Research proof index

Running the inner unifForward + roImpl simulator against a source computation with an nmaHashQueryBound Q can grow the internal queryLog by at most Q. Each source Sum.inr step consumes one unit of the nmaHashQueryBound budget, while roImpl appends to queryLog only on a cache miss, hence at most once per such step.

If two successful contextual forks select the same fork index, their forgery targets agree.

NMA-to-extraction via the forking lemma and special soundness. The parameter qH is the fork slot parameter passed to Fork.forkPoint qH, i.e., the number of Fin (qH + 1) candidate target positions over which the replay-forking lemma sums. It is not required to be a valid query bound on the adversary: callers may supply a wrapped adversary with up...

Completeness of the Fiat-Shamir signature scheme follows from completeness of the underlying Σ-protocol.

Fiat-Shamir signing has expected weighted query cost equal to the expectation of the queried commitment cost over the output signature distribution.

Hash-query bound for simulatedNmaAdv: if the CMA adversary makes at most qS signing-oracle queries and qH random-oracle queries, the NMA reduction makes at most qH live hash queries. The qS signing queries are absorbed into the managed cache rather than issued live.