Research proof index

Coordinate-wise special soundness of SendWitness. The verifier has no challenge rounds, so CWSS collapses (via the no-challenge bridge coordinateWiseSpecialSound_of_isEmpty_challengeIdx) to a transcript-level extraction obligation. The extractor is e := fun _ tr => tr 0: the witness is the (single) prover message. Since the verifier is pure wi...

If every value x in the support of gen satisfies Pr[= a | f x] ≥ 1 - δ, then the overall probability satisfies Pr[= a | gen >>= f] ≥ 1 - δ. This reduces a "for all keys" completeness statement to per-key bounds.

Phase B (freshness-drop) bound. The CMA advantage is bounded above by the success probability of the same experiment with the freshness check dropped. Both unforgeableExp and unforgeableExpNoFresh factor as runtime.evalDist (joint >>= ...) sharing the same prefix joint. The hypothesis h_pull packages the runtime-specific factoring step that...

Failing companion to simulateQ_optionT_forIn_yield_pure_some: if each loop body, under simulateQ, resolves to pure (some (ForInStep.yield init)) when its per-element condition cond a holds and to pure none otherwise, and some element of the list fails its condition, then the whole OptionT-monadic forIn resolves to pure none (the failure...

OptionT companion to QueryImpl.simulateQ_liftM_eq_of_query: simulating an OracleComp-computation oa lifted into OptionT (OracleComp spec₂') (the shape produced by an OptionT-monadic verifier's let _ ← liftM (queryHelper) binds) agrees, at the run (Option) level, with some-mapping the simulation of oa through a per-query-bridged handler...

Three-layer simulation collapse: if a "reduction" red : QueryImpl spec₁ (StateT σ (OracleComp spec₂)) followed by an inner cached impl : QueryImpl spec₂ (StateT τ n) agrees per-query with a single "combined" handler combined : QueryImpl spec₁ (StateT (σ × τ) n) up to the natural reassociation α × σ × τ ≃ (α × σ) × τ, then the agreement extends to...