Moved definition of the Schwartz-Zippel lemma

thesis/sections/edggm/sdlog.tex

@@ -11,6 +11,14 @@ This section focuses on establishing a lower bound on the hardness of a modified
 
 \paragraph{\underline{Proof Overview}} This proof closely resembles the original proof on the lower bound for the discrete logarithm problem by Shoup \cite{EC:Shoup97}. The initial step involves working with the discrete logarithms of group elements rather than the actual group elements themselves. In the generic group model, this is equivalent as each group element can be uniquely represented by its discrete logarithms with respect to a generating set. For consistency  the generating set is denoted as $(\groupelement{B}, \groupelement{E_2}, ..., \groupelement{E_m})$, with $\groupelement{B}$ being the generator of the prime order subgroup and $\groupelement{E_2}$ to $\groupelement{E_m}$ being the generators of the other subgroups. Subsequently, the discrete logarithm in the prime order subgroup is replaced by an indeterminate. By doing this, the discrete logarithm in the prime order subgroup can be chosen after the adversary has provided their solution. As a result, the generic adversary can only guess the discrete logarithm in the prime order subgroup, since it is generated only after the adversary has already submitted their solution. Figure \ref{fig:sdlog_ggm} shows the \sdlog game in the generic group model.
 
+The following proof utilizes the Schwartz-Zippel lemma \cite{schwartz_fast_1980}. The Schwarz-Zippel lemma is defined as following:
+
+\begin{lemma}[Schwartz-Zippel lemma]
+	Let $L$ be a prime number and $P \in \mathbb{F}_{L}[X_1, ..., X_n]$ be a non-zero polynomial of total degree $d \geq 0$ over a field $\mathbb{F}_{L}$. Let $S$ be a finite subset of $\mathbb{F}_{L}$ and let $x$ be selected uniformly at random from $S$. Then
+	
+	\[ \Pr[P(x) = 0] \leq \frac{d}{|S|}. \]
+\end{lemma}
+
 \begin{figure}[h]
 	\hrule
 	\vspace{2mm}
@@ -173,14 +181,6 @@ This section focuses on establishing a lower bound on the hardness of a modified
 \begin{proof}
 	\item Let $G_0$ represent the \sdlog game in the generic group model. In this proof, the discrete logarithm within the prime order subgroup of the group element $\groupelement{A}$ will be substituted with an indeterminate. Following that, it will be demonstrated that the challenger, by working with polynomials rather than actual discrete logarithms, makes errors in the simulation with negligible probability. Finally, it will be established that the discrete logarithm of the group element $\groupelement{A}$ can be selected after the adversary has submitted its solution for the game.
 	
-	\item This proof utilizes the Schwartz-Zippel lemma \cite{schwartz_fast_1980}. The Schwarz-Zippel lemma is defined as following:
-	
-	\begin{definition}[Schwartz-Zippel lemma]
-		Let $L$ be a prime number and $P \in \mathbb{F}_{L}[X_1, ..., X_n]$ be a non-zero polynomial of total degree $d \geq 0$ over a field $\mathbb{F}_{L}$. Let $S$ be a finite subset of $\mathbb{F}_{L}$ and let $x$ be selected uniformly at random from $S$. Then
-		
-		\[ \Pr[P(x) = 0] \leq \frac{d}{|S|}. \]
-	\end{definition}
-	
 	\item \paragraph{\underline{$G_0:$}} Let $G_0$ be defined in figure \ref{fig:sdlog_games_ggm_1} by excluding all boxes except the black ones. This is identical to the \sdlog in the generic group model. By definition,
 	
 	\[ \advantage{\curve, n, c, L, \adversary{A}}{\sdlog} = \prone{G_0^{\adversary{A}}}. \]
@@ -193,7 +193,7 @@ This section focuses on establishing a lower bound on the hardness of a modified
 	
 	\[ \prone{G_1^{\adversary{A}}} = \prone{G_2^{\adversary{A}}}. \]
 	
-	\item \paragraph{\underline{$G_3:$}} $G_3$ introduces the "if" condition within the green box. This condition checks if the challenger generated two distinct polynomials that would produce the same value when evaluated at $a$. This verification ensures that polynomials can be directly compared later on, rather than needing to evaluate them. If the "if" condition evaluates to true, a bad flag is set to true, indicating that the challenger might incorrectly assume that two discrete logarithms, represented by the polynomials, are different by only comparing the polynomials. This modification is purely conceptual, as it only affects internal variables and does not influence the game's behavior. Therefore,
+	\item \paragraph{\underline{$G_3:$}} $G_3$ introduces the if condition within the green box. This condition checks if the challenger generated two distinct polynomials that would produce the same value when evaluated at $a$. This verification ensures that polynomials can be directly compared later on, rather than needing to evaluate them. If the if condition evaluates to true, a bad flag is set to true, indicating that the challenger might incorrectly assume that two discrete logarithms, represented by the polynomials, are different by only comparing the polynomials. This modification is purely conceptual, as it only affects internal variables and does not influence the game's behavior. Therefore,
 	
 	\[ \prone{G_1^{\adversary{A}}} = \prone{G_2^{\adversary{A}}}. \]