## 4 Random Oracles Proof for the Security of Our Protocols
If b is \(1\), the simulator generates the real session key \(SK^{k}_{i^{*},j^{*}}=h(R_{U}\oplus R_{R}\oplus R_{C})\), where \(R_{U},\ R_{R}\), and \(R_{C}\) are random numbers in the \(Z^{*}_{n}\) with \(l\)-_bit_ length and \(\{i^{*},\ j^{*}\}\in I\) and \(I\in\{U,\)\(RCRS,\)\(C\}\). Otherwise, \(A\) outputs the random string from \(\{0,1\}^{*}\). When \(D\) has received the tuple from \(A\), its work is to distinguish whether or not this tuple is a real session key. We assume that if the attacker \(D\) could distinguish this tuple with a non-negligible advantage \(Adv_{AD,\ h,\ RO}(\theta,\ t)\). Then, the following equation will hold. \[Adv_{CD,\ h,\ RO}(\theta,\ t)\] \[\geq Pr[D(Z_{n}^{*},PC,\ h,\ RO)=1\big{|}SK_{r,\prime}^{k},\ =h(R_{U}\oplus R_{R}\oplus R_{C})\big{]}\] \[\qquad-\Pr\Big{[}D(Z_{n}^{*},PC,\ h,\ RO)=1\Big{|}SK_{r,\prime}^{k }\leftarrow\{0,1\}^{*}\Big{]}\] \[\geq\frac{1}{I^{2}q_{h}2^{3l}}Pr[A(\cdot)=1\Big{|}SK_{r,\prime}^{ k},\ \text{is real in the Test query}\ ]\] \[\geq\frac{-\Pr\Big{[}A(\cdot)=1\Big{|}SK_{r,\prime}^{k}\ \text{is a random string \ in the Test query}\Big{]}}{I^{2}q_{h}2^{3l}}(Pr[b=b^{\prime}\text{ in the \ Pre checkups phase}]\] \[\qquad-Pr[b\
eq b^{\prime}\text{ in the \ subsequent validations phase}])\] \[\geq\frac{1}{I^{2}q_{h}2^{3l}}(2(Pr[b=b^{\prime}\text{ in the \ Pre checkups phase}])-1).\]  
Finally, the following equation will hold  
\[Pr[b=b^{\prime}\text{ in the \ Pre checkups phase}]\leq(I^{2}q_{h}2^{3l} \Big{(}Adv_{PC,\ h,\ RO}(\theta,\ t)\Big{)}+1)/2.\]  
2. In the subsequent validation phase. In this subsequent validation (\(SV\)) phase, we consider the following situation. In this phase, we assume that there is an attacker \(C\) whose job is to distinguish the real session key after gathering enough training information. The simulator that we assume to be \(F\) begins to prepare system parameters including the instance of players \(\{i,j\}\in I\) and \(I\in\{U,\ RCRS\}\) in the \(k\)-th session, where \(k\in N\) under the security parameter \(\theta\) and each player's key pair. The attacker \(C\) could also make queries as follows. * Send \((i,\,k,\ ID_{i})\) query: When the attacker makes the send query to the simulator \(F,F\) will prepare the \((i,\ ID_{i})\) for the further simulation usage. Then, \(F\) forwards \((i,\ ID_{i})\) to the attacker \(C\). * Hash query \((i,\,k,\ ID_{i})\): When the attacker makes the hash query of instance \(\Pi^{k}_{i}\) with the \(ID_{i}\). The simulator \(F\) will prepare the random oracle to reply to the result \(UA_{i}\) to \(C\), where \(UA_{i}\) is computed from random oracle with the help of \(ID_{i}\) and the instance's secret key \(X_{i}\). * Reveal\((i)\) query: If \(C\) makes a Reveal\((i)\) query, \(F\) could reply to \(C\) according to the hash value \((i,\ h(R_{U}\oplus R_{R}),\ R_{U},\ R_{R},k)\), where \(R_{U}\) and \(R_{R}\) are random numbers in the \(Z_{n}^{*}\) with \(l\) length bits and they are chosen by player \(U_{i}\) and \(RCRS\) in the \(k\)-th session, respectively. * Corrupt\((i)\) query: If \(C\) makes a Corrupt\((i)\) query, \(F\) could reply to \(C\) according to the secret key value \(X_{i}\). * Finally, if \(C\) makes a Test\((i)\) query to \(F\), then \(F\) prepares in the following. First, we assume that the instance \(i=i^{\prime}\) and the instance \(j=j^{\prime}\) in the \(k\)th session are chosen by attacker \(C\), where each of them is a fresh instance of player, respectively. In this time, \(F\) also prepares the session key to respond to the attacker \(C\). It depends on the coin flips by the simulator \(F\) with the output \(b\). If b is 1, then \(F\) computes \(SK_{r,\prime}^{k}=h(R_{U}\oplus R_{R})\), where \(R_{U}\) and \(R_{R}\) are random numbers and \(\{i^{\prime},\ j^{\prime}\}\in I\) and \(I\in\{U,\ RCRS\}\). Otherwise, \(F\) outputs a random string from \(\{0,1\}^{*}\). When \(C\) has received the tuple from \(F\), its work is to distinguish whether this tuple is real session key or not.