tf 9.9626 0 0 9.9626 340.68 299.2801 Tm (,)Tj /F10 1 Tf 0.4457 0 TD ({)Tj /F5 1 Tf 0.4999 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 356.1 302.9401 Tm ()Tj /F10 1 Tf 9.9626 0 0 9.9626 358.86 299.2801 Tm (})Tj /F9 1 Tf 6.9739 0 0 6.9739 363.84 302.9401 Tm (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F6 1 Tf 9.9626 0 0 9.9626 381.78 299.2801 Tm (\))Tj /TT4 1 Tf 0.6384 0 TD [(yielding)-252.9(the)-252.9(attack.)]TJ -24.9813 -1.4394 TD [(4.)-493.8(Let)]TJ /F5 1 Tf 2.8654 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 173.76 283.4401 Tm (4)Tj /F6 1 Tf 9.9626 0 0 9.9626 181.68 284.9401 Tm (=)Tj /F10 1 Tf 1.1262 0 TD -0.0001 Tc ({{)Tj /F5 1 Tf 1.3912 0 TD 0 Tc (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 222.42 283.4401 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 226.32 284.9401 Tm (\))Tj /F5 1 Tf 0.3915 0 TD 0.1679 Tc (,h)Tj /F6 1 Tf 1.0238 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 250.32 288.6 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 253.02 284.9401 Tm (\))Tj /F10 1 Tf 0.3915 0 TD 0.0026 Tc (})Tj /F9 1 Tf 6.9739 0 0 6.9739 265.8 288.6 Tm 0 Tc (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9809 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F5 1 Tf 9.9626 0 0 9.9626 283.68 284.9401 Tm (,)Tj /F8 1 Tf 0.4457 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 1.0058 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD (\))Tj /F10 1 Tf 0.3915 0 TD (})Tj /TT4 1 Tf 0.7829 0 TD (where)Tj /F5 1 Tf 2.7259 0 TD (r)Tj /F10 1 Tf 0.8251 0 TD ()Tj T* ()Tj /F8 1 Tf 1.0118 0 TD 0.0006 Tc (Rand)Tj /F9 1 Tf 6.9739 0 0 6.9739 386.04 283.4401 Tm -0.0006 Tc (adv)Tj /TT4 1 Tf 9.9626 0 0 9.9626 399.24 284.9401 Tm 0 Tc [(.)-283.1(Then)]TJ ET 427.92 293.52 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 427.9008 284.9401 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 433.86 283.4401 Tm (4)Tj /F6 1 Tf 9.9626 0 0 9.9626 441.72 284.9401 Tm (=)Tj /F5 1 Tf 1.1262 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 458.88 283.4401 Tm (4)Tj /TT4 1 Tf 9.9626 0 0 9.9626 466.2 284.9401 Tm (and)Tj /F8 1 Tf -31.5699 -1.4876 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 166.2 268.6201 Tm 0 Tc (n)Tj /F12 1 Tf 4.9813 0 0 4.9813 171.12 267.5401 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 175.26 270.1201 Tm (\()Tj ET 179.16 278.64 10.44 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 179.16 270.1201 Tm ()Tj /F2 1 Tf 6.9739 0 0 6.9739 185.1 268.6201 Tm (4)Tj /F6 1 Tf 9.9626 0 0 9.9626 189.54 270.1201 Tm 0.3218 Tc (\)=)Tj /F10 1 Tf 1.8068 0 TD -0.0001 Tc ({{)Tj /F5 1 Tf 1.3912 0 TD 0 Tc (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 237.06 268.6201 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 240.96 270.1201 Tm (\))Tj /F5 1 Tf 0.3915 0 TD (,)Tj /F23 1 Tf 0.4457 0 TD ()Tj /F10 1 Tf 0.7769 0 TD 0.0026 Tc (})Tj /F9 1 Tf 6.9739 0 0 6.9739 265.92 273.7201 Tm 0 Tc (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9809 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /F5 1 Tf 9.9626 0 0 9.9626 283.86 270.1201 Tm (,)Tj /F8 1 Tf 0.4457 0 TD 0.0013 Tc (dk)Tj /F6 1 Tf 0.9997 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (a)Tj /F6 1 Tf 0.53 0 TD (\))Tj /F10 1 Tf 0.3915 0 TD (})Tj /TT4 1 Tf 0.4999 0 TD [(.)-265(A)0(g)6(ain,)]TJ /F5 1 Tf 3.4738 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 357 268.6201 Tm (b)Tj /TT4 1 Tf 9.9626 0 0 9.9626 363.72 270.1201 Tm [(does)-265(occur)-271(in)]TJ /F8 1 Tf 5.6446 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 434.46 268.6201 Tm 0 Tc (n)Tj /F12 1 Tf 4.9813 0 0 4.9813 439.38 267.5401 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 443.52 270.1201 Tm (\()Tj /F5 1 Tf 0.3915 0 TD ()Tj /F2 1 Tf 6.9739 0 0 6.9739 453.36 268.6201 Tm (1)Tj /F6 1 Tf 9.9626 0 0 9.9626 457.8 270.1201 Tm (\))Tj /TT4 1 Tf 0.3915 0 TD 0.271 Tc [(.F)283(o)271(r)]TJ -31.1183 -1.349 TD 0 Tc [(this)-367.4(attack)-361.4(an)-367.4(intruder)-367.4(may)-361.4(get)]TJ /F5 1 Tf 13.077 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 297.66 255.1801 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 301.62 256.6801 Tm (\))Tj /TT4 1 Tf 0.7528 0 TD [(by)-367.4(decrypting)-361.4(and)-367.4(projecting)-367.4(the)-361.4(message)]TJ /F10 1 Tf -15.803 -1.1985 TD -0.0001 Tc ({)Tj /F5 1 Tf 0.8913 0 TD 0 Tc (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 176.22 243.2401 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 180.18 244.7401 Tm (\))Tj /F5 1 Tf 0.3915 0 TD 0.1679 Tc (,h)Tj /F6 1 Tf 1.0238 0 TD 0 Tc (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F7 1 Tf 6.9739 0 0 6.9739 204.18 248.3401 Tm ()Tj /F6 1 Tf 9.9626 0 0 9.9626 206.82 244.7401 Tm (\))Tj /F10 1 Tf 0.3915 0 TD 0.0026 Tc (})Tj /F9 1 Tf 6.9739 0 0 6.9739 219.6 248.3401 Tm 0 Tc (r)Tj /F11 1 Tf 0 -0.9808 TD 0.001 Tc (ek)Tj /F2 1 Tf 0.9895 0 TD 0 Tc (\()Tj /F9 1 Tf 0.4474 0 TD (a)Tj /F2 1 Tf 0.6195 0 TD (\))Tj /TT4 1 Tf 9.9626 0 0 9.9626 240.18 244.7401 Tm [(and)-259(compare)]TJ /F5 1 Tf 5.4102 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F9 1 Tf 6.9739 0 0 6.9739 309.78 243.2401 Tm (b)Tj /F6 1 Tf 9.9626 0 0 9.9626 313.74 244.7401 Tm (\))Tj /TT4 1 Tf 0.6504 0 TD (with)Tj /F5 1 Tf 2.0428 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 356.22 243.2401 Tm (0)Tj /F6 1 Tf 9.9626 0 0 9.9626 360.6 244.7401 Tm (\))Tj /TT4 1 Tf 0.6565 0 TD (and)Tj /F5 1 Tf 1.7088 0 TD (h)Tj /F6 1 Tf 0.5782 0 TD (\()Tj /F5 1 Tf 0.3915 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 399.84 243.2401 Tm (1)Tj /F6 1 Tf 9.9626 0 0 9.9626 404.22 244.7401 Tm (\))Tj /TT4 1 Tf 0.6504 0 TD [(that)-265(he)-265(may)-265(com-)]TJ -25.9991 -1.1985 TD [(pute)-252.9(from)]TJ /F5 1 Tf 4.1714 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 199.2 231.3001 Tm (0)Tj /TT4 1 Tf 9.9626 0 0 9.9626 206.16 232.8001 Tm (and)Tj /F5 1 Tf 1.6908 0 TD (n)Tj /F2 1 Tf 6.9739 0 0 6.9739 229.02 231.3001 Tm (1)Tj /TT4 1 Tf 9.9626 0 0 9.9626 233.46 232.8001 Tm (.)Tj -8.4074 -1.7947 TD [(Our)-289.1(notion)-295.1(of)-289.1(secrec)12(y)-283.1(has)-283.1(a)-289.1(useful)-289.1(equi)24.1(v)24.1(alent)-283.1(formulation)-301.1(described)-283.1(in)-289.1(the)-289.1(follo)24.1(w-)]TJ -1.4996 -1.1985 TD [(ing)-271(lemma.)-265(Informally)66.2(,)-277(the)-265(lemma)-271(states)-265(that)-265(all)-271(unencrypted)-271(occurrences)-259(of)-271(the)-271(secret)]TJ T* [(nonce)-259(in)-265(a)-265(set)-259(of)-265(messages)-252.9(are)-265(such)-259(that)-265(the)12(y)-259(occur)-265(in)-265(a)-259(term)]TJ /F5 1 Tf 24.5355 0 TD (t)Tj /TT4 1 Tf 0.6263 0 TD [(that)-265(is)-265(hashed,)-252.9(and)-259(such)]TJ -25.1619 -1.2045 TD (that)Tj /F5 1 Tf 1.7525 0 TD (t)Tj /TT4 1 Tf 0.6083 0 TD [(itself)-252.9(can)-246.9(not)-246.9(be)-252.9(computed)-246.9(from)]TJ /F5 1 Tf 12.9957 0 TD ()Tj /TT4 1 Tf 0.8492 0 TD (and)Tj /F5 1 Tf 1.6908 0 TD (n)Tj /TT4 1 Tf 0.6023 0 TD (.)Tj -1.3947 -2.9992 TD (7)Tj ET endstream endobj 52 0 obj << /ProcSet [/PDF /Text ] /Font << /F2 5 0 R /F5 16 0 R /F6 17 0 R /F7 18 0 R /F8 23 0 R /F9 24 0 R /F10 25 0 R /F11 26 0 R /F12 27 0 R /F22 46 0 R /F23 47 0 R /TT2 8 0 R /TT4 9 0 R /TT5 10 0 R /TT7 19 0 R /TT8 48 0 R /TT9 49 0 R >> /ExtGState << /GS1 11 0 R >> >> endobj 54 0 obj << /Length 24856 >> stream BT /TT2 1 Tf 9.9626 0 0 9.9626 134.76 716.16 Tm 0 g /GS1 gs 0 Tc 0 Tw [(Lemma)-252.9(1.)]TJ /TT7 1 Tf 4.7736 0 TD (Let)Tj /F5 1 Tf 1.5488 0 TD ()Tj /TT7 1 Tf 0.8612 0 TD [(be)-265(an)-271(arbitr)12(ary)-252.9(set)-265(of)-271(messa)12(g)12(e)0(s)-259(and)]TJ /F5 1 Tf 14.5896 0 TD (n)Tj /TT7 1 Tf 0.8733 0 TD [(a)-265(nonce)-265(symbol)-265(that)-265(occur)12(s)-265(i)0(n)]TJ /F5 1 Tf -22.6466 -1.1985 TD ()Tj /TT7 1 Tf 0.5962 0 TD (.)Tj /F5 1 Tf 0.5632 0 TD (n)Tj /TT7 1 Tf 0.9154 0 TD [(does)-313.2(not)-319.2(occur)-307.1(in)]TJ /F8 1 Tf 7.4242 0 TD -0.0306 Tc [(Pa)-31.9(t)]TJ /F9 1 Tf 6.9739 0 0 6.9739 243.96 702.72 Tm 0 Tc (n)Tj /F6 1 Tf 9.9626 0 0 9.9626 249.36 704.22 Tm (\()Tj ET 253.26 712.74 5.94 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 253.26 704.22 Tm ()Tj /F6 1 Tf 0.5962 0 TD (\))Tj /TT7 1 Tf 0.7046 0 TD [(if)-319.2(and)-313.2(only)-313.2(if)]TJ ET 321.96 712.74 5.94 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 321.9884 704.22 Tm ()Tj /F10 1 Tf 0.9937 0 TD ()Tj T* ()Tj /F5 1 Tf 1.0118 0 TD (n)Tj /TT7 1 Tf 0.9154 0 TD (and)Tj /F10 1 Tf 1.8192 0 TD (\012)Tj /F5 1 Tf 0.5541 0 TD (M)Tj /TT7 1 Tf 1.3972 0 TD [(subterm)-307.1(of)]TJ /F5 1 Tf 4.6263 0 TD ()Tj /TT7 1 Tf 0.9094 0 TD [(suc)12(h)-307.1(that)]TJ ET 134.76 700.8 5.94 -0.42 re f BT /F5 1 Tf 9.9626 0 0 9.9626 134.76 692.28 Tm ()Tj /F10 1 Tf 0.9636 0 TD ()Tj /F5 1 Tf 0.9817 0 TD (M)Tj /TT7 1 Tf 1.078 0 TD (,)Tj /F10 1 Tf 0.5511 0 TD (\012)Tj /F5 1 Tf 0.5541 0 TD (p)Tj /TT7 1 Tf 0.807 0 TD [(suc)12(h)-289.1(that)]TJ /F5 1 Tf 3.9668 0 TD (M)Tj /F10 1 Tf 1.078 0 TD (|)Tj /F9 1 Tf 6.9739 0 0 6.9739 237 690.78 Tm (p)Tj /F6 1 Tf 9.9626 0 0 9.9626 245.34 692.28 Tm (=)Tj /F5 1 Tf 1.1503 0 TD (n)Tj /TT7 1 Tf 0.6023 0 TD [(,)-289.1(s)0(o)-301.1(that)-301.1(ther)36.1(e)-295.1(i)0(s)-295.1(n)0(o)-301.1(encryption)-295.1(along)]TJ /F5 1 Tf 15.3135 0 TD (p)Tj /TT7 1 Tf 0.5059 0 TD (,)Tj /F10 1 Tf 0.5451 0 TD ()Tj /F5 1 Tf 0.5541 0 TD (p)Tj /F7 1 Tf 6.9739 0 0 6.9739 436.56 695.88 Tm ()Tj /F5 1 Tf 9.9626 0 0 9.9626 443.04 692.28 Tm 0.3725 Tc (
>
/ExtGState <<
/GS1 11 0 R
>>
>>
endobj
57 0 obj
<<
/Length 15313
>>
stream
BT
/TT2 1 Tf
9.9626 0 0 9.9626 134.76 716.16 Tm
0 g
/GS1 gs
0 Tc
0 Tw
[(Theor)18.1(em)-246.9(1.)]TJ
/TT7 1 Tf
5.3664 0 TD
(Let)Tj
/F5 1 Tf
1.5488 0 TD
()Tj
/TT7 1 Tf
1.1864 0 TD
[(be)-271(an)-277(e)18.1(xecutable)-265(pr)42.2(otocol)-271(and)-271(let)]TJ
/F5 1 Tf
13.6788 0 TD
(X)Tj
/F9 1 Tf
6.9739 0 0 6.9739 360.96 720.9601 Tm
(j)Tj
-0.1118 -1.1013 TD
(A)Tj
/F12 1 Tf
4.9813 0 0 4.9813 366.18 712.26 Tm
(i)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 372.48 716.16 Tm
[(be)-277(a)-271(nonce)-271(variable)-271(occur)18.1(-)]TJ
-23.8611 -1.1985 TD
[(ring)-277(in)-277(some)-277(r)42.2(ole)]TJ
/F5 1 Tf
7.1708 0 TD
(A)Tj
/F9 1 Tf
6.9739 0 0 6.9739 213.78 702.72 Tm
(i)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 217.08 704.22 Tm
[(.)-271(I)0(f)-283.1(the)-277(encryption)-271(sc)12(heme)]TJ
/F10 1 Tf
10.6628 0 TD
0.0025 Tc
(AE)Tj
/TT7 1 Tf
1.6923 0 TD
0 Tc
[(used)-271(in)-283.1(the)-277(implementation)-277(of)]TJ
/F5 1 Tf
12.2167 0 TD
()Tj
/TT7 1 Tf
1.1925 0 TD
(is)Tj
/F8 1 Tf
-34.0272 -1.1985 TD
0.0008 Tc
(IND)Tj
/TT7 1 Tf
1.7104 0 TD
0 Tc
(-)Tj
/F8 1 Tf
0.333 0 TD
-0.0005 Tc
(CCA)Tj
/TT7 1 Tf
2.1922 0 TD
0 Tc
[(secur)36.1(e)-240.9(then)]TJ
/F5 1 Tf
4.7893 0 TD
()Tj
/F10 1 Tf
1.1864 0 TD
(|)Tj
/F6 1 Tf
0.1084 0 TD
(=)Tj
/F9 1 Tf
6.9739 0 0 6.9739 245.4 695.88 Tm
(s)Tj
/F8 1 Tf
9.9626 0 0 9.9626 252.48 692.28 Tm
0.0009 Tc
(SecNonce)Tj
/F6 1 Tf
4.0592 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0 Tc
(\))Tj
/TT7 1 Tf
0.6324 0 TD
[(if)-252.9(and)-252.9(only)-246.9(if)]TJ
/F5 1 Tf
5.3388 0 TD
()Tj
/F10 1 Tf
1.1925 0 TD
(|)Tj
/F6 1 Tf
0.1084 0 TD
(=)Tj
/F11 1 Tf
6.9739 0 0 6.9739 389.52 695.88 Tm
(c)Tj
/F8 1 Tf
9.9626 0 0 9.9626 396.12 692.28 Tm
0.0009 Tc
(SecNonce)Tj
/F6 1 Tf
4.0532 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0 Tc
(\))Tj
/TT7 1 Tf
0.3915 0 TD
(.)Tj
-32.3289 -2.1139 TD
[(Pr)42.2(oof)12(.)]TJ
/TT2 1 Tf
2.9675 0 TD
[(The)-325.2(if)-54.2()-337.3(dir)18.1(ection.)]TJ
/TT4 1 Tf
8.3842 0 TD
[(First,)-331.2(we)-325.2(gi)24.1(v)12(e)-325.2(an)-331.2(ideal)-325.2(e)12(x)12(ecution)-325.2(of)-331.2(the)-325.2(protocols)-331.2(that)-331.2(re-)]TJ
-11.3517 -1.1985 TD
[(places)-259(real)-259(nonces)-259(with)-265(random)-265(strings.)-259(W)78.3(e)-259(sho)24.1(w)-259(that)-265(no)-265(adv)12(ersary)-252.9(can)-259(distinguish)-265(the)]TJ
T*
(modi)Tj
/TT5 1 Tf
2.0557 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(ed)-252.9(e)12(x)12(ecution,)-240.9(which)-246.9(we)-246.9(call)-246.9(the)-252.9(oracle)-246.9(e)12(x)12(ecution)-234.9(from)-259(the)-246.9(real)-252.9(e)12(x)12(ecution.)]TJ
-1.1122 -1.2045 TD
[(Ne)12(xt,)-252.9(we)-259(ar)18.1(gue)-259(that)-265(in)-259(the)-265(oracle)-259(e)12(x)12(ecution,)-246.9(nonces)-259(that)-259(are)-259(symbolically)-265(secret)-252.9(are)]TJ
-1.4996 -1.1985 TD
[(information)-259(theoretically)-252.9(hidden)-252.9(from)-252.9(the)-252.9(computational)-252.9(adv)12(ersary)66.2(.)-246.9(Indeed,)-246.9(if)-252.9(the)-252.9(sym-)]TJ
T*
[(bolic)-283.1(secrec)12(y)-271(property)-283.1(is)-277(satis)]TJ
/TT5 1 Tf
11.9317 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(ed,)-271(by)-283.1(Lemma)-283.1(1)-283.1(the)-277(nonce)-277(occurs)-277(only)-283.1(in)-283.1(some)-277(hashed)]TJ
-12.4879 -1.2045 TD
[(terms,)-228.9(and)-228.9(the)-234.9(term)-228.9(themselv)12(es)-222.8(are)-228.9(secret)-228.9(\(i.e.,)-222.8(it)-234.9(cannot)-228.9(be)-228.9(computed)-234.9(ef)]TJ
/TT5 1 Tf
28.3714 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(ciently\).)-228.9(Since)]TJ
-28.9276 -1.1985 TD
[(in)-240.9(the)-234.9(random)-240.9(oracle)-234.9(model)-240.9(the)-234.9(hash)-234.9(v)24.1(alues)-228.9(are)-240.9(independent)-234.9(of)-234.9(the)-240.9(hashed)-228.9(message,)-228.9(the)]TJ
T*
[(vie)24.1(w)-246.9(o)0(f)-252.9(the)-246.9(adv)12(ersary)-246.9(is)-246.9(independent)-246.9(from)-259(the)-246.9(v)24.1(alue)-246.9(of)-252.9(the)-246.9(secret)-246.9(nonces.)]TJ
0.0241 -1.4876 TD
(S)Tj
7.9701 0 0 7.9701 141.0207 560.7601 Tm
0.0602 Tc
(TEP)Tj
9.9626 0 0 9.9626 158.7902 560.7601 Tm
0 Tc
[(I)-48.2(.)-240.9(W)78.3(e)-204.8(no)24.1(w)-204.8(describe)-210.8(the)-204.8(oracle)-210.8(e)12(x)12(ecution.)-192.7(Whene)24.1(v)12(e)0(r)-204.8(the)-210.8(protocol)-210.8(dictates)-204.8(that)-210.8(an)]TJ
-2.412 -1.1985 TD
[(honest)-252.9(party)-259(encrypts)-259(some)-252.9(bitstring)]TJ
/F5 1 Tf
14.7804 0 TD
(m)Tj
/TT4 1 Tf
0.8793 0 TD
[(,)-252.9(the)-259(party)-259(encrypts)-252.9(instead)-252.9(a)-259(randomly)-259(selected)]TJ
-15.6597 -1.1985 TD
(bitstring)Tj
/F5 1 Tf
3.6105 0 TD
(r)Tj
/F9 1 Tf
6.9739 0 0 6.9739 175.2 535.3801 Tm
(m)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 185.52 536.8801 Tm
[(of)-277(equal)-271(length.)-271(The)-277(e)12(x)12(ecution)-265(k)12(eeps)-271(a)-271(table)-277(with)-277(all)-271(association)]TJ
/F6 1 Tf
26.0378 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
0.0013 Tc
[(m,)-166.6(r)]TJ
/F9 1 Tf
6.9739 0 0 6.9739 466.74 535.3801 Tm
0 Tc
(m)Tj
/F6 1 Tf
9.9626 0 0 9.9626 474.24 536.8801 Tm
(\))Tj
/TT4 1 Tf
0.3915 0 TD
(,)Tj
-34.4668 -1.2045 TD
[(which)-277(we)-277(call)-277(the)-277(random)-283.1(associations)-271(table)-277(\(RA)108.4(T\).)-277(The)-277(RA)108.4(T)-277(i)0(s)-277(not)-283.1(made)-271(a)18.1(v)24.1(ailable)-277(to)]TJ
0 -1.1985 TD
[(the)-204.8(adv)12(ersary)66.2(,)-204.8(b)18.1(ut)-204.8(only)-210.8(to)-204.8(honest)-204.8(parties.)-204.8(Speci)]TJ
/TT5 1 Tf
18.283 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(cally)66.2(,)-204.8(whene)24.1(v)12(e)0(r)-204.8(a)0(n)-204.8(honest)-204.8(party)-210.8(recei)24.1(v)12(e)0(s)]TJ
-18.8391 -1.1985 TD
[(encrypted)-289.1(messages,)-271(the)-289.1(party)-295.1(performs)-289.1(the)-289.1(appropriate)-289.1(decryption)-289.1(and)-289.1(reco)12(v)12(ers)-277(some)]TJ
T*
[(plainte)12(xt.)-277(If)-277(the)-283.1(plainte)12(xt)-271(is)-283.1(some)]TJ
/F5 1 Tf
13.5517 0 TD
(m)Tj
/F7 1 Tf
6.9739 0 0 6.9739 278.58 492.6601 Tm
()Tj
/TT4 1 Tf
9.9626 0 0 9.9626 284.16 489.0601 Tm
[(such)-277(that)]TJ
/F6 1 Tf
3.8866 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
0.0013 Tc
[(m,)-166.6(m)]TJ
/F7 1 Tf
6.9739 0 0 6.9739 348.78 492.6601 Tm
0 Tc
()Tj
/F6 1 Tf
9.9626 0 0 9.9626 351.48 489.0601 Tm
(\))Tj
/TT4 1 Tf
0.6685 0 TD
[(occurs)-277(in)-277(RA)108.4(T)72.3(,)-277(the)-277(party)-277(treats)]TJ
-22.4218 -1.2045 TD
[(the)-234.9(encryption)-240.9(as)-234.9(an)-234.9(encryption)-240.9(of)]TJ
/F5 1 Tf
13.8116 0 TD
(m)Tj
/TT4 1 Tf
1.1142 0 TD
[(and)-234.9(continues)-234.9(its)-240.9(e)12(x)12(ecution)-228.9(as)-234.9(normal.)-234.9(Otherwise,)]TJ
-14.9258 -1.1985 TD
[(the)-246.9(underlying)-252.9(plainte)12(xt)-252.9(is)-246.9(set)-246.9(to)]TJ
/F5 1 Tf
13.0965 0 TD
(m)Tj
/F7 1 Tf
6.9739 0 0 6.9739 274.02 468.7201 Tm
()Tj
/TT4 1 Tf
9.9626 0 0 9.9626 276.78 465.1201 Tm
(.)Tj
-12.7557 -1.2045 TD
[(Intuiti)24.1(v)12(ely)66.2(,)-271(i)0(f)-271(a)0(n)12(y)-265(adv)12(ersary)-265(beha)18.1(v)12(e)0(s)-252.9(dif)24.1(ferently)-277(in)-271(the)-265(tw)12(o)-271(e)12(x)12(ecutions,)-259(it)-271(is)-265(because)]TJ
-1.4996 -1.1985 TD
[(he)-367.4(can)-361.4(see)-361.4(the)-367.4(dif)24.1(ference)-367.4(between)-361.4(encryptions)-367.4(of)-367.4(true,)-367.4(and)-367.4(random)-367.4(cipherte)12(xts.)-361.4(F)12(o)0(r)18.1(-)]TJ
T*
[(mally)66.2(,)-252.9(i)0(f)-259(w)0(e)-246.9(let)]TJ
/F8 1 Tf
6.2553 0 TD
0.001 Tc
(Exec)Tj
/F7 1 Tf
6.9739 0 0 6.9739 216.48 427.7401 Tm
0 Tc
(A)Tj
/F9 1 Tf
0.9207 0 TD
-0.0037 Tc
(,)Tj
/F6 1 Tf
9.9626 0 0 9.9626 232.8 429.2401 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.6444 0 TD
[(be)-246.9(the)-252.9(output)-259(of)-252.9(adv)12(ersary)]TJ
/F10 1 Tf
10.6876 0 TD
(A)Tj
/TT4 1 Tf
1.0539 0 TD
[(when)-252.9(e)12(x)12(ecuted)-240.9(with)-252.9(protocol)]TJ
/F5 1 Tf
-23.1482 -1.1985 TD
()Tj
/TT4 1 Tf
1.1864 0 TD
[(for)-283.1(security)-271(parameter)]TJ
/F5 1 Tf
9.1597 0 TD
( )Tj
/TT4 1 Tf
0.53 0 TD
[(,)-277(and)]TJ
/F8 1 Tf
2.2479 0 TD
0.001 Tc
(Exec)Tj
/F9 1 Tf
6.9739 0 0 6.9739 284.94 421.7401 Tm
0 Tc
(o)Tj
/F7 1 Tf
0 -0.9894 TD
(A)Tj
/F9 1 Tf
0.9207 0 TD
-0.0037 Tc
(,)Tj
/F6 1 Tf
9.9626 0 0 9.9626 301.26 417.3 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.6625 0 TD
[(the)-277(output)-277(of)-277(the)-277(adv)12(ersary)-271(in)-277(the)-277(associ-)]TJ
-18.2964 -1.2045 TD
[(ated)-246.9(oracle)-246.9(e)12(x)12(ecution,)-240.9(we)-246.9(ha)18.1(v)12(e)-240.9(the)-252.9(follo)24.1(wing)-252.9(lemma.)]TJ
/TT2 1 Tf
0 -1.9031 TD
[(Lemma)-252.9(2.)]TJ
/TT7 1 Tf
4.7736 0 TD
(Let)Tj
/F5 1 Tf
1.5549 0 TD
()Tj
/TT7 1 Tf
1.1864 0 TD
[(be)-271(an)-277(e)18.1(xecutable)-265(pr)42.2(otocol,)-265(and)]TJ
/F10 1 Tf
12.6523 0 TD
(A)Tj
/TT7 1 Tf
1.072 0 TD
[(an)-271(arbitr)12(ary)-265(ppt)-277(adver)12(sary)54.2(.)-259(Then,)]TJ
-21.2392 -1.2045 TD
[(if)-240.9(the)-240.9(encryption)-240.9(sc)12(heme)]TJ
/F10 1 Tf
9.9361 0 TD
0.0025 Tc
(AE)Tj
/TT7 1 Tf
1.6562 0 TD
0 Tc
[(used)-240.9(in)-240.9(the)-240.9(implementation)-240.9(of)]TJ
/F5 1 Tf
12.036 0 TD
()Tj
/TT7 1 Tf
1.1563 0 TD
(is)Tj
/F8 1 Tf
0.9079 0 TD
0.0008 Tc
(IND)Tj
/TT7 1 Tf
1.7104 0 TD
0 Tc
(-)Tj
/F8 1 Tf
0.333 0 TD
-0.0005 Tc
(CCA)Tj
/TT7 1 Tf
2.1862 0 TD
0 Tc
[(secur)36.1(e)12(,)-228.9(then)]TJ
/F6 1 Tf
-29.9222 -1.1985 TD
[(Pr)-168.4([)]TJ
/F8 1 Tf
1.6863 0 TD
0.001 Tc
(Exec)Tj
/F7 1 Tf
6.9739 0 0 6.9739 170.94 360.9001 Tm
0 Tc
(A)Tj
/F9 1 Tf
0.9207 0 TD
-0.0037 Tc
(,)Tj
/F6 1 Tf
9.9626 0 0 9.9626 187.26 362.4001 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
0.2779 Tc
[(\)=1)109.4(])]TJ
/F10 1 Tf
2.8908 0 TD
0 Tc
()Tj
/F6 1 Tf
0.9997 0 TD
(Pr)Tj
/F22 1 Tf
1.2346 0.813 TD
()Tj
/F8 1 Tf
0.5842 -0.813 TD
0.001 Tc
(Exec)Tj
/F9 1 Tf
6.9739 0 0 6.9739 272.76 366.8401 Tm
0 Tc
(o)Tj
/F7 1 Tf
0 -0.9894 TD
(A)Tj
/F9 1 Tf
0.9207 0 TD
-0.0037 Tc
(,)Tj
/F6 1 Tf
9.9626 0 0 9.9626 289.08 362.4001 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
0.2749 Tc
(\)=1)Tj
/F22 1 Tf
2.3849 0.813 TD
0 Tc
()Tj
/TT7 1 Tf
0.6685 -0.813 TD
[(is)-246.9(ne)42.2(gligible)12(.)]TJ
/TT4 1 Tf
-19.4647 -1.9091 TD
[(Notice)-397.5(that)-391.5(we)-397.5(can)-391.5(apply)-397.5(the)-397.5(abo)12(v)12(e)-385.4(lemma)-397.5(for)-397.5(the)-397.5(case)-391.5(when)-391.5(the)-397.5(e)12(x)12(ecution)-385.4(that)-397.5(is)]TJ
0 -1.1985 TD
[(considered)-271(is)-277(used)-277(in)-277(the)-277(e)12(xperiment)]TJ
/F21 1 Tf
14.9672 0 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 303.96 335.8201 Tm
0.0016 Tc
(sec)Tj
ET
314.58 336.24 2.1 -0.42 re
f
BT
/F9 1 Tf
6.9739 0 0 6.9739 316.6809 335.8201 Tm
0 Tc
(b)Tj
/F11 1 Tf
-1.8241 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F14 1 Tf
4.9813 0 0 4.9813 318.36 327.9601 Tm
0 Tc
(A)Tj
/F12 1 Tf
1.108 0 TD
-0.0007 Tc
(,)Tj
/F6 1 Tf
9.9626 0 0 9.9626 333.12 331.4401 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.3915 0 TD
[(,)-265(for)-277(some)]TJ
/F5 1 Tf
4.3459 0 TD
-0.0014 Tc
[(b,)-169.3(i,)-169.3(j)]TJ
/TT4 1 Tf
2.132 0 TD
0 Tc
[(.)-271(I)0(f)-283.1(w)0(e)-277(write)]TJ
/F21 1 Tf
-29.7429 -1.4695 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 154.68 321.1801 Tm
0.0016 Tc
(sec)Tj
ET
165.36 321.6 2.1 -0.42 re
f
BT
/F9 1 Tf
6.9739 0 0 6.9739 167.4609 321.1801 Tm
0 Tc
(b)Tj
/F11 1 Tf
-1.8327 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 169.14 316.7401 Tm
0 Tc
(o)Tj
/F14 1 Tf
0 -0.9516 TD
(A)Tj
/F12 1 Tf
1.108 0 TD
-0.0007 Tc
(,)Tj
/F6 1 Tf
9.9626 0 0 9.9626 183.9 316.8 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.6143 0 TD
[(for)-240.9(the)-234.9(corresponding)-234.9(oracle)-228.9(e)12(x)12(ecution,)-222.8(we)-234.9(obtain)-234.9(that)-234.9(there)-234.9(e)12(xists)]TJ
-8.5098 -1.3611 TD
[(some)-246.9(ne)12(gligible)-246.9(function)]TJ
/F5 1 Tf
10.1771 0 TD
()Tj
/F9 1 Tf
6.9739 0 0 6.9739 241.08 301.7401 Tm
-0.0017 Tc
(i,j,b)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 258.42 303.2401 Tm
0 Tc
[(such)-246.9(that)]TJ
/F6 1 Tf
-10.8224 -2.5415 TD
(Pr)Tj
/F22 1 Tf
1.2406 1.1081 TD
()Tj
/F21 1 Tf
0.4758 -1.1081 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 187.62 282.3 Tm
0.0016 Tc
(sec)Tj
ET
198.3 282.72 2.1 -0.42 re
f
BT
/F9 1 Tf
6.9739 0 0 6.9739 200.3409 282.3 Tm
0 Tc
(b)Tj
/F11 1 Tf
-1.8241 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 202.08 274.4401 Tm
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 216.42 277.9201 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.2749 Tc
(\)=1)Tj
/F22 1 Tf
2.2162 1.1081 TD
0 Tc
()Tj
/F10 1 Tf
0.6986 -1.1081 TD
()Tj
/F6 1 Tf
0.9997 0 TD
(Pr)Tj
/F22 1 Tf
1.2346 1.1081 TD
()Tj
/F21 1 Tf
0.4758 -1.1081 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 321.9 282.3 Tm
0.0016 Tc
(sec)Tj
ET
332.58 282.72 2.1 -0.42 re
f
BT
/F9 1 Tf
6.9739 0 0 6.9739 334.6809 282.3 Tm
0 Tc
(b)Tj
/F11 1 Tf
-1.8327 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 336.36 277.8601 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 350.7 277.9201 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.2749 Tc
(\)=1)Tj
/F22 1 Tf
2.2162 1.1081 TD
0 Tc
()Tj
/F6 1 Tf
0.7528 -1.1081 TD
(=)Tj
/F5 1 Tf
1.0539 0 TD
()Tj
/F9 1 Tf
6.9739 0 0 6.9739 425.22 276.4201 Tm
-0.0017 Tc
(i,j,b)Tj
/F6 1 Tf
9.9626 0 0 9.9626 440.04 277.9201 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
1.9814 0 TD
(\(1\))Tj
-33.5213 -2.7222 TD
(S)Tj
7.9701 0 0 7.9701 141.0207 250.8001 Tm
0.0602 Tc
(TEP)Tj
9.9626 0 0 9.9626 159.7502 250.8001 Tm
0 Tc
[(I)-48.2(I)-48.2(.)-337.3(Ne)12(xt,)-295.1(we)-301.1(associate)-295.1(symbolic)-307.1(traces)-301.1(to)-307.1(the)-301.1(computational)-307.1(traces)-301.1(of)-307.1(the)-301.1(oracle)]TJ
-2.5084 -1.1985 TD
[(e)12(x)12(ecution.)-277(This)-295.1(enables)-283.1(us)-289.1(to)-289.1(reason)-283.1(about)-289.1(an)-289.1(adv)12(ersary)54.2(s)-283.1(success)-277(in)-295.1(the)-289.1(oracle)-283.1(e)12(x)12(ecu-)]TJ
0 -1.2045 TD
[(tion)-295.1(\(which)-295.1(is)-295.1(conceptually)-295.1(simpler\).)-289.1(The)-301.1(association)-283.1(is)-295.1(in)-295.1(f)12(act)-295.1(the)-295.1(one)-295.1(in)-295.1(the)-295.1(proof)-301.1(of)]TJ
0 -1.1985 TD
[(Proposition)-222.8(1,)-210.8(with)-216.8(an)-216.8(additional)-216.8(parsing)-216.8(step)-210.8(necessary)-204.8(to)-216.8(tak)12(e)-216.8(into)-222.8(account)-210.8(the)-216.8(random)]TJ
T*
[(association)-228.9(table)-234.9(that)-234.9(we)-234.9(detail)-234.9(belo)24.1(w)66.2(.)-228.9(In)-234.9(addition)-240.9(to)-234.9(access)-222.8(to)-234.9(the)-234.9(k)12(e)12(y)0(s)-234.9(and)-228.9(the)-234.9(random-)]TJ
T*
[(ness)-337.3(of)-343.3(the)-343.3(parties,)-343.3(the)-343.3(parsing)-343.3(procedure)-343.3(also)-337.3(uses)-337.3(access)-331.2(to)-349.3(the)-343.3(random)-343.3(association)]TJ
0 -1.2045 TD
[(table,)-265(and)-265(is)-265(as)-265(follo)24.1(ws:)-271(the)]TJ
/TT5 1 Tf
11.2086 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(rst)-271(step)-265(in)-271(processing)-259(some)-265(message)]TJ
/F5 1 Tf
14.754 0 TD
(m)Tj
/F7 1 Tf
6.9739 0 0 6.9739 408 182.7001 Tm
()Tj
/TT4 1 Tf
9.9626 0 0 9.9626 413.46 179.0401 Tm
[(is)-271(a)-265(search)-259(in)-271(the)]TJ
-10.8706 -2.9992 TD
(9)Tj
ET
endstream
endobj
58 0 obj
<<
/ProcSet [/PDF /Text ]
/Font <<
/F2 5 0 R
/F5 16 0 R
/F6 17 0 R
/F7 18 0 R
/F8 23 0 R
/F9 24 0 R
/F10 25 0 R
/F11 26 0 R
/F12 27 0 R
/F14 32 0 R
/F21 45 0 R
/F22 46 0 R
/TT2 8 0 R
/TT4 9 0 R
/TT5 10 0 R
/TT7 19 0 R
>>
/ExtGState <<
/GS1 11 0 R
>>
>>
endobj
60 0 obj
<<
/Length 21652
>>
stream
BT
/TT4 1 Tf
9.9626 0 0 9.9626 134.76 716.16 Tm
0 g
/GS1 gs
0 Tc
0 Tw
[(random)-240.9(association)-228.9(table.)-234.9(If)]TJ
/F6 1 Tf
11.303 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
0.0013 Tc
[(m,)-166.6(m)]TJ
/F7 1 Tf
6.9739 0 0 6.9739 273.3 719.8201 Tm
0 Tc
()Tj
/F6 1 Tf
9.9626 0 0 9.9626 276.06 716.16 Tm
(\))Tj
/TT4 1 Tf
0.6263 0 TD
[(occurs)-228.9(in)-240.9(the)-234.9(RA)108.4(T)72.3(,)-234.9(then)-234.9(the)-240.9(procedure)-234.9(proceeds)-234.9(as)]TJ
-14.8093 -1.1985 TD
[(before,)-246.9(with)]TJ
/F5 1 Tf
5.0814 0 TD
(m)Tj
/F7 1 Tf
6.9739 0 0 6.9739 194.16 707.8201 Tm
()Tj
/TT4 1 Tf
9.9626 0 0 9.9626 199.44 704.22 Tm
[(replaced)-246.9(by)]TJ
/F5 1 Tf
4.8801 0 TD
(m)Tj
/TT4 1 Tf
0.8793 0 TD
[(,)-246.9(otherwise)-246.9(the)-252.9(procedure)-246.9(remains)-246.9(unchanged.)]TJ
-10.752 -1.1985 TD
[(Ne)12(xt,)-198.7(we)-204.8(ar)18.1(gue)-204.8(that)-204.8(the)-204.8(symbolic)-204.8(traces)-198.7(obtained)-204.8(as)-204.8(abo)12(v)12(e)-192.7(are)-204.8(v)24.1(alid)-204.8(e)12(x)12(ecution)-198.7(traces,)]TJ
-1.4996 -1.1985 TD
[(and)-277(moreo)12(v)12(e)0(r)42.2(,)-271(that)-277(the)12(y)-277(are)-277(included)-277(among)-277(the)-277(traces)-271(of)-283.1(the)-277(e)12(x)12(ecution)-265(of)]TJ
/F5 1 Tf
29.9475 0 TD
()Tj
/TT4 1 Tf
0.9094 0 TD
[(.)-277(The)-277(for)18.1(-)]TJ
-30.8569 -1.2045 TD
[(malization)-252.9(is)-246.9(gi)24.1(v)12(e)0(n)-246.9(i)0(n)-246.9(the)-252.9(ne)12(xt)-246.9(lemma.)]TJ
/TT2 1 Tf
0 -1.8609 TD
[(Lemma)-252.9(3.)]TJ
/TT7 1 Tf
4.7736 0 TD
[(The)-222.8(symbolic)-216.8(tr)12(aces)-210.8(of)]TJ
/F8 1 Tf
9.1376 0 TD
0.001 Tc
(Exec)Tj
/F9 1 Tf
6.9739 0 0 6.9739 292.92 654.2401 Tm
0 Tc
(o)Tj
/F6 1 Tf
9.9626 0 0 9.9626 297.36 649.8 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
0.024 Tc
(,)Tj
/F10 1 Tf
1.3009 0 TD
0 Tc
(A)Tj
/F6 1 Tf
0.801 0 TD
(\))Tj
/TT7 1 Tf
0.6022 0 TD
[(ar)36.1(e)-216.8(valid)-222.8(with)-222.8(o)12(verwhelming)-216.8(pr)42.2(obabil-)]TJ
-19.4166 -1.2045 TD
[(ity)-252.9(and)]TJ
/F8 1 Tf
2.9994 0 TD
0.001 Tc
(Exec)Tj
/F9 1 Tf
6.9739 0 0 6.9739 184.08 642.3 Tm
0 Tc
(o)Tj
/F7 1 Tf
0 -0.998 TD
(A)Tj
/F9 1 Tf
0.9207 0 TD
-0.0037 Tc
(,)Tj
/F10 1 Tf
9.9626 0 0 9.9626 203.16 637.8 Tm
0 Tc
()Tj
/F8 1 Tf
1.0539 0 TD
0.001 Tc
(Exec)Tj
/F7 1 Tf
6.9739 0 0 6.9739 233.04 636.3 Tm
0 Tc
(A)Tj
/F9 1 Tf
0.9207 0 TD
-0.0037 Tc
(,)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 249.36 637.8 Tm
0 Tc
(.)Tj
/TT4 1 Tf
-11.4789 -2.15 TD
(S)Tj
7.9701 0 0 7.9701 141.0207 616.3801 Tm
0.0602 Tc
(TEP)Tj
9.9626 0 0 9.9626 158.6102 616.3801 Tm
0.0482 Tc
(III.)Tj
1.6164 0 TD
0 Tc
[(Finally)66.2(,)-192.7(w)0(e)-186.7(pro)12(v)12(e)-186.7(that)-186.7(if)]TJ
/F10 1 Tf
9.4919 0 TD
0.0025 Tc
(AE)Tj
/TT4 1 Tf
1.608 0 TD
0 Tc
(is)Tj
/F8 1 Tf
0.8537 0 TD
0.0008 Tc
(IND)Tj
/TT4 1 Tf
1.7104 0 TD
0 Tc
(-)Tj
/F8 1 Tf
0.333 0 TD
-0.0005 Tc
(CCA)Tj
/TT4 1 Tf
2.138 0 TD
0 Tc
[(secure)-180.7(then)]TJ
/F5 1 Tf
4.6488 0 TD
()Tj
/F10 1 Tf
1.1864 0 TD
(|)Tj
/F6 1 Tf
0.1084 0 TD
(=)Tj
/F8 1 Tf
1.06 0 TD
0.0009 Tc
(SecNonce)Tj
/F9 1 Tf
6.9739 0 0 6.9739 445.68 620.8201 Tm
0 Tc
(s)Tj
/F6 1 Tf
9.9626 0 0 9.9626 449.94 616.3801 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0 Tc
(\))Tj
/F10 1 Tf
0.6625 0 TD
()Tj
/F5 1 Tf
-33.9489 -1.1985 TD
()Tj
/F10 1 Tf
1.2406 0 TD
(|)Tj
/F6 1 Tf
0.1084 0 TD
(=)Tj
/F11 1 Tf
6.9739 0 0 6.9739 155.94 608.04 Tm
(c)Tj
/F8 1 Tf
9.9626 0 0 9.9626 163.02 604.4401 Tm
0.0009 Tc
(SecNonce)Tj
/F6 1 Tf
4.0592 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0 Tc
(\))Tj
/TT4 1 Tf
0.3915 0 TD
[(.)-271(F)12(or)-277(an)-277(arbitrary)-277(adv)12(ersary)]TJ
/F10 1 Tf
11.2612 0 TD
(A)Tj
/TT4 1 Tf
1.078 0 TD
[(ag)6(ainst)-271(the)-277(secrec)12(y)-271(o)0(f)-277(nonce)]TJ
/F5 1 Tf
11.6275 0 TD
(X)Tj
/F9 1 Tf
6.9739 0 0 6.9739 471.78 609.2401 Tm
(j)Tj
-0.1118 -1.1099 TD
(A)Tj
/F12 1 Tf
4.9813 0 0 4.9813 477 600.48 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 134.76 590.28 Tm
[(recall)-325.2(that)-331.2(we)-325.2(write)]TJ
/F21 1 Tf
8.2533 0 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 236.94 594.66 Tm
0.0016 Tc
(sec)Tj
ET
247.62 595.08 2.1 -0.42 re
f
BT
/F9 1 Tf
6.9739 0 0 6.9739 249.7209 594.66 Tm
0 Tc
(b)Tj
/F11 1 Tf
-1.8327 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 251.4 590.22 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 265.74 590.28 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.7709 0 TD
[(for)-331.2(the)-325.2(oracle)-325.2(v)12(ersion)-325.2(of)-331.2(the)-331.2(e)12(xperiment)-325.2(de)]TJ
/TT5 1 Tf
17.541 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
(ning)Tj
-32.9366 -1.6201 TD
[(secrec)12(y)-277(o)0(f)-289.1(nonce)]TJ
/F5 1 Tf
7.0554 0 TD
(X)Tj
/F9 1 Tf
6.9739 0 0 6.9739 214.2 578.8801 Tm
(j)Tj
-0.1118 -1.1013 TD
(A)Tj
/F12 1 Tf
4.9813 0 0 4.9813 219.42 570.1801 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 223.08 574.14 Tm
[(.)-283.1(Let)]TJ
/F21 1 Tf
2.1547 0 TD
-0.0014 Tc
(Adv)Tj
/F2 1 Tf
6.9739 0 0 6.9739 265.8 578.5801 Tm
0.0016 Tc
(sec)Tj
/F11 1 Tf
0 -0.998 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 280.2 574.0801 Tm
0 Tc
(o)Tj
/F14 1 Tf
0 -0.9636 TD
(A)Tj
/F12 1 Tf
1.108 0 TD
-0.0007 Tc
(,)Tj
/F6 1 Tf
9.9626 0 0 9.9626 294.96 574.14 Tm
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.6745 0 TD
[(be)-283.1(the)-289.1(corresponding)-289.1(adv)24.1(antage)-277(functions.)]TJ
-17.6761 -1.3671 TD
[(By)-246.9(de)]TJ
/TT5 1 Tf
2.3578 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(nition)-252.9(we)-252.9(ha)18.1(v)12(e)-240.9(that:)]TJ
/F21 1 Tf
-2.3177 -2.421 TD
-0.0014 Tc
(Adv)Tj
/F2 1 Tf
6.9739 0 0 6.9739 161.94 540.84 Tm
0.0016 Tc
(sec)Tj
/F11 1 Tf
0 -0.9894 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 176.4 532.92 Tm
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 190.8 536.4 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.2676 Tc
[(\)=)-14.6(P)267.6(r)]TJ
/F22 1 Tf
2.951 1.1081 TD
0 Tc
()Tj
/F21 1 Tf
0.4758 -1.1081 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 274.38 540.78 Tm
0.0016 Tc
(sec)Tj
ET
285.06 541.2 2.1 -0.42 re
f
BT
6.9739 0 0 6.9739 287.1009 540.78 Tm
0 Tc
(1)Tj
/F11 1 Tf
-1.8241 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 288.84 532.92 Tm
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 303.18 536.4 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.0026 Tc
[(\)=)9.5(1)]TJ
/F22 1 Tf
1.6622 1.1081 TD
0 Tc
()Tj
/F10 1 Tf
0.4758 -1.1081 TD
()Tj
/F6 1 Tf
0.7769 0 TD
(Pr)Tj
/F22 1 Tf
1.2346 1.1081 TD
()Tj
/F21 1 Tf
0.4758 -1.1081 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 398.7 540.78 Tm
0.0016 Tc
(sec)Tj
ET
409.38 541.2 2.1 -0.42 re
f
BT
6.9739 0 0 6.9739 411.4809 540.78 Tm
0 Tc
(0)Tj
/F11 1 Tf
-1.8327 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 413.16 532.92 Tm
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 427.56 536.4 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.0026 Tc
[(\)=)15.5(1)]TJ
/F22 1 Tf
1.6562 1.1081 TD
0 Tc
()Tj
/F21 1 Tf
-34.0091 -3.3124 TD
-0.0014 Tc
(Adv)Tj
/F2 1 Tf
6.9739 0 0 6.9739 156 518.9401 Tm
0.0016 Tc
(sec)Tj
/F11 1 Tf
0 -0.998 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 170.46 514.3801 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 184.8 514.4401 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.2749 Tc
[(\)=P)274.9(r)]TJ
/F22 1 Tf
2.957 1.1142 TD
0 Tc
()Tj
/F21 1 Tf
0.4698 -1.1142 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 268.44 518.8201 Tm
0.0016 Tc
(sec)Tj
ET
279.06 519.24 2.1 -0.42 re
f
BT
6.9739 0 0 6.9739 281.1609 518.8201 Tm
0 Tc
(1)Tj
/F11 1 Tf
-1.8241 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 282.9 514.3801 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 297.24 514.4401 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.0026 Tc
[(\)=)9.5(1)]TJ
/F22 1 Tf
1.6622 1.1142 TD
0 Tc
()Tj
/F10 1 Tf
0.4698 -1.1142 TD
()Tj
/F6 1 Tf
0.7829 0 TD
(Pr)Tj
/F22 1 Tf
1.2346 1.1142 TD
()Tj
/F21 1 Tf
0.4758 -1.1142 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 392.76 518.8201 Tm
0.0016 Tc
(sec)Tj
ET
403.44 519.24 2.1 -0.42 re
f
BT
6.9739 0 0 6.9739 405.4809 518.8201 Tm
0 Tc
(0)Tj
/F11 1 Tf
-1.8241 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 407.22 514.3801 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 421.56 514.4401 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.0026 Tc
(\)=)Tj
/F5 1 Tf
1.1624 0 TD
0 Tc
(f)Tj
/F6 1 Tf
0.5962 0 TD
(1)Tj
/F22 1 Tf
0.4998 1.1142 TD
()Tj
/TT4 1 Tf
-34.0091 -3.4991 TD
[(By)-246.9(subtracting,)-246.9(using)-252.9(Equation)-252.9(1,)-246.9(we)-246.9(obtain)-246.9(that)-252.9(for)-252.9(some)-246.9(ne)12(gligible)-246.9(function)]TJ
/F5 1 Tf
31.1423 0 TD
()Tj
/F21 1 Tf
-24.367 -2.403 TD
-0.0014 Tc
(Adv)Tj
/F2 1 Tf
6.9739 0 0 6.9739 223.5 471.1801 Tm
0.0016 Tc
(sec)Tj
/F11 1 Tf
0 -0.9894 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 237.9 463.2601 Tm
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 252.3 466.7401 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.2736 Tc
(\)=)Tj
/F21 1 Tf
1.7164 0 TD
-0.0014 Tc
(Adv)Tj
/F2 1 Tf
6.9739 0 0 6.9739 320.16 471.1801 Tm
0.0016 Tc
(sec)Tj
/F11 1 Tf
0 -0.9894 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 334.62 466.6801 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 348.96 466.7401 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
0.2194 Tc
(\)+)Tj
/F5 1 Tf
1.608 0 TD
0 Tc
()Tj
/F6 1 Tf
0.5601 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
5.9924 0 TD
(\(2\))Tj
-32.0458 -2.0055 TD
[(Finally)66.2(,)-246.9(w)0(e)-240.9(sho)24.1(w)-240.9(that)-246.9(in)-240.9(the)-246.9(oracle)-240.9(e)12(x)12(ecution)-234.9(the)-246.9(adv)24.1(antage)]TJ
/F21 1 Tf
23.7469 0 TD
-0.0014 Tc
(Adv)Tj
/F2 1 Tf
6.9739 0 0 6.9739 407.7 451.2001 Tm
0.0016 Tc
(sec)Tj
/F11 1 Tf
0 -0.9894 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 422.16 446.7001 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 436.5 446.7601 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0.0026 Tc
(\)\()Tj
/F5 1 Tf
0.7829 0 TD
0 Tc
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.6324 0 TD
(of)Tj
-33.8826 -1.3611 TD
[(an)12(y)-343.3(adv)12(ersary)]TJ
/F10 1 Tf
5.993 0 TD
(A)Tj
/TT4 1 Tf
1.1503 0 TD
[(is)-343.3(ne)12(gligible)-349.3(since)-343.3(nonces)-343.3(that)-349.3(are)-349.3(symbolically)-349.3(secret)-343.3(are)-349.3(informa-)]TJ
-7.1433 -1.2045 TD
[(tional)-252.9(theoretically)-246.9(hidden)-252.9(from)-252.9(the)-252.9(adv)12(ersary)66.2(.)-240.9(This)-246.9(can)-246.9(be)-252.9(seen)-240.9(as)-246.9(follo)24.1(ws.)]TJ
1.4996 -1.1985 TD
[(Consider)-283.1(the)-289.1(symbolic)-283.1(trace)]TJ
/F5 1 Tf
11.5857 0 TD
()Tj
/TT4 1 Tf
0.8793 0 TD
[(that)-289.1(corresponds)-283.1(to)-289.1(the)-289.1(e)12(x)12(ecution)-277(of)-289.1(the)-283.1(e)12(xperiment)]TJ
/F21 1 Tf
-13.9646 -1.1985 TD
-0.0007 Tc
(Exp)Tj
/F2 1 Tf
6.9739 0 0 6.9739 154.68 401.7 Tm
0.0016 Tc
(sec)Tj
ET
165.36 402.12 2.1 -0.42 re
f
BT
/F9 1 Tf
6.9739 0 0 6.9739 167.4609 401.7 Tm
0 Tc
(b)Tj
/F11 1 Tf
-1.8327 -0.9808 TD
0.0006 Tc
(Exec)Tj
/F12 1 Tf
4.9813 0 0 4.9813 169.14 397.2601 Tm
0 Tc
(o)Tj
0 -0.9516 TD
-0.0025 Tc
(,)Tj
/F14 1 Tf
1.5656 0 TD
0 Tc
(A)Tj
/F6 1 Tf
9.9626 0 0 9.9626 183.54 397.3201 Tm
(\()Tj
/F5 1 Tf
0.3915 0 TD
( )Tj
/F6 1 Tf
0.53 0 TD
(\))Tj
/TT4 1 Tf
0.3915 0 TD
[(,)-246.9(u)0(p)-246.9(t)0(o)-252.9(the)-252.9(point)-252.9(when)-252.9(the)-246.9(adv)12(ersary)-246.9(is)-246.9(gi)24.1(v)12(e)0(n)-246.9(the)-252.9(nonces)-246.9(and)-246.9(he)-252.9(is)-246.9(ask)12(ed)]TJ
-6.2092 -1.5056 TD
[(to)-289.1(determine)-289.1(the)-289.1(bit)]TJ
/F5 1 Tf
8.2156 0 TD
(b)Tj
/TT4 1 Tf
0.4276 0 TD
[(.)-289.1(Let)]TJ
/F5 1 Tf
2.1607 0 TD
(s)Tj
/TT4 1 Tf
0.7588 0 TD
[(be)-289.1(the)-289.1(id)-289.1(of)-289.1(the)-289.1(session)-283.1(under)-289.1(attack,)-283.1(and)-289.1(let)]TJ
/F5 1 Tf
18.1234 0 TD
(n)Tj
/F9 1 Tf
6.9739 0 0 6.9739 436.68 385.92 Tm
-0.0018 Tc
(a,j,s)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 456.12 382.3201 Tm
0 Tc
[(be)-289.1(the)]TJ
-32.2565 -1.2045 TD
[(symbolic)-240.9(nonce)-240.9(that)-240.9(corresponds)-234.9(to)-246.9(the)-240.9(nonce)-234.9(under)-240.9(attack.)-234.9(By)-240.9(Lemma)-246.9(3,)-234.9(the)-240.9(trace)]TJ
/F5 1 Tf
33.1828 0 TD
()Tj
/TT4 1 Tf
0.8371 0 TD
(is)Tj
-34.02 -1.1985 TD
[(with)-277(o)12(v)12(erwhelming)-265(probability)-277(a)-271(Dole)24.1(v-Y)102.4(ao)-271(trace)-271(of)-277(protocol)]TJ
/F5 1 Tf
24.9666 0 TD
()Tj
/TT4 1 Tf
0.9094 0 TD
[(.)-277(B)0(y)-271(the)-271(h)6(ypothesis)-271(of)]TJ
-25.876 -1.1985 TD
[(the)-234.9(theorem)]TJ
/F5 1 Tf
4.9738 0 TD
()Tj
/F10 1 Tf
1.1864 0 TD
(|)Tj
/F6 1 Tf
0.1084 0 TD
(=)Tj
/F9 1 Tf
6.9739 0 0 6.9739 204.96 350.04 Tm
(s)Tj
/F8 1 Tf
9.9626 0 0 9.9626 212.04 346.4401 Tm
0.0009 Tc
(SecNonce)Tj
/F6 1 Tf
4.0592 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
-0.0012 Tc
[(i,)-169.1(j)]TJ
/F6 1 Tf
1.2587 0 TD
0 Tc
(\))Tj
/TT4 1 Tf
0.6203 0 TD
[(and)-234.9(therefore)-240.9(by)-234.9(Lemma)-240.9(1,)-234.9(all)-234.9(occurrences)-228.9(of)]TJ
/F5 1 Tf
18.3545 0 TD
(n)Tj
/F9 1 Tf
6.9739 0 0 6.9739 464.04 350.04 Tm
-0.0018 Tc
(a,j,s)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 134.76 334.5001 Tm
0 Tc
(in)Tj
/F5 1 Tf
1.1271 0 TD
()Tj
/TT4 1 Tf
0.9395 0 TD
[(that)-349.3(are)-343.3(not)-349.3(under)-343.3(an)-343.3(honest)-343.3(encryption)-349.3(are)-343.3(in)-349.3(some)-343.3(term)]TJ
/F5 1 Tf
23.8541 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 398.88 333.0001 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 405.66 334.5001 Tm
[(that)-343.3(appears)-343.3(under)]TJ
-27.1916 -1.2045 TD
[(a)-307.1(hash,)-295.1(and)]TJ
/F5 1 Tf
4.8801 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 189.3 321.0001 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 195.66 322.5001 Tm
[(is)-307.1(nondeductible)-301.1(from)]TJ
/F5 1 Tf
9.1973 0 TD
0.0004 Tc
[(,)-167.5(n)]TJ
/F9 1 Tf
6.9739 0 0 6.9739 303.66 326.1601 Tm
-0.0017 Tc
(i,j,s)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 318.66 322.5001 Tm
0 Tc
[(.)-307.1(Let)]TJ
/F5 1 Tf
2.1968 0 TD
(t)Tj
/F9 1 Tf
6.9739 0 0 6.9739 344.16 321.0001 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 350.52 322.5001 Tm
[(be)-307.1(the)-301.1(bitstrings)-307.1(that)-307.1(correspond)]TJ
-21.6569 -1.1985 TD
[(to)-379.4(the)-373.4(terms)]TJ
/F5 1 Tf
5.3474 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 193.86 309.0601 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 197.22 310.5601 Tm
[(.)-367.4(W)78.3(e)-373.4(conclude)-373.4(by)-373.4(observing)-379.4(that)-373.4(in)-379.4(the)-373.4(real)-373.4(e)12(x)12(ecution,)-367.4(the)-373.4(adv)12(ersary)]TJ
-6.2694 -1.1985 TD
[(may)-252.9(observ)12(e)-252.9(the)-252.9(v)24.1(alues)]TJ
/F5 1 Tf
9.5775 0 TD
(c)Tj
/F2 1 Tf
6.9739 0 0 6.9739 234.6 297.1201 Tm
(1)Tj
/F6 1 Tf
9.9626 0 0 9.9626 241.92 298.6201 Tm
(=)Tj
/F5 1 Tf
1.066 0 TD
(h)Tj
/F6 1 Tf
0.5782 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
(t)Tj
/F2 1 Tf
6.9739 0 0 6.9739 265.8 297.1201 Tm
(1)Tj
/F6 1 Tf
9.9626 0 0 9.9626 270.24 298.6201 Tm
(\))Tj
/F5 1 Tf
0.3915 0 TD
0.1679 Tc
(,c)Tj
/F2 1 Tf
6.9739 0 0 6.9739 282.9 297.1201 Tm
0 Tc
(2)Tj
/F6 1 Tf
9.9626 0 0 9.9626 290.16 298.6201 Tm
(=)Tj
/F5 1 Tf
1.066 0 TD
(h)Tj
/F6 1 Tf
0.5782 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
(t)Tj
/F2 1 Tf
6.9739 0 0 6.9739 314.04 297.1201 Tm
(2)Tj
/F6 1 Tf
9.9626 0 0 9.9626 318.42 298.6201 Tm
(\))Tj
/F5 1 Tf
0.3915 0 TD
0.1679 Tc
(,...)Tj
/TT4 1 Tf
1.608 0 TD
0 Tc
[(,)-252.9(b)18.1(ut)-252.9(pro)12(vided)-259(that)-252.9(it)-259(does)-246.9(not)-259(query)]TJ
/F5 1 Tf
-20.4344 -1.1985 TD
(t)Tj
/F2 1 Tf
6.9739 0 0 6.9739 138.36 285.1801 Tm
(1)Tj
/F5 1 Tf
9.9626 0 0 9.9626 142.86 286.6801 Tm
0.1679 Tc
(,t)Tj
/F2 1 Tf
6.9739 0 0 6.9739 150.9 285.1801 Tm
0 Tc
(2)Tj
/F5 1 Tf
9.9626 0 0 9.9626 155.34 286.6801 Tm
0.1679 Tc
(,...)Tj
/TT4 1 Tf
1.8188 0 TD
0 Tc
[(to)-210.8(the)-204.8(random)-210.8(oracle,)-204.8(their)-210.8(v)24.1(alues)-198.7(\(and)-210.8(thus)-204.8(in)-210.8(particular)-210.8(the)-204.8(v)24.1(alue)-204.8(of)-210.8(the)-210.8(secret)]TJ
-3.8845 -1.2045 TD
[(nonce\))-295.1(are)-289.1(independent)-295.1(from)-295.1(the)]TJ
/F5 1 Tf
13.4636 0 TD
(c)Tj
/F2 1 Tf
6.9739 0 0 6.9739 273.24 273.1801 Tm
(1)Tj
/F5 1 Tf
9.9626 0 0 9.9626 277.68 274.6801 Tm
0.1679 Tc
(,c)Tj
/F2 1 Tf
6.9739 0 0 6.9739 286.44 273.1801 Tm
0 Tc
(2)Tj
/F5 1 Tf
9.9626 0 0 9.9626 290.88 274.6801 Tm
0.1679 Tc
(,...)Tj
/TT4 1 Tf
1.614 0 TD
0 Tc
[(.)-289.1(Since)-295.1(all)-295.1(queries)-289.1(to)-295.1(the)-295.1(random)-295.1(oracle)-289.1(are)]TJ
-17.2846 -1.1985 TD
[(the)-246.9(images)-246.9(of)-252.9(deductible)-246.9(terms,)-246.9(we)-252.9(conclude)-240.9(that)]TJ
/F10 1 Tf
19.7863 0 TD
(A)Tj
/TT4 1 Tf
1.0479 0 TD
[(does)-246.9(not)-252.9(request)]TJ
/F5 1 Tf
6.7453 0 TD
(h)Tj
/F6 1 Tf
0.5782 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
(t)Tj
/F9 1 Tf
6.9739 0 0 6.9739 423 261.2401 Tm
(i)Tj
/F6 1 Tf
9.9626 0 0 9.9626 426.24 262.7401 Tm
(\))Tj
/TT4 1 Tf
0.3915 0 TD
[(,)-246.9(for)-252.9(all)]TJ
/F5 1 Tf
3.1623 0 TD
(i)Tj
/TT4 1 Tf
0.3433 0 TD
(.)Tj
/TT2 1 Tf
-31.6548 -1.1985 TD
[(The)-222.8(only)-228.9(if)-54.2()-228.9(dir)18.1(ection.)]TJ
/TT4 1 Tf
10.1338 0 TD
[(It)-228.9(is)-222.8(important)-228.9(to)-222.8(observ)12(e)-216.8(that)-222.8(if)-228.9(a)-222.8(message)]TJ
/F5 1 Tf
16.9951 0 TD
(M)Tj
/TT4 1 Tf
1.3009 0 TD
[(is)-222.8(deducible)]TJ
-29.9294 -1.1985 TD
[(from)-265(a)-259(set)-259(of)-265(messages)]TJ
/F5 1 Tf
9.4093 0 TD
(M)Tj
/F2 1 Tf
6.9739 0 0 6.9739 238.26 237.3601 Tm
(1)Tj
/F5 1 Tf
9.9626 0 0 9.9626 242.7 238.8601 Tm
0.1679 Tc
(,M)Tj
/F2 1 Tf
6.9739 0 0 6.9739 256.8 237.3601 Tm
0 Tc
(2)Tj
/F5 1 Tf
9.9626 0 0 9.9626 261.3 238.8601 Tm
0.1679 Tc
[(,...)6(,M)]TJ
/F9 1 Tf
6.9739 0 0 6.9739 293.1 237.3601 Tm
0 Tc
(n)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 298.5 238.8601 Tm
[(,)-259(the)-259(associated)-252.9(deduction)-265(tree)]TJ
/F5 1 Tf
12.3178 0 TD
()Tj
/TT4 1 Tf
0.813 0 TD
[(can)-259(be)-259(trans-)]TJ
-29.5662 -1.2045 TD
[(lated)-277(into)-283.1(an)-277(\(ef)]TJ
/TT5 1 Tf
6.3658 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(cient\))-283.1(program)]TJ
ET
265.74 232.8 5.52 -0.42 re
f
BT
/F5 1 Tf
9.9626 0 0 9.9626 265.7896 226.8601 Tm
()Tj
/TT4 1 Tf
0.8311 0 TD
[(which)-277(gi)24.1(v)12(e)0(n)-277(the)-277(bit-string)-283.1(representations)-277(of)]TJ
/F5 1 Tf
18.0781 0 TD
(m)Tj
/F9 1 Tf
6.9739 0 0 6.9739 462.9 225.3601 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 468.96 226.8601 Tm
(for)Tj
/F5 1 Tf
-33.5453 -1.1985 TD
(M)Tj
/F9 1 Tf
6.9739 0 0 6.9739 144.42 213.4201 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 150.24 214.9201 Tm
(\()Tj
/F5 1 Tf
0.333 0 TD
(i)Tj
/F6 1 Tf
0.6263 0 TD
0.2762 Tc
(=1)Tj
/F5 1 Tf
1.5538 0 TD
0 Tc
(,)Tj
/F6 1 Tf
0.4457 0 TD
(2)Tj
/F5 1 Tf
0.4999 0 TD
0.1679 Tc
[(,...)6(,n)]TJ
/TT4 1 Tf
2.8246 0 TD
0 Tc
[(\))-246.9(computes)-246.9(the)-246.9(bit-string)-259(representation)]TJ
/F5 1 Tf
15.9644 0 TD
(m)Tj
/TT4 1 Tf
1.1262 0 TD
(of)Tj
/F5 1 Tf
1.086 0 TD
(M)Tj
/TT4 1 Tf
1.078 0 TD
(.)Tj
-25.5921 -1.1985 TD
[(W)78.3(e)-222.8(proceed)-222.8(as)-222.8(follo)24.1(ws.)-222.8(Assume)-222.8(that)-228.9(for)-228.9(some)-222.8(symbolic)-228.9(trace)]TJ
/F5 1 Tf
24.3867 0 TD
()Tj
/TT4 1 Tf
0.5962 0 TD
[(,)-222.8(the)-228.9(symbolic)-222.8(nonce)]TJ
/F5 1 Tf
-26.4825 -1.1985 TD
(n)Tj
/F9 1 Tf
6.9739 0 0 6.9739 140.76 194.6401 Tm
(a)Tj
/F12 1 Tf
4.9813 0 0 4.9813 145.08 193.6201 Tm
(i)Tj
/F9 1 Tf
6.9739 0 0 6.9739 148.2 194.6401 Tm
-0.0027 Tc
(,j,s)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 163.56 191.0401 Tm
0 Tc
[(occurs)-307.1(in)]TJ
/F8 1 Tf
4.002 0 TD
-0.0306 Tc
[(Pa)-31.8(t)]TJ
/F9 1 Tf
6.9739 0 0 6.9739 217.98 188.7601 Tm
0 Tc
(n)Tj
/F12 1 Tf
4.9813 0 0 4.9813 222.9 191.1001 Tm
(a)Tj
0.7709 -0.3252 TD
(i)Tj
0.6384 0.3252 TD
-0.0007 Tc
[(,j)9.4(,s)]TJ
/F6 1 Tf
9.9626 0 0 9.9626 241.68 191.0401 Tm
0 Tc
(\()Tj
ET
245.58 199.56 5.94 -0.42 re
f
BT
/F5 1 Tf
9.9626 0 0 9.9626 245.58 191.0401 Tm
()Tj
/F6 1 Tf
0.5902 0 TD
(\))Tj
/TT4 1 Tf
0.3915 0 TD
[(,)-307.1(starting)-307.1(from)-313.2(Lemma)-313.2(1)-307.1(w)0(e)-307.1(can)-307.1(sho)24.1(w)-307.1(that)-307.1(there)-313.2(e)12(xist)-301.1(a)]TJ
-12.1052 -1.2045 TD
(term)Tj
/F5 1 Tf
2.0734 0 TD
(M)Tj
/F10 1 Tf
1.3551 0 TD
()Tj
ET
178.32 187.62 5.94 -0.42 re
f
BT
/F5 1 Tf
9.9626 0 0 9.9626 178.3369 179.0401 Tm
()Tj
/TT4 1 Tf
0.8371 0 TD
[(and)-234.9(a)-234.9(deduction)-240.9(tree)]TJ
/F5 1 Tf
8.2751 0 TD
()Tj
/TT4 1 Tf
0.7889 0 TD
[(such)-234.9(that:)-240.9(1\))]TJ
/F5 1 Tf
5.16 0 TD
()Tj
/F6 1 Tf
0.5541 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
0.0004 Tc
[(,)-167.5(n)]TJ
/F9 1 Tf
6.9739 0 0 6.9739 354.24 182.7001 Tm
0 Tc
(a)Tj
/F12 1 Tf
4.9813 0 0 4.9813 358.56 181.6801 Tm
(i)Tj
/F9 1 Tf
6.9739 0 0 6.9739 361.62 182.7001 Tm
-0.0027 Tc
(,j,s)Tj
/F6 1 Tf
9.9626 0 0 9.9626 373.86 179.0401 Tm
0 Tc
(\))Tj
/TT4 1 Tf
0.6263 0 TD
[(yields)-234.9(message)]TJ
/F5 1 Tf
6.2401 0 TD
(M)Tj
/TT4 1 Tf
1.3189 0 TD
[(and)-240.9(2\))]TJ
-15.3281 -2.9992 TD
(10)Tj
ET
endstream
endobj
61 0 obj
<<
/ProcSet [/PDF /Text ]
/Font <<
/F2 5 0 R
/F5 16 0 R
/F6 17 0 R
/F7 18 0 R
/F8 23 0 R
/F9 24 0 R
/F10 25 0 R
/F11 26 0 R
/F12 27 0 R
/F14 32 0 R
/F21 45 0 R
/F22 46 0 R
/TT2 8 0 R
/TT4 9 0 R
/TT5 10 0 R
/TT7 19 0 R
>>
/ExtGState <<
/GS1 11 0 R
>>
>>
endobj
63 0 obj
<<
/Length 17028
>>
stream
BT
/TT4 1 Tf
9.9626 0 0 9.9626 134.76 716.16 Tm
0 g
/GS1 gs
0 Tc
0 Tw
(for)Tj
/F5 1 Tf
1.4009 0 TD
(n)Tj
/F10 1 Tf
0.8793 0 TD
()Tj
/F6 1 Tf
T*
(=)Tj
/F5 1 Tf
1.0539 0 TD
(n)Tj
/F9 1 Tf
6.9739 0 0 6.9739 173.94 719.8201 Tm
(a)Tj
/F12 1 Tf
4.9813 0 0 4.9813 178.26 718.8 Tm
(i)Tj
/F9 1 Tf
6.9739 0 0 6.9739 181.44 719.8201 Tm
-0.0027 Tc
(,j,s)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 193.68 716.16 Tm
0 Tc
(,)Tj
/F5 1 Tf
0.4789 0 TD
()Tj
/F6 1 Tf
0.5541 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
0.0004 Tc
[(,)-167.5(n)]TJ
/F6 1 Tf
1.6442 0 TD
0 Tc
(\))Tj
/TT4 1 Tf
0.6143 0 TD
[(does)-228.9(not)-234.9(yield)]TJ
/F5 1 Tf
5.809 0 TD
(M)Tj
/TT4 1 Tf
1.078 0 TD
[(.)-228.9(Since)]TJ
/F5 1 Tf
2.9354 0 TD
(M)Tj
/F10 1 Tf
1.3551 0 TD
()Tj
ET
351.24 724.74 5.94 -0.42 re
f
BT
/F5 1 Tf
9.9626 0 0 9.9626 351.1484 716.16 Tm
()Tj
/TT4 1 Tf
0.5962 0 TD
[(,)-228.9(w)0(e)-234.9(kno)24.1(w)-228.9(that)-234.9(there)-234.9(also)-228.9(e)12(xists)]TJ
-22.3162 -1.1985 TD
[(a)-246.9(deduction)-252.9(tree)]TJ
/F5 1 Tf
6.6325 0 TD
()Tj
/TT4 1 Tf
0.8552 0 TD
[(such)-246.9(that)]TJ
/F5 1 Tf
3.8324 0 TD
()Tj
/F6 1 Tf
0.6083 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
()Tj
/F6 1 Tf
0.5962 0 TD
(\))Tj
/TT4 1 Tf
0.6324 0 TD
(yields)Tj
/F5 1 Tf
2.6356 0 TD
(M)Tj
/TT4 1 Tf
1.078 0 TD
(.)Tj
-15.7625 -1.1985 TD
[(Based)-319.2(on)-319.2(the)-325.2(abo)12(v)12(e)0(,)-313.2(w)0(e)-319.2(construct)-319.2(a)-325.2(t)0(w)12(o-stage)-319.2(adv)12(ersary)-319.2(ag)6(ainst)-319.2(secrec)12(y)-313.2(o)0(f)-325.2(nonce)]TJ
/F5 1 Tf
-1.4996 -1.1985 TD
(X)Tj
/F9 1 Tf
6.9739 0 0 6.9739 143.82 685.0801 Tm
(j)Tj
-0.1118 -1.1013 TD
(A)Tj
/F12 1 Tf
4.9813 0 0 4.9813 149.04 676.38 Tm
(i)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 152.64 680.34 Tm
0.2469 Tc
[(.I)246.9(nt)246.9(h)246.9(e)]TJ
/TT5 1 Tf
3.0394 0 TD
0 Tc
()Tj
/TT4 1 Tf
0.5562 0 TD
[(rst)-246.9(stage,)-240.9(the)-240.9(adv)12(ersary)-240.9(produces)-240.9(a)-240.9(computational)-246.9(representation)]TJ
/F5 1 Tf
25.7788 0 TD
()Tj
/F11 1 Tf
6.9739 0 0 6.9739 451.44 683.9401 Tm
(c)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 457.68 680.34 Tm
[(of)-246.9(the)]TJ
-32.4131 -1.2045 TD
(trace)Tj
/F5 1 Tf
2.2556 0 TD
()Tj
/TT4 1 Tf
0.9094 0 TD
[(\(by)-319.2(simply)-319.2(follo)24.1(wing)-319.2(the)-313.2(instructions)-313.2(of)-319.2(the)-313.2(Dole)24.1(v-Y)102.4(ao)-319.2(adv)12(ersary)-307.1(that)-313.2(de)]TJ
/TT5 1 Tf
29.6533 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
(nes)Tj
/F5 1 Tf
-33.3745 -1.1985 TD
()Tj
/TT4 1 Tf
0.5962 0 TD
[(\).)-265(Once)]TJ
/F5 1 Tf
3.2229 0 TD
()Tj
/TT4 1 Tf
0.8672 0 TD
[(is)-265(created,)-265(it)-271(requests)-265(the)-265(tw)12(o)-271(v)24.1(alues)-265(of)-271(the)-265(nonce)]TJ
/F5 1 Tf
19.9863 0 TD
(n)Tj
/F9 1 Tf
6.9739 0 0 6.9739 386.82 660 Tm
(a)Tj
/F12 1 Tf
4.9813 0 0 4.9813 391.14 658.98 Tm
(i)Tj
/F9 1 Tf
6.9739 0 0 6.9739 394.32 660 Tm
-0.0027 Tc
(,j,s)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 409.26 656.4 Tm
0 Tc
[(and)-265(recei)24.1(v)12(e)0(s)-259(from)]TJ
-27.5529 -1.1985 TD
[(the)-283.1(e)12(xperiment)]TJ
/F5 1 Tf
6.2738 0 TD
(n)Tj
/F9 1 Tf
6.9739 0 0 6.9739 203.28 642.96 Tm
(b)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 210.06 644.46 Tm
(and)Tj
/F5 1 Tf
1.7269 0 TD
(n)Tj
/F2 1 Tf
6.9739 0 0 6.9739 233.28 642.96 Tm
(1)Tj
/F7 1 Tf
0.5679 0 TD
()Tj
/F9 1 Tf
0.8949 0 TD
(b)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 247.5 644.46 Tm
[(.)-277(Then)-289.1(it)-283.1(computes)]TJ
/F5 1 Tf
7.8251 0 TD
(m)Tj
/F9 1 Tf
6.9739 0 0 6.9739 334.26 642.96 Tm
(b)Tj
/F6 1 Tf
9.9626 0 0 9.9626 341.64 644.46 Tm
(=)Tj
/F5 1 Tf
1.1202 0 TD
()Tj
/F6 1 Tf
0.5541 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
()Tj
/F11 1 Tf
6.9739 0 0 6.9739 368.16 648.0601 Tm
(c)Tj
/F5 1 Tf
9.9626 0 0 9.9626 371.88 644.46 Tm
0.1679 Tc
(,n)Tj
/F9 1 Tf
6.9739 0 0 6.9739 382.32 642.96 Tm
0 Tc
(b)Tj
/F6 1 Tf
9.9626 0 0 9.9626 386.28 644.46 Tm
(\))Tj
/TT4 1 Tf
0.6745 0 TD
(for)Tj
/F5 1 Tf
1.4551 0 TD
(b)Tj
/F6 1 Tf
0.7709 0 TD
0.3364 Tc
(=0)Tj
/F5 1 Tf
1.614 0 TD
0 Tc
(,)Tj
/F6 1 Tf
0.4457 0 TD
(1)Tj
/TT4 1 Tf
0.7829 0 TD
(and)Tj
/F5 1 Tf
1.7269 0 TD
(m)Tj
/F6 1 Tf
1.2226 0 TD
(=)Tj
/F5 1 Tf
-33.939 -1.1985 TD
()Tj
/F6 1 Tf
0.6083 0 TD
(\()Tj
/F5 1 Tf
0.3915 0 TD
()Tj
/F11 1 Tf
6.9739 0 0 6.9739 150.66 636.1201 Tm
(c)Tj
/F6 1 Tf
9.9626 0 0 9.9626 154.38 632.52 Tm
(\))Tj
/TT4 1 Tf
0.3915 0 TD
[(,)-246.9(and)-246.9(retrie)24.1(v)12(e)0(s)]TJ
/F5 1 Tf
5.8409 0 TD
(b)Tj
/TT4 1 Tf
0.6805 0 TD
[(by)-246.9(comparing)]TJ
/F5 1 Tf
5.7762 0 TD
(m)Tj
/TT4 1 Tf
1.1262 0 TD
(with)Tj
/F5 1 Tf
2.0308 0 TD
(m)Tj
/F2 1 Tf
6.9739 0 0 6.9739 321.06 631.02 Tm
(0)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 328.02 632.52 Tm
(and)Tj
/F5 1 Tf
1.6908 0 TD
(m)Tj
/F2 1 Tf
6.9739 0 0 6.9739 353.64 631.02 Tm
(1)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 358.08 632.52 Tm
(.)Tj
/TT2 1 Tf
11.9552 0 0 11.9552 134.76 602.7001 Tm
[(5)-998.7(Decidability)-256(of)-250.9(Symbolic)-250.9(Secr)20.1(ecy)]TJ
/TT4 1 Tf
9.9626 0 0 9.9626 134.76 580.92 Tm
[(In)-361.3(this)-361.4(section,)-349.3(we)-361.3(sho)24.1(w)-355.3(that)-361.4(our)-361.4(notion)-361.4(of)-361.3(secrec)12(y)-349.3(i)0(s)-355.3(decidable.)-355.3(W)78.3(e)-355.3(present)-355.3(an)-355.3(NP-)]TJ
0 -1.1985 TD
[(procedure)-228.9(that)-234.9(decides)-222.8(nonce)-234.9(non-secrec)12(y)-222.8(for)-234.9(the)-228.9(case)-228.9(of)-228.9(a)-234.9(bounded)-228.9(number)-234.9(of)-234.9(sessions)]TJ
0 -1.2045 TD
[(\(that)-252.9(is,)-246.9(adv)12(ersaries)-240.9(are)-246.9(allo)24.1(wed)-246.9(only)-252.9(a)]TJ
/TT5 1 Tf
15.5533 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(x)12(e)0(d)-246.9(number)-252.9(of)]TJ
/F21 1 Tf
6.0723 0 TD
0.0012 Tc
(new)Tj
/TT4 1 Tf
2.2585 0 TD
0 Tc
(queries\))Tj
6.9739 0 0 6.9739 410.46 560.64 Tm
(6)Tj
9.9626 0 0 9.9626 149.7 545.04 Tm
[(W)42.2(ithout)-271(loss)-265(of)-265(generality)66.2(,)-265(w)0(e)-265(assume)-259(that)-265(all)-265(of)-271(the)]TJ
/F21 1 Tf
21.1256 0 TD
0.0012 Tc
(new)Tj
/TT4 1 Tf
2.2765 0 TD
0 Tc
[(queries)-265(are)-265(performed)-271(at)]TJ
-24.9018 -1.1985 TD
[(the)-246.9(be)12(ginning)-246.9(of)-246.9(the)-246.9(e)12(x)12(ecution.)-234.9(Our)-246.9(decision)-240.9(procedure)-246.9(starts)-240.9(by)-246.9(guessing)-240.9(the)-246.9(sequence)]TJ
T*
[(of)-331.2(these)-319.2(requests)-319.2(together)-325.2(with)-331.2(the)-325.2(identities)-325.2(of)-325.2(the)-325.2(agents)-325.2(in)42.2(v)18.1(olv)12(ed.)-319.2(Then,)-325.2(the)-325.2(proce-)]TJ
0 -1.2045 TD
[(dure)-325.2(guesses)-313.2(an)-319.2(interlea)18.1(ving)-325.2(for)-325.2(the)-325.2(e)12(x)12(ecution.)-307.1(Using)-325.2(standard)-319.2(techniques)-319.2([15],)-644.4(such)]TJ
0 -1.1985 TD
[(e)12(x)12(ecutions)-240.9(can)-246.9(be)-246.9(translated)-246.9(to)-252.9(constraint)-246.9(systems.)-240.9(W)78.3(e)-246.9(recall)-246.9(their)-252.9(de)]TJ
/TT5 1 Tf
27.3844 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
(nition:)Tj
/TT2 1 Tf
-27.9406 -1.6863 TD
(De)Tj
/TT8 1 Tf
1.166 0 TD
()Tj
/TT2 1 Tf
0.5562 0 TD
[(nition)-259(5.)]TJ
/TT7 1 Tf
4.0038 0 TD
(A)Tj
/TT4 1 Tf
0.93 0 TD
[(constraint)-307.1(system)]TJ
/F5 1 Tf
7.3415 0 TD
(C)Tj
/TT7 1 Tf
1.0961 0 TD
[(is)-313.2(a)]TJ
/TT9 1 Tf
1.7933 0 TD
()Tj
/TT7 1 Tf
0.5 0 TD
[(nite)-313.2(set)-307.1(of)-313.2(e)18.1(xpr)36.1(essions)]TJ
/F5 1 Tf
9.2286 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 405.9 478.92 Tm
(i)Tj
/F23 1 Tf
9.9626 0 0 9.9626 413.16 480.42 Tm
()Tj
/F5 1 Tf
1.1142 0 TD
-0.1684 Tc
(tt)Tj
/TT7 1 Tf
0.8672 0 TD
0 Tc
(or)Tj
/F5 1 Tf
1.2023 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 450.72 478.92 Tm
(i)Tj
/F23 1 Tf
9.9626 0 0 9.9626 457.98 480.42 Tm
()Tj
/F5 1 Tf
1.1142 0 TD
(u)Tj
/F9 1 Tf
6.9739 0 0 6.9739 474.78 478.92 Tm
(i)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 478.08 480.42 Tm
(,)Tj
-34.4607 -1.2045 TD
[(wher)36.1(e)]TJ
/F5 1 Tf
2.7028 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 167.58 466.92 Tm
(i)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 173.94 468.42 Tm
[(is)-301.1(a)-301.1(non)-307.1(empty)-301.1(set)-301.1(of)-301.1(terms,)]TJ
/F5 1 Tf
11.5234 0 TD
-0.1684 Tc
(tt)Tj
/TT7 1 Tf
0.8612 0 TD
0 Tc
[(is)-301.1(a)-301.1(special)-301.1(symbol)-301.1(that)-301.1(r)36.1(epr)36.1(esents)-289.1(an)-307.1(always)]TJ
-16.3173 -1.1985 TD
[(deducible)-246.9(term,)-246.9(and)-246.9(\(for)]TJ
/F6 1 Tf
9.9639 0 TD
(1)Tj
/F10 1 Tf
0.7769 0 TD
( )Tj
/F5 1 Tf
1.0539 0 TD
(i)Tj
/F10 1 Tf
0.6203 0 TD
( )Tj
/F5 1 Tf
1.06 0 TD
(n)Tj
/TT7 1 Tf
0.6023 0 TD
(\))Tj
/F5 1 Tf
0.5799 0 TD
(u)Tj
/F9 1 Tf
6.9739 0 0 6.9739 286.56 454.9801 Tm
(i)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 292.38 456.4801 Tm
[(is)-246.9(a)-252.9(term)-246.9(suc)12(h)-240.9(that:)]TJ
-14.9539 -1.7345 TD
(-)Tj
/F5 1 Tf
0.8329 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 157.5 437.7001 Tm
(i)Tj
/F10 1 Tf
9.9626 0 0 9.9626 163.62 439.2001 Tm
()Tj
/F5 1 Tf
1.0539 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 179.94 437.7001 Tm
(i)Tj
/F2 1 Tf
0.4044 0 TD
0.0007 Tc
(+1)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 193.32 439.2001 Tm
0 Tc
[(,)-252.9(for)-246.9(all)]TJ
/F6 1 Tf
3.2255 0 TD
(1)Tj
/F10 1 Tf
0.7769 0 TD
( )Tj
/F5 1 Tf
1.0539 0 TD
(i)Tj
/F10 1 Tf
0.6203 0 TD
( )Tj
/F5 1 Tf
1.06 0 TD
(n)Tj
/F10 1 Tf
0.8191 0 TD
()Tj
/F6 1 Tf
0.9997 0 TD
(1)Tj
/TT7 1 Tf
0.4999 0 TD
(;)Tj
-14.066 -1.1443 TD
0.4999 Tc
[(-i)499.9(f)]TJ
/F5 1 Tf
1.6716 0 TD
0 Tc
(x)Tj
/F10 1 Tf
0.9034 0 TD
()Tj
/F6 1 Tf
0.9937 0 TD
-0.052 Tc
[(va)-51.9(r)-51.8(\()]TJ
/F5 1 Tf
1.7586 0 TD
0 Tc
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 202.26 426.3 Tm
(i)Tj
/F6 1 Tf
9.9626 0 0 9.9626 205.56 427.8 Tm
(\))Tj
/TT7 1 Tf
0.6625 0 TD
(then)Tj
/F10 1 Tf
1.9987 0 TD
()Tj
/F5 1 Tf
0.5541 0 TD
0.3892 Tc
[(j<)58.8(i)]TJ
/TT7 1 Tf
2.5355 0 TD
0 Tc
[(suc)12(h)-271(that)]TJ
/F5 1 Tf
3.9307 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 307.86 426.3 Tm
(j)Tj
/F6 1 Tf
9.9626 0 0 9.9626 315.3 427.8 Tm
0.3304 Tc
[(=m)332.6(i)331.1(n)]TJ
/F10 1 Tf
2.7764 0 TD
0 Tc
({)Tj
/F5 1 Tf
0.4999 0 TD
(T)Tj
/F10 1 Tf
0.9997 0 TD
(|)Tj
/F5 1 Tf
0.5601 0 TD
(T)Tj
/F23 1 Tf
0.9997 0 TD
()Tj
/F5 1 Tf
0.9997 0 TD
(u)Tj
/F10 1 Tf
0.8492 0 TD
()Tj
/F5 1 Tf
0.9455 0 TD
0.02 Tc
[(C,)-147.9(x)]TJ
/F10 1 Tf
2.0236 0 TD
0 Tc
()Tj
/F6 1 Tf
0.9455 0 TD
-0.052 Tc
[(va)-51.9(r)-45.8(\()]TJ
/F5 1 Tf
1.7526 0 TD
0 Tc
(u)Tj
/F6 1 Tf
0.5721 0 TD
(\))Tj
/F10 1 Tf
0.3915 0 TD
(})Tj
/TT7 1 Tf
0.7769 0 TD
(\(for)Tj
-31.5159 -1.2045 TD
[(the)-252.9(inclusion)-246.9(r)36.1(elation\))-252.9(and)]TJ
/F5 1 Tf
10.8513 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 265.62 414.3 Tm
(j)Tj
/F13 1 Tf
9.9626 0 0 9.9626 272.58 415.8 Tm
()Tj
/F5 1 Tf
1.06 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 288.96 414.3 Tm
(i)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 292.26 415.8 Tm
(.)Tj
-15.8091 -1.7887 TD
(The)Tj
/TT4 1 Tf
1.8252 0 TD
[(left-hand)-331.2(side)]TJ
/TT7 1 Tf
5.8767 0 TD
(\()Tj
/TT4 1 Tf
0.333 0 TD
[(right-hand)-331.2(side)]TJ
/TT7 1 Tf
6.1076 0 TD
[(\))-325.2(o)0(f)-331.2(a)-325.2(constr)12(aint)]TJ
/F5 1 Tf
6.9613 0 TD
(T)Tj
/F23 1 Tf
1.1443 0 TD
()Tj
/F5 1 Tf
1.1383 0 TD
(u)Tj
/TT7 1 Tf
0.9034 0 TD
(is)Tj
/F5 1 Tf
0.9922 0 TD
(T)Tj
/TT7 1 Tf
1.0479 0 TD
[(\(r)36.1(espectively)]TJ
/F5 1 Tf
5.391 0 TD
(u)Tj
/TT7 1 Tf
0.5721 0 TD
[(\).)-325.2(The)]TJ
/TT4 1 Tf
-32.293 -1.1985 TD
[(left-hand)-240.9(side)]TJ
/TT7 1 Tf
5.696 0 TD
[(of)-240.9(a)-240.9(constr)12(aint)-228.9(system)]TJ
/F5 1 Tf
8.933 0 TD
(C)Tj
/TT7 1 Tf
0.789 0 TD
[(,)-228.9(\(for)-240.9(whic)12(h)-234.9(w)0(e)-234.9(write)]TJ
/F24 1 Tf
8.4675 0 TD
-0.0009 Tc
(lhs)Tj
/F6 1 Tf
1.2587 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
(C)Tj
/F6 1 Tf
0.789 0 TD
(\))Tj
/TT7 1 Tf
0.3915 0 TD
[(\),)-228.9(is)-234.9(the)-240.9(maximal)-234.9(set)]TJ
-26.7161 -1.1985 TD
[(of)-252.9(messa)12(g)12(e)0(s)]TJ
/F5 1 Tf
5.0249 0 TD
(T)Tj
/F9 1 Tf
6.9739 0 0 6.9739 190.74 372.6001 Tm
(n)Tj
/TT7 1 Tf
9.9626 0 0 9.9626 196.2 374.1001 Tm
0.2469 Tc
[(.B)246.9(y)]TJ
/F10 1 Tf
1.7985 0 TD
0 Tc
()Tj
/TT7 1 Tf
1.0299 0 TD
[(we)-246.9(denote)-246.9(the)-246.9(unsatis)]TJ
/TT9 1 Tf
8.5728 0 TD
()Tj
/TT7 1 Tf
0.5 0 TD
[(able)-246.9(system.)]TJ
/TT4 1 Tf
-18.0682 -1.6923 TD
[(The)-240.9(left-hand)-246.9(side)-234.9(of)-240.9(a)-240.9(constraint)-481.8(represents)-234.9(the)-240.9(messages)-228.9(already)-240.9(sent)-234.9(on)-240.9(the)-240.9(netw)12(ork,)]TJ
0 -1.1985 TD
[(while)-283.1(the)-277(right-hand)-283.1(side)-277(represents)-277(the)-277(message)-271(e)12(xpected)-277(by)-277(an)-277(agent)-283.1(in)-277(order)-283.1(to)-283.1(per)18.1(-)]TJ
T*
[(form)-210.8(the)-204.8(ne)12(xt)-204.8(protocol)-210.8(step.)-403.5(A)]TJ
/TT7 1 Tf
12.2301 0 TD
(solution)Tj
/TT4 1 Tf
3.4334 0 TD
[(of)-210.8(a)-204.8(constraint)-204.8(system)]TJ
/F5 1 Tf
8.8171 0 TD
(C)Tj
/TT4 1 Tf
0.9937 0 TD
[(is)-204.8(a)-204.8(ground)-210.8(substitution)]TJ
/F5 1 Tf
-25.4743 -1.1985 TD
()Tj
/TT4 1 Tf
0.8191 0 TD
[(such)-210.8(that)]TJ
/F5 1 Tf
3.7541 0 TD
0.1383 Tc
(T)Tj
/F10 1 Tf
1.608 0 TD
0 Tc
()Tj
/F11 1 Tf
6.9739 0 0 6.9739 202.44 319.92 Tm
0.0006 Tc
(Rand)Tj
/F12 1 Tf
4.9813 0 0 4.9813 218.46 318.8401 Tm
-0.0044 Tc
(adv)Tj
/F5 1 Tf
9.9626 0 0 9.9626 233.58 321.42 Tm
-0.0003 Tc
(u)Tj
/TT4 1 Tf
1.3912 0 TD
0 Tc
[(for)-210.8(an)12(y)]TJ
/F5 1 Tf
3.0194 0 TD
(T)Tj
/F23 1 Tf
0.9997 0 TD
()Tj
/F5 1 Tf
0.9997 0 TD
(u)Tj
/F10 1 Tf
0.8492 0 TD
()Tj
/F5 1 Tf
0.9455 0 TD
(C)Tj
/TT4 1 Tf
0.7889 0 TD
[(.)-204.8(W)78.3(e)-210.8(say)-204.8(that)]TJ
/F5 1 Tf
5.223 0 TD
(C)Tj
/TT7 1 Tf
0.9997 0 TD
[(pr)36.1(eserves)-198.7(nonce)-204.8(secr)36.1(ecy)]TJ
/TT4 1 Tf
-25.1356 -1.3069 TD
(of)Tj
/F5 1 Tf
1.086 0 TD
(n)Tj
/TT4 1 Tf
0.8492 0 TD
[(if)-252.9(there)-246.9(does)-246.9(not)-252.9(e)12(xist)-246.9(a)-246.9(solution)]TJ
/F5 1 Tf
13.0099 0 TD
()Tj
/TT4 1 Tf
0.8552 0 TD
(of)Tj
/F5 1 Tf
1.086 0 TD
(C)Tj
/TT4 1 Tf
1.0359 0 TD
[(such)-246.9(that)]TJ
/F5 1 Tf
3.8264 0 TD
(n)Tj
/TT4 1 Tf
0.8492 0 TD
[(occurs)-246.9(in)]TJ
/F8 1 Tf
3.8876 0 TD
-0.0306 Tc
[(Pa)-31.9(t)]TJ
/F9 1 Tf
6.9739 0 0 6.9739 413.16 306.9001 Tm
0 Tc
(n)Tj
/F6 1 Tf
9.9626 0 0 9.9626 418.62 308.4001 Tm
(\()Tj
ET
422.52 317.46 34.2 -0.42 re
f
BT
/F24 1 Tf
9.9626 0 0 9.9626 422.52 308.4001 Tm
-0.0009 Tc
(lhs)Tj
/F6 1 Tf
1.2527 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
(C)Tj
/F6 1 Tf
0.789 0 TD
(\))Tj
/F5 1 Tf
0.3915 0 TD
()Tj
/F6 1 Tf
0.6023 0 TD
(\))Tj
/TT4 1 Tf
0.3915 0 TD
(.)Tj
-31.2026 -1.2045 TD
[(The)-204.8(transformation)-204.8(of)-204.8(protocols)-198.7(into)-204.8(constraint)-198.7(systems)-198.7(yields)-198.7(systems)-192.7(that)-198.7(are)-204.8(well-)]TJ
-1.4996 -1.1985 TD
[(formed.)-228.9(A)-228.9(constraint)-228.9(system)]TJ
/F5 1 Tf
11.4905 0 TD
(E)Tj
/TT4 1 Tf
1.0238 0 TD
(is)Tj
/TT7 1 Tf
0.8958 0 TD
(well-formed)Tj
/TT4 1 Tf
5.0855 0 TD
[(if)-228.9(1\))-234.9(an)12(y)-222.8(subterm)-228.9(of)]TJ
/F5 1 Tf
8.0746 0 TD
(E)Tj
/TT4 1 Tf
1.0238 0 TD
[(of)-234.9(the)-222.8(form)]TJ
/F8 1 Tf
4.6911 0 TD
0.0013 Tc
(dk)Tj
/F6 1 Tf
1.0058 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
(t)Tj
/F7 1 Tf
6.9739 0 0 6.9739 473.94 288.0601 Tm
()Tj
/F6 1 Tf
9.9626 0 0 9.9626 476.7 284.4601 Tm
(\))Tj
/TT4 1 Tf
-34.3222 -1.1985 TD
[(is)-295.1(such)-295.1(that)]TJ
/F5 1 Tf
4.8848 0 TD
(t)Tj
/F7 1 Tf
6.9739 0 0 6.9739 187.08 276.1201 Tm
()Tj
/TT4 1 Tf
9.9626 0 0 9.9626 192.84 272.5201 Tm
[(is)-295.1(an)-289.1(agent)-295.1(identity)-301.1(and)-295.1(2\))-295.1(an)12(y)-295.1(subterm)-295.1(of)]TJ
/F5 1 Tf
17.2568 0 TD
(E)Tj
/TT4 1 Tf
1.0901 0 TD
[(of)-295.1(the)-301.1(form)]TJ
/F10 1 Tf
4.8959 0 TD
({)Tj
/F5 1 Tf
0.4999 0 TD
(t)Tj
/F2 1 Tf
6.9739 0 0 6.9739 432.96 271.0201 Tm
(1)Tj
/F10 1 Tf
9.9626 0 0 9.9626 437.4 272.5201 Tm
(})Tj
/F9 1 Tf
6.9739 0 0 6.9739 442.38 276.1201 Tm
(r)Tj
0 -0.869 TD
(t)Tj
/F20 1 Tf
4.9813 0 0 4.9813 445.38 269.0401 Tm
(2)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 452.76 272.5201 Tm
[(is)-289.1(such)]TJ
-31.9193 -1.1985 TD
(that)Tj
/F5 1 Tf
1.7284 0 TD
(r)Tj
/F10 1 Tf
0.7528 0 TD
()Tj
/F8 1 Tf
0.9455 0 TD
0.0006 Tc
(Rand)Tj
/TT4 1 Tf
2.3849 0 TD
0 Tc
(and)Tj
/F5 1 Tf
1.6727 0 TD
0.4161 Tc
(r/)Tj
/F10 1 Tf
0.7528 0 TD
0 Tc
()Tj
/F8 1 Tf
0.9455 0 TD
0.0006 Tc
(Rand)Tj
/F9 1 Tf
6.9739 0 0 6.9739 247.8 259.0801 Tm
-0.0006 Tc
(adv)Tj
/TT4 1 Tf
9.9626 0 0 9.9626 261 260.5801 Tm
0 Tc
[(.)-451.7(The)-222.8(follo)24.1(wing)-234.9(theorem)-222.8(states)-222.8(that)-222.8(our)-228.9(notion)-228.9(of)-228.9(nonce)]TJ
-12.6713 -1.2045 TD
[(secrec)12(y)-240.9(\(Section)-252.9(3\))-252.9(is)-246.9(decidable)-246.9(for)-252.9(a)-246.9(bounded)-246.9(number)-252.9(of)-252.9(sessions.)]TJ
/TT2 1 Tf
0 -1.6863 TD
[(Theor)18.1(em)-246.9(2.)]TJ
/TT7 1 Tf
5.3664 0 TD
[(The)-246.9(following)-252.9(pr)42.2(oblem)-246.9(is)-246.9(co-NP)-252.9(complete:)]TJ
/TT2 1 Tf
-3.9451 -1.1985 TD
[(Gi)12(v)12(en:)]TJ
/TT7 1 Tf
3.1235 0 TD
[(A)-252.9(well-formed)-246.9(constr)12(aint)-246.9(system)]TJ
/F5 1 Tf
13.1407 0 TD
(C)Tj
/TT7 1 Tf
1.0359 0 TD
[(and)-246.9(a)-499.9(nonce)]TJ
/F5 1 Tf
5.3874 0 TD
(n)Tj
/TT7 1 Tf
0.6023 0 TD
(.)Tj
/TT2 1 Tf
-23.2898 -1.1985 TD
(Decide:)Tj
/TT7 1 Tf
3.4736 0 TD
(Does)Tj
/F5 1 Tf
2.2961 0 TD
(C)Tj
/TT7 1 Tf
1.0359 0 TD
[(pr)36.1(eserve)-234.9(the)-252.9(nonce)-246.9(secr)36.1(ecy)-234.9(of)]TJ
/F5 1 Tf
11.9779 0 TD
(n)Tj
/TT7 1 Tf
0.6023 0 TD
(?)Tj
ET
134.76 200.94 56.7 -0.42 re
f
BT
/TT4 1 Tf
5.9776 0 0 5.9776 139.02 193.8001 Tm
(6)Tj
8.9664 0 0 8.9664 144.72 190.0201 Tm
[(As)-214.1(for)-207.4(the)-214.1(standard)-207.4(deducibility-based)-194.1(notions,)-200.7(nonce)-214.1(secrec)13.4(y)-220.8(i)0(s)-214.1(undecidable)-207.4(for)-207.4(an)-214.1(unbounded)]TJ
0 -1.2246 TD
[(number)-247.6(of)-247.6(sessions.)]TJ
9.9626 0 0 9.9626 302.7 149.1601 Tm
(11)Tj
ET
endstream
endobj
64 0 obj
<<
/ProcSet [/PDF /Text ]
/Font <<
/F2 5 0 R
/F5 16 0 R
/F6 17 0 R
/F7 18 0 R
/F8 23 0 R
/F9 24 0 R
/F10 25 0 R
/F11 26 0 R
/F12 27 0 R
/F13 31 0 R
/F20 38 0 R
/F21 45 0 R
/F23 47 0 R
/F24 65 0 R
/TT2 8 0 R
/TT4 9 0 R
/TT5 10 0 R
/TT7 19 0 R
/TT8 48 0 R
/TT9 49 0 R
>>
/ExtGState <<
/GS1 11 0 R
>>
>>
endobj
69 0 obj
<<
/Length 11304
>>
stream
BT
/TT4 1 Tf
9.9626 0 0 9.9626 134.76 716.16 Tm
0 g
/GS1 gs
0 Tc
0 Tw
[(The)-301.1(decision)-301.1(procedure)-301.1(for)-301.1(nonce)-301.1(secrec)12(y)-289.1(preserv)24.1(ation)-301.1(w)12(orks)-602.3(as)-295.1(follo)24.1(ws.)-301.1(First,)-301.1(gi)24.1(v)12(e)0(n)]TJ
0 -1.1985 TD
[(an)-283.1(arbitrary)-289.1(constraint)-283.1(system)-283.1(we)-277(reduce)-283.1(it)-289.1(to)-283.1(a)]TJ
/TT7 1 Tf
19.2689 0 TD
(solved)Tj
/TT4 1 Tf
2.8618 0 TD
[(system)-277(using)-283.1(non-deterministic)]TJ
-22.1307 -1.1985 TD
[(transformation)-210.8(rules)-204.8(similar)-204.8(to)-204.8(those)-204.8(in)-204.8([8].)-204.8(A)-204.8(constraint)-204.8(system)-198.7(is)]TJ
/TT7 1 Tf
26.0537 0 TD
(solved)Tj
/TT4 1 Tf
2.7835 0 TD
[(if)-204.8(it)-210.8(is)-198.7(dif)24.1(ferent)]TJ
-28.8372 -1.1985 TD
(from)Tj
/F10 1 Tf
2.1607 0 TD
()Tj
/TT4 1 Tf
0.9937 0 TD
[(and)-210.8(each)-210.8(of)-216.8(its)-210.8(constraints)-210.8(are)-216.8(of)-210.8(the)-216.8(form)]TJ
/F5 1 Tf
16.5262 0 TD
(T)Tj
/F23 1 Tf
0.9997 0 TD
()Tj
/F5 1 Tf
0.9997 0 TD
-0.1684 Tc
(tt)Tj
/TT4 1 Tf
0.7709 0 TD
0 Tc
(or)Tj
/F5 1 Tf
1.0498 0 TD
(T)Tj
/F23 1 Tf
0.9997 0 TD
()Tj
/F5 1 Tf
0.9997 0 TD
(x)Tj
/TT4 1 Tf
0.7889 0 TD
(where)Tj
/F5 1 Tf
2.6537 0 TD
(x)Tj
/TT4 1 Tf
0.7829 0 TD
[(is)-210.8(a)-216.8(v)24.1(ariable.)]TJ
-29.7258 -1.2045 TD
[(Second,)-271(we)-277(check)-271(whether)]TJ
/F5 1 Tf
11.0082 0 TD
(n)Tj
/TT4 1 Tf
0.8793 0 TD
[(occurs)-271(in)]TJ
/F8 1 Tf
3.9357 0 TD
-0.0306 Tc
[(Pa)-31.8(t)]TJ
/F9 1 Tf
6.9739 0 0 6.9739 307.02 666.84 Tm
0 Tc
(n)Tj
/F6 1 Tf
9.9626 0 0 9.9626 312.48 668.34 Tm
(\()Tj
ET
1 i
316.38 677.04 28.14 0.42 re
f
BT
/F24 1 Tf
9.9626 0 0 9.9626 316.38 668.34 Tm
-0.0009 Tc
(lhs)Tj
/F6 1 Tf
1.2527 0 TD
0 Tc
(\()Tj
/F5 1 Tf
0.3915 0 TD
(C)Tj
/F6 1 Tf
0.789 0 TD
-0.0034 Tc
(\)\))Tj
/TT4 1 Tf
0.7769 0 TD
0 Tc
[(.)-271(I)0(f)-283.1(not,)-271(we)-277(check)-271(whether)]TJ
/F5 1 Tf
10.8123 0 TD
(C)Tj
/TT4 1 Tf
1.06 0 TD
(can)Tj
-33.3124 -1.1985 TD
[(further)-228.9(be)-228.9(simpli)]TJ
/TT5 1 Tf
6.6227 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(ed)-222.8(into)-228.9(a)-222.8(solv)12(ed)-222.8(form)-228.9(that)-228.9(does)-216.8(not)-228.9(preserv)12(e)-222.8(nonce)-216.8(secrec)12(y)66.2(,)-216.8(and)-222.8(so)-222.8(on.)]TJ
-7.1789 -1.1985 TD
[(Note)-210.8(that)-210.8(although)-210.8(for)-216.8(standard)-204.8(deducibility-based)-210.8(notions)-210.8(decision)-204.8(procedures)-210.8(can)-204.8(stop)]TJ
T*
[(as)-234.9(soon)-234.9(as)-234.9(the)-234.9(constraint)-240.9(system)-234.9(has)-228.9(been)-234.9(transformed)-240.9(into)-240.9(solv)12(ed)-234.9(form,)-240.9(for)-240.9(our)-240.9(secrec)12(y)]TJ
0 -1.2045 TD
[(notion)-277(further)-277(transformations)-271(might)-277(be)-271(necessary)66.2(.)-259(NP-hardness)-271(is)-271(pro)12(v)12(e)0(d)-265(analogously)]TJ
0 -1.1985 TD
[(to)-252.9(the)-246.9(case)-240.9(of)-252.9(standard)-246.9(deducibility-based)-252.9(notions)-246.9([16].)]TJ
/TT2 1 Tf
11.9552 0 0 11.9552 134.76 579.54 Tm
[(Refer)20.1(ences)]TJ
/TT4 1 Tf
8.9664 0 0 8.9664 139.26 560.22 Tm
[(1.)-555.4(M.)-361.3(Abadi)-361.3(and)-361.3(P)113.8(.)-368(Rog)6.7(a)13.4(w)6.7(ay)66.9(.)-722.7(Reconciling)-348(tw)6.7(o)-354.7(vie)26.8(ws)-361.4(of)-361.3(cryptograph)6.7(y)66.9(.)-716(In)]TJ
/TT7 1 Tf
31.4341 0 TD
[(IFIP)-368(TCS)-361.3(2000)]TJ
/TT4 1 Tf
6.3402 0 TD
(,)Tj
-36.4695 -1.2246 TD
[(v)20.1(olume)-247.6(1872)-240.9(of)]TJ
/TT7 1 Tf
6.5485 0 TD
(LNCS)Tj
/TT4 1 Tf
2.3901 0 TD
[(,)-247.6(pages)-247.6(322,)-247.6(August)-240.9(2000.)]TJ
-10.2435 -1.1376 TD
[(2.)-555.4(A.)-307.8(Armando,)-307.8(D.)-307.8(Basin,)-301.1(Y)127.1(.)-307.8(Boichut,)-301.1(Y)127.1(.)-301.1(Che)26.8(v)26.8(alier)40.1(,)-307.8(L)0(.)-314.5(Compagna,)-301.1(J.)-314.5(Cuellar)40.2(,)-301.1(P)113.8(.)-314.5(H)0(.)-307.8(Drielsma,)]TJ
1.3049 -1.2246 TD
-0.1138 Tc
[(P.)-348(H)-113.8(e)]TJ
2.1413 0.0067 TD
0 Tc
()Tj
-0.0535 -0.0067 TD
[(am,)-234.2(O.)-227.5(K)33.5(ouchnarenk)6.7(o,)-220.8(J.)-227.5(Manto)13.4(v)26.8(ani,)-220.8(S.)-227.5(M)]TJ
16.8563 0.0067 TD
()Tj
-0.0803 -0.0067 TD
[(odersheim,)-227.5(D.)-227.5(v)20.1(o)0(n)-227.5(Oheimb,)-220.8(M.)-234.2(Rusino)26.8(witch,)]TJ
-18.8638 -1.2246 TD
[(J.)-348(Santiago,)-334.6(M.)-341.3(T)46.8(uruani,)-341.3(L.)-348(V)60.2(i)0(g)6.7(a)0(n)]TJ
13.932 0.0067 TD
(`)Tj
-0.0803 -0.0067 TD
[(o,)-341.3(and)-341.3(L.)-348(V)60.2(igneron.)-642.4(The)-348(Avispa)-334.6(tool)-334.6(for)-341.3(the)-334.6(automated)]TJ
-13.8517 -1.2179 TD
[(v)26.8(alidation)-354.7(of)-368(internet)-361.4(security)-361.4(protocols)-354.7(and)-368(applications.)-736.1(In)]TJ
/TT7 1 Tf
25.3778 0 TD
[(CA)107.1(V)-368(2005)]TJ
/TT4 1 Tf
4.1497 0 TD
[(,)-368(v)20.1(olume)-361.3(3576)-361.4(of)]TJ
/TT7 1 Tf
-29.5274 -1.2246 TD
(LNCS)Tj
/TT4 1 Tf
2.3901 0 TD
[(,)-247.6(2005.)]TJ
-3.695 -1.1443 TD
[(3.)-555.4(M.)-281(Back)6.7(es)-281(and)-281(I.)-281.1(Christian)-267.7(Jacobi.)-461.7(Cryptographically)-254.3(sound)-274.4(and)-281(machine-assisted)-281(v)13.4(eri)]TJ
/TT5 1 Tf
36.2492 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
(ca-)Tj
-35.5005 -1.2179 TD
[(tion)-240.9(of)-247.6(security)-240.9(protocols.)-348(In)]TJ
/TT7 1 Tf
11.6838 0 TD
[(ST)46.8(A)26.8(C)0(S)-240.9(2003)]TJ
/TT4 1 Tf
5.0013 0 TD
[(,)-247.6(pages)-247.6(675686,)-240.9(2003.)]TJ
-17.99 -1.1443 TD
[(4.)-555.4(M.)-321.2(Back)6.7(es)-321.2(and)-321.2(B.)-327.9(P)]TJ
/TT5 1 Tf
9.5341 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(tzmann.)-588.9(Relating)-314.5(cryptographic)-307.8(und)-314.5(symbolic)-314.5(k)6.7(e)13.4(y)-314.5(secrec)13.4(y)66.9(.)-602.2(In)]TJ
/TT7 1 Tf
25.8035 0 TD
[(Pr)46.8(oc.)]TJ
-34.5888 -1.2246 TD
[(26th)-240.9(IEEE)-254.3(Symposium)-240.9(on)-247.6(Security)-247.6(and)-240.9(Privacy)-261(\(SSP05\))]TJ
/TT4 1 Tf
22.7273 0 TD
[(,)-240.9(pages)-247.6(171182,)-240.9(2005.)]TJ
-24.0322 -1.1376 TD
[(5.)-555.4(M.)-214.1(Bellare)-207.4(and)-214.1(P)113.8(.)-214.1(Rog)6.7(a)13.4(w)6.7(ay)66.9(.)-274.4(Entity)-200.7(authentication)-200.8(and)-207.4(k)6.7(e)13.4(y)-207.4(distrib)20.1(ution.)-254.3(In)]TJ
/TT7 1 Tf
30.4543 0 TD
(Crypto93)Tj
/TT4 1 Tf
4.1108 0 TD
[(,)-207.4(v)20.1(olume)]TJ
-33.2602 -1.2246 TD
[(773)-240.9(of)]TJ
/TT7 1 Tf
2.8215 0 TD
(LNCS)Tj
/TT4 1 Tf
2.3901 0 TD
[(,)-247.6(pages)-254.3(232249,)-240.9(1993.)]TJ
-6.5165 -1.1443 TD
[(6.)-555.4(B.)-341.3(Blanchet.)-642.4(An)-334.6(ef)]TJ
/TT5 1 Tf
9.3171 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(cient)-341.3(cryptographic)-327.9(protocol)-321.2(v)13.4(eri)]TJ
/TT5 1 Tf
13.3608 0 TD
()Tj
/TT4 1 Tf
0.5562 0 TD
[(er)-341.3(based)-341.3(on)-334.6(Prolog)-327.9(rules.)-642.4(In)]TJ
/TT7 1 Tf
12.0762 0 TD
[(Pr)46.8(oc.)]TJ
-34.5616 -1.2179 TD
[(14th)-240.9(IEEE)-254.3(Computer)-240.9(Security)-247.6(F)107.1(oundations)-234.2(W)93.7(orkshop)-254.3(\(CSFW01\))]TJ
/TT4 1 Tf
26.2118 0 TD
[(,)-247.6(pages)-247.6(8296,)-247.6(2001.)]TJ
-27.5167 -1.1443 TD
[(7.)-555.4(R.)-301.1(Canetti)-294.4(and)-294.4(J.)-307.8(Herzog.)-521.9(Soundness)-294.4(of)-294.4(formal)-301.1(encryption)-287.7(in)-294.4(the)-301.1(presence)-301.1(of)-301.1(acti)26.8(v)13.4(e)-294.4(adv)13.4(er)20.1(-)]TJ
1.3049 -1.2246 TD
[(saries.)-361.4(In)]TJ
/TT7 1 Tf
3.9688 0 TD
[(TCC)-247.6(2006\))]TJ
/TT4 1 Tf
4.4707 0 TD
[(,)-240.9(LNCS,)-254.3(2006.)-354.7(T)80.3(o)-247.6(appear)53.5(.)]TJ
-9.7444 -1.1443 TD
[(8.)-555.4(H.)-287.7(Comon-Lundh)-267.7(and)-287.7(V)127.1(.)-287.7(Shmatik)6.7(o)13.4(v)66.9(.)-461.7(Intruder)-274.4(deductions,)-274.4(constraint)-274.4(solving)-274.4(and)-281(insecurity)]TJ
1.3049 -1.2179 TD
[(decision)-240.9(in)-247.6(presence)-254.3(of)-247.6(e)13.4(xclusi)26.8(v)13.4(e)-240.9(or)53.5(.)-361.3(I)0(n)]TJ
/TT7 1 Tf
15.8664 0 TD
[(LICS)-240.9(2003)]TJ
/TT4 1 Tf
4.2971 0 TD
[(,)-247.6(pages)-254.3(271280,)-234.2(2003.)]TJ
-21.4684 -1.1443 TD
[(9.)-555.4(V)127.1(.)-421.6(Cortier)40.1(,)-421.6(S)0(.)-421.6(Kremer)40.1(,)-435(R)0(.)-421.6(K)]TJ
13.1022 0.0067 TD
()Tj
-0.0803 -0.0067 TD
[(usters,)-428.3(and)-421.6(B.)-421.6(W)80.3(arinschi.)-916.8(Computationally)-401.5(sound)-421.6(symbolic)]TJ
-11.7171 -1.2246 TD
[(secrec)13.4(y)-361.3(i)0(n)-354.7(the)-354.7(presence)-361.3(of)-354.7(hash)-361.3(functions.)-695.9(Research)-361.3(Report)-348(2006/218,)-348(Cryptology)-334.6(ePrint)]TJ
0 -1.2179 TD
[(Archi)26.8(v)13.4(e)0(,)-247.6(June)-247.6(2006.)-354.7(31)-247.6(pages.)]TJ
-1.8067 -1.1443 TD
[(10.)-555.4(V)127.1(.)-247.6(Cortier)-240.9(and)-247.6(B.)-254.3(W)80.3(arinschi.)-354.7(Computationally)-227.5(Sound,)-247.6(Automated)-247.6(Proofs)-240.9(for)-247.6(Security)-240.9(Proto-)]TJ
1.8067 -1.2246 TD
[(cols.)-361.4(In)]TJ
/TT7 1 Tf
3.3028 0 TD
[(ESOP)-247.6(2005)]TJ
/TT4 1 Tf
4.6914 0 TD
[(,)-247.6(v)20.1(olume)-247.6(3444)-240.9(of)]TJ
/TT7 1 Tf
7.0461 0 TD
(LNCS)Tj
/TT4 1 Tf
2.3901 0 TD
[(,)-240.9(pages)-254.3(157171,)-240.9(2005.)]TJ
-19.2372 -1.1376 TD
[(11.)-555.4(S.)-348(Goldw)6.7(asser)-334.6(and)-341.3(S.)-348(Micali.)-655.8(Probabilistic)-327.9(encryption.)]TJ
/TT7 1 Tf
25.0225 0 TD
[(J)26.8(ournal)-341.3(of)-334.6(Computer)-334.6(and)-341.3(System)]TJ
-23.2158 -1.2246 TD
(Sciences)Tj
/TT4 1 Tf
3.4424 0 TD
[(,)-254.3(28:270299,)-234.2(1984.)]TJ
-5.2491 -1.1443 TD
[(12.)-555.4(P)113.8(.)-327.9(Gupta)-321.2(and)-321.2(V)127.1(.)-327.9(Shmatik)6.7(o)13.4(v)66.9(.)-588.9(T)80.3(o)26.8(w)6.7(ards)-321.2(computationally)-307.8(sound)-314.5(symbolic)-321.2(analysis)-321.2(of)-321.2(k)6.7(e)13.4(y)-314.5(e)13.4(x-)]TJ
1.8067 -1.2179 TD
[(change)-247.6(protocols.)-354.7(In)]TJ
/TT7 1 Tf
8.4861 0 TD
[(FMSE)-254.3(2005)]TJ
/TT4 1 Tf
4.809 0 TD
[(,)-240.9(pages)-254.3(2332,)-240.9(2005.)]TJ
-15.1018 -1.1443 TD
[(13.)-555.4(R.)-261(Jan)40.1(vier)40.1(,)-261(Y)127.1(.)-261(Lakhnech,)-261(and)-261(L.)-261(Mazar)]TJ
17.2845 0.0067 TD
()Tj
-0.0535 -0.0067 TD
[(e.)-401.5(Computational)-247.6(soundness)-254.3(of)-254.3(symbolic)-254.3(analysis)-261(for)]TJ
-15.4242 -1.2246 TD
[(protocols)-234.2(using)-247.6(hash)-247.6(functions.)-348(In)]TJ
/TT7 1 Tf
13.8513 0 TD
(ICS06)Tj
/TT4 1 Tf
2.833 0 TD
[(,)-240.9(2006.)-354.7(T)80.3(o)-254.3(appear)53.5(.)]TJ
-18.4911 -1.1376 TD
[(14.)-555.4(D.)-287.7(Micciancio)-281(and)-287.7(B.)-287.7(W)80.3(arinschi.)-475.1(Soundness)-281(of)-281.1(formal)-281(encryption)-274.4(in)-287.7(the)-281.1(presence)-294.4(of)-281.1(acti)26.8(v)13.4(e)]TJ
1.8067 -1.2246 TD
[(adv)13.4(ersaries.)-361.3(In)]TJ
/TT7 1 Tf
6.1761 0 TD
[(TCC)-247.6(2004)]TJ
/TT4 1 Tf
4.1377 0 TD
[(,)-240.9(v)20.1(olume)-247.6(2951)-240.9(of)]TJ
/TT7 1 Tf
7.0394 0 TD
(LNCS)Tj
/TT4 1 Tf
2.3901 0 TD
[(,)-247.6(pages)-254.3(133151,)-234.2(2004.)]TJ
-21.5502 -1.1443 TD
[(15.)-555.4(J.)-234.2(K.)-234.2(Millen)-227.5(and)-227.5(V)127.1(.)-234.2(Shmatik)6.7(o)13.4(v)66.9(.)-314.5(Constraint)-214.1(solving)-220.8(for)-227.5(bounded-process)-227.5(cryptographic)-220.8(proto-)]TJ
1.8067 -1.2246 TD
[(col)-247.6(analysis.)-361.3(In)]TJ
/TT7 1 Tf
6.3762 0 TD
[(CCS)-247.6(2001)]TJ
/TT4 1 Tf
4.0816 0 TD
[(,)-240.9(pages)-254.3(166175,)-240.9(2001.)]TJ
-12.2645 -1.1376 TD
[(16.)-555.4(M.)-321.2(Rusino)26.8(witch)-307.8(and)-321.2(M.)-327.9(T)46.8(uruani.)-588.9(Protocol)-314.5(Insecurity)-314.5(with)-307.8(Finite)-314.5(Number)-321.2(of)-321.2(Sessions)-321.2(and)]TJ
1.8067 -1.2246 TD
[(Composed)-247.6(K)26.8(e)13.4(ys)-247.6(is)-247.6(NP-complete.)]TJ
/TT7 1 Tf
13.5903 0 TD
[(Theor)40.1(etical)-247.6(Computer)-240.9(Science)]TJ
/TT4 1 Tf
12.1119 0 TD
[(,)-254.3(299:451475,)-227.5(April)-240.9(2003.)]TJ
9.9626 0 0 9.9626 302.7 149.1601 Tm
(12)Tj
ET
endstream
endobj
70 0 obj
<<
/ProcSet [/PDF /Text ]
/Font <<
/F5 16 0 R
/F6 17 0 R
/F8 23 0 R
/F9 24 0 R
/F10 25 0 R
/F23 47 0 R
/F24 65 0 R
/TT2 8 0 R
/TT4 9 0 R
/TT5 10 0 R
/TT7 19 0 R
>>
/ExtGState <<
/GS1 11 0 R
>>
>>
endobj
11 0 obj
<<
/Type /ExtGState
/SA false
/SM 0.02
/OP false
/op false
/OPM 1
/BG2 /Default
/UCR2 /Default
/HT /Default
/TR2 /Default
>>
endobj
71 0 obj
<<
/Type /FontDescriptor
/Ascent 0
/CapHeight 0
/Descent 0
/Flags 98
/FontBBox [-163 -250 1146 969]
/FontName /IFNHFE+CMTI10
/ItalicAngle -14.04
/StemV 68
/StemH 31
/CharSet (/l/h/s)
/FontFile3 72 0 R
>>
endobj
72 0 obj
<<
/Filter /FlateDecode
/Length 595
/Subtype /Type1C
>>
stream
Hbd`ab`ddtpsv
44 f!"Ћ?dX~Ų~W'!&FF7ʢ
gMCKKsԢ<Ē 'G!8?93RO1'G!X!(8,5j5x22ΰQqcF|5,{V=OCўɽRSZ;:4Y*v(Q%[#֮ήN)5̘3ObOX8qS]ͱzSƕMh*_6wuwִ4hJu͚dɋݐQ9r|5,)qҜ+F*l}-!7g}R vuȵVU$Kv/9{pa]]w#?~f74J5LZ