Model and Definitions Clause Samples

Model and Definitions. We consider a distributed system in which 𝑛 parties 𝑃1, 𝑃2, . . . , 𝑃𝑛 run a protocol over a network where all the parties are connected through pair-wise authenticated channels. The network can be synchronous or asynchronous, and the parties are not aware of the type of the network in which the protocol is running. If the network is synchronous, any message is delivered within a (publicly) known amount of time Δ and the parties have access to synchronized clocks. If the network is asynchronous, these assumptions are removed: parties do not have synchronized clocks, and the messages may be delayed arbitrarily. We assume that all the parties have access to a public key infrastructure (PKI). That is, parties hold the same vector of public keys (𝑝𝑘1, 𝑝𝑘2, . . . , 𝑝𝑘𝑛 ), and each honest party 𝑃𝑖 holds the secret key 𝑠𝑘𝑖 corresponding to 𝑝𝑘𝑖 .1 A signature on a value 𝑣 using secret key 𝑠𝑘 is computed as 𝜎 ← sign𝑠𝑘 (𝑣); a signature is verified relative to public key 𝑝𝑘 by calling ver𝑝𝑘 (𝑣, 𝜎). For simplicity, we assume in our proofs that the signatures are perfectly unforgeable. When replacing the signatures with real-world instantiations, the results hold except with a negligible failure probability. We consider an adaptive adversary that can corrupt at any point in the protocol’s execution at most 𝑡𝑠 parties if the network is synchronous, and at most 𝑡𝑎 parties if the network is asynchronous, causing the corrupted parties to deviate arbitrarily. The adversary is strongly ▇▇▇▇▇▇▇: it can observe messages sent by the honest parties before choosing its own messages. Moreover, when an honest party sends a message, the adversary can immediately corrupt that party and replace the message with another of its choice. In addition, the adversary may schedule the delivery of the messages, with the condition that every message is delivered at some point and, if the network is synchronous, within Δ time.

Model and Definitions. We consider a setting of 𝑛 parties 𝑃1, 𝑃2, . . . , 𝑃𝑛 running a proto- col over a network. The parties are pair-wise connected through authenticated channels. The network may be either synchronous or asynchronous, and the parties are not aware of the type of network in which they are running the protocol. In a synchronous network, every message is delivered within a publicly known amount of time Δ, and the parties have access to synchronized clocks. In an asynchronous network, the messages are only guaranteed to be delivered eventually, and no assumption is made about the clocks. We consider an adaptive adversary that may corrupt at any point of the protocol’s execution at most 𝑡𝑠 parties if the network is syn- chronous, and at most 𝑡𝑎 parties if the network is asynchronous. The corrupted parties become Byzantine, meaning that they may deviate arbitrarily from the protocol, and may even be malicious. Additionally, the adversary may schedule the delivery of the mes- sages, with the condition that, if the network is synchronous, the messages are delivered within Δ time. The messages sent over the network are provided with identifica- tion numbers ensuring that the parties can identify which messages correspond to which sub-protocol instances. For simplicity of pre- sentation, we omit these identification numbers.

Model and Definitions