This is a draft of the proof

Current proof for pUT:

Claim of security is:
assume a sUT for distribution D(z) defined as follows:

• let T = z
• sample epk-s
• return \(F^{resh}_{T,epk-s}\)
  then the pUT built with that sUT is secure.

Two simulators \(SSetup, SEval\)
Probably Sim_pUT.Setup is the same as Sim_sUT.Setup

Sim_pUT.Eval(xquery, C):

• just run Sim_sUT.Eval(xquery, C)

The above is Sim_pUT.

To argue indstinguishability between real and ideal:

we observe the analogy with the sUT experiment and observe that if this did not hold then somebody could break the sUT experiment with the other adverary letting a "Reshare" correspond to TrapEval invocations.

The following hybrid is not valid anymore
where hyb is an experimetn where replace the Reshare step at time T with a call to the following:

• sample epk
• let \(F^{resh}_{T,epk-s}\) as the usual reshare function
• return \(Sim_sUT.Eval(trapd, F^{resh}_{T,epk-s})\)

OBS: the above steps return something distributed exactly as \(\mathcal{O}^{ideal}_{sUT}(trapdquery, T)\)

Current proof for sUT

Statement: The construction in (what is currently) 5.2 is secure for distribution D as formalized above.

The proof is the same as for the other paper in their vanilla UT model. We just need to show simulability for the special queries of the sUT for the distribution above. We o

Old stuff from here

\(UTSetup() \rightarrow (pk, sk_1, ..., skN, trapd)\)

Simulate \(SInject()\) in some way…

\(SEval(tag, F^\text{resh}_{T,epk}) \to \text{shares of ciphertext}\)
Let's assume that tag = "reshare" and C is the right F_reshare (with honest time and honets pke)
Given the ciphertexts, SEval generates shares through SS
Let us define the ciphertexts.

Given in input hssk, we need to define ciphertexts such that they all open to something of the following type
\[Dec(ct_i) = (R_i, \sigma_i)\]
where \(\sigma_R\) is a valid signature, that is:
\(HS.Vfy(hspk, R_i, \sigma_i, sgntag := "(i,T)") = 1\)

The other simulator samples \(\rho\)

\(SEval(hssk, F^\text{resh}_{epk}):\)

• \rho_t+1 = PRF_\rho(T+1)
• for each \(i \in [N]\):

– sample \(R_i\), sign it and obtain \(\sigma_i\)
– \(ct_i \gets Enc(epk_i, R_i, \sigma_i)\)