Research proof index

H5 boundary in shifted-NMA form. This is the fork-side statement after the native H4 normalization has moved cmaSim to nma ∘ cmaToNma. The bound is in terms of the verify-wrapped adversary nmaAdvFromCmaWithFinalQuery at fork slot parameter qH (the framework's Fin (qH + 1) indexing accommodates the wrapper's verifier-point query).

Public EUF-CMA advantage in the shared fixed-key post-keygen normal form.

Candidate production, with signing queries logged before final verification, preserves the source adversary signing/hash query budget.

The post-keygen freshness endpoint is the same Boolean experiment as running signedFreshAdv in the direct stateful CMA game.

When the simulated signing loop produces some (w, z), the random-oracle cache contains a challenge c at (msg, w) satisfying ids.verify pk w c z = true. This is proved by induction on the loop counter: each abort iteration preserves the invariant (the cache only grows), and a successful iteration writes exactly the challenge used in verification.

The expected number of signing queries is the sum, over prefixes of the retry loop, of the probability that every attempt in the prefix aborts.