.. _math.notation:

Notation used in formulas
=========================

.. list-table::
   :header-rows: 1
   :widths: auto

   * - Heissler
     - Schoen-makers
     - Tang et al.
     - Description

   * - :math:`{\alpha_j}_0`
     - :math:`\alpha_j`
     - :math:`\alpha_j`
     - Secret coefficients for :math:`f_0`

   * - :math:`{\alpha_j}_1`
     -
     - :math:`\beta_j`
     - Secret coefficients for :math:`f_1`

   * - :math:`a_i`
     -
     -
     - First part of ElGamal ciphertext.

   * - :math:`a'_i`
     -
     -
     - Randomized commitment for :math:`a_i`.

   * - :math:`b_i`
     -
     -
     - Second part of ElGamal ciphertext.

   * - :math:`C_j`
     - :math:`C_j`
     - :math:`C_j`
     - Commitments for the coefficients :math:`{\alpha_j}_{0,1}`.

   * - :math:`c`
     - :math:`c`
     - :math:`c`
     - Challenge for zero knowledge proofs, generated by hash function.

   * - :math:`e`
     -
     -
     - Identity element of (image) group.

   * - :math:`e'`
     -
     -
     - Randomized commitment for :math:`e`.

   * - :math:`f_0(i)`
     - :math:`p(x)`
     - :math:`f(x)`
     - Polynomial with secret coefficients :math:`{\alpha_j}_0`

   * - :math:`f_1(i)`
     -
     - :math:`g(x)`
     - Polynomial with secret coefficients :math:`{\alpha_j}_1`

   * - :math:`G_0`
     - :math:`G`
     - :math:`G`
     - Generator for :math:`G_q`

   * - :math:`G_1`
     -
     - :math:`H`
     - Generator for :math:`G_q`

   * - :math:`G_q`
     - :math:`G_q`
     - :math:`G_q`
     - Finite cyclic group of prime order :math:`q`, used as the image group for all group
       isomorphisms. Computing discrete logarithms in this group must be infeasible.

   * - :math:`g_0`
     - :math:`g`
     - :math:`g`
     - Generator for :math:`G_q`

   * - :math:`g_1`
     -
     - :math:`h`
     - Generator for :math:`G_q`

   * - :math:`i`
     - :math:`i`
     - :math:`i`
     - Unique index for user, :math:`i \in [0,q)`, usually :math:`1 \leq i \leq n`.

   * - :math:`i'`
     - :math:`j`
     - :math:`j`
     - Another iterator for user indices, used during reconstruction.

   * - :math:`j`
     - :math:`j`
     - :math:`j`
     - Indices for coefficients, :math:`0 \leq j < t`

   * - :math:`k_…`
     - :math:`w`
     - :math:`s,t`
     - Values :math:`\in_R Z_q` for computing the Prover's commitment in zero knowledge proofs.

   * - :math:`n`
     - :math:`n`
     - :math:`n`
     - Number of users.

   * - :math:`q`
     - :math:`q`
     - :math:`q`
     - Size of :math:`G_q` and :math:`Z_q`

   * - :math:`S`
     - :math:`S`
     - :math:`S`
     - Shared secret :math:`\in G_q`, generated by dealer and reconstructed by receiver.

   * - :math:`S_i`
     - :math:`S_i`
     - :math:`S_i`
     - User :math:`i`'s share of the shared secret.

   * - :math:`s_…`
     - :math:`r_i`
     - :math:`r_{i1},r_{i2}`
     - Responses for zero knowledge proofs.

   * - :math:`t`
     - :math:`t`
     - :math:`t`
     - Size of *qualified subset* of users able to reconstruct the secret,
       :math:`1 \leq t \leq n`.

   * - :math:`v_{0,1}`
     -
     -
     - Helper variables used in zero-knowledge proof for re-encryption.

   * - :math:`w_{0,1}`
     -
     -
     - Random values for ElGamal encryption.

   * - :math:`X_i`
     - :math:`X_i`
     - :math:`X_i`
     - Shares with alternative generator :math:`g_{0,1}`.

   * - :math:`X'_i`
     - :math:`a_{1i}/X_i^c`
     - :math:`a_{1i}/X_i^c`
     - Randomized commitment for :math:`X_i`.

   * - :math:`x_i`
     - :math:`x_i`
     - :math:`x_i`
     - Private key :math:`\in_R Z_q^*` for user :math:`i`

   * - :math:`x_r`
     -
     -
     - Private key :math:`\in_R Z_q^*` for recipient

   * - :math:`Y_i`
     - :math:`Y_i`
     - :math:`Y_i`
     - Encrypted share for each user.

   * - :math:`Y'_i`
     - :math:`a_{2i}/Y_i^c`
     - :math:`a_{2i}/Y_i^c`
     - Randomized commitment for :math:`Y_i`.

   * - :math:`{y_i}_0`
     - :math:`y_i`
     - :math:`y_{i1}`
     - First public key part for users, :math:`{y_i}_0 = G_0^{x_i}`

   * - :math:`{y_i}_1`
     -
     - :math:`y_{i2}`
     - Second public key part for users, :math:`{y_i}_1 = G_1^{x_i}`

   * - :math:`y_i`
     -
     - y_i
     - Product of public key parts, :math:`y_i = {y_i}_0 \cdot {y_i}_1`

   * - :math:`y'_i`
     -
     -
     - Randomized commitment for :math:`y_i`.

   * - :math:`{y_r}_0`
     -
     -
     - First public key part for recipient, :math:`{y_r}_0 = G_0^{x_r}`

   * - :math:`{y_r}_1`
     -
     -
     - Second public key part for recipient, :math:`{y_r}_1 = G_1^{x_r}`

   * - :math:`Z_q`
     - :math:`Z_q`
     - :math:`Z_q`
     - Additive group of integers modulo prime :math:`q`,
       used as the pre-image group for all group isomorphisms.

   * - :math:`Z_q^*`
     - :math:`Z_q^*`
     - :math:`Z_q^*`
     - :math:`Z_q \setminus \{0\}`