
\section*{Appendix}

\input{sections/proof_of_extsim_lemma}
\input{sections/small-tag-quantum}

\end{document}


\section{Extract-and-Simulate Lemma}\label{sec:extract_and_simulate}

In this section, we show a generalized version of the extract-and-simulate lemma given in \cite[Lemma 4]{cryptoeprint:2021:1516}.  
\takashi{modified the statement. Especially, $\mathcal{A}$ does not appear in the lemma anymore. When using this lemma, we should think of the description of $(\mathcal{M}_\lambda,\rho_\lambda)$ as part of $\rho$.}
\takashi{I added $1^{\gamma^{-1}}$ in the input of $\mathcal{G}$. This is needed to deal with the proof of our main step. ($\mathcal{G}$ corresponds to the simulated main-thread $\mathcal{G}_1$) that internally run the extractor for WIAoK, so it needs to know $\epsilon$ to determine the simulation error.}
\begin{lemma}[Extract-and-Simulate Lemma]
\label{lem:extract_and_simulate}
Let $\mathcal{G}$ be a QPT algorithm that takes the security parameter $1^\lambda$, an error parameter $1^{\gamma^{-1}}$, a quantum state $\rho$, {and a classical string $z$} as input,  and outputs  $b\in \{\top,\bot\}$ and a quantum state $\rho_\mathsf{out}$. 

Suppose that there exists a QPT algorithm $\mathcal{K}$ (referred to as the simulation-less extractor) that takes as input the security parameter $1^\lambda$, an error parameter $1^{\gamma^{-1}}$, a quantum state $\rho$, {and a classical string $z$}, and outputs $s\in \{0,1\}^{\mathsf{poly}(\lambda)}\cup \{\bot\}$   
satisfying the following w.r.t.\ some sequence of classical strings {$\{s^*_{z}\}_{z\in \{0,1\}^*}$.}
\takashi{The index of $s^*$ is changed from $\lambda$ to $z$. (Imagine that $s^*$ is the committed message and $z$ is the partial transcript. Then this should be a more natural formalization.)}
\begin{enumerate}
 \item  \label{item:s_star_or_bot}
    For any $\lambda$, $\gamma$,  $\rho_\lambda$, {and $z_\lambda$},  
    the output $s$ of $\mathcal{K}(1^\lambda,1^{\gamma^{-1}},\rho_\lambda,{z_\lambda})$ is equal to {$s^*_{z_\lambda}$} whenever $s\neq \bot$.
    \item \label{item:gamma_delta}
 For any noticeable function  $\gamma(\lambda)$, there exists a noticeable function $\delta(\lambda)$ that is efficiently computable from $\gamma(\lambda)$ and satisfies the following. For any sequence $\{\rho_\lambda,{z_\lambda}\}_{\lambda\in\mathbb{N}}$ of polynomial-size quantum states and classical strings,
 if 
$$
\Pr[b=\top : (b,\rho_\mathsf{out}) \leftarrow \mathcal{G}(1^\lambda,1^{\gamma^{-1}},\rho_\lambda,{z_\lambda})]\geq  \gamma(\lambda), 
$$  
then 
$$
\Pr[\mathcal{K}(1^\lambda,1^{\gamma^{-1}},\rho_\lambda,{z_\lambda})=s^*_{{z_\lambda}}]\geq   \delta(\lambda).
$$
\end{enumerate}
Then, there exists a QPT algorithm $\ensuremath{\mathcal{SE}}\xspace$ and an efficiently computable polynomial $\mathsf{poly}$ such that for any sequence $\{\rho_\lambda,{z_\lambda}\}_{\lambda\in\mathbb{N}}$ of polynomial-size quantum states and classical strings and
noticeable function $\epsilon=\epsilon(\lambda)$,  
$$
\{\ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\rho_\lambda,{z_\lambda})\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}
\sind_{\epsilon} 
\{(\rho_\mathsf{out},\Gamma_b(s^*_{{z_\lambda}})):(b,\rho_\mathsf{out})\leftarrow \mathcal{G}(1^\lambda,1^{\gamma^{-1}},\rho_\lambda,{z_{\lambda}})\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace},
$$
where $\gamma=\mathsf{poly}(\epsilon)$ and $
\Gamma_b(s^*_{{z_\lambda}}):= 
\begin{cases}
s^*_{{z_\lambda}} & \text{if}~ b=\top \\
\bot & \text{otherwise}
\end{cases}
$.
\end{lemma}
In \cite{cryptoeprint:2021:1516}, the authors essentially proved a special case of the above lemma where the simulation-less extractor is fixed to Unruh's rewinding extractor~\cite{EC:Unruh12}. 
We observe that essentially the same proof works for general simulation-less extractors.\footnote{Indeed, this observation is also mentioned in the technical overview of \cite{cryptoeprint:2021:1516}.}  
We provide the full proof of \Cref{lem:extract_and_simulate} in \Cref{sec:proof_extract_and_simulate} for completeness.



\if0
\takashi{The following corollary may be removed if the way of applying the above lemma can be explained in the security proof. Note that the revisions made in the above lemma are not reflected yet for the following corollary.}


\xiao{I changed ``$\mathcal{C}$'' to ``$\mathcal{B}$'', to avoid conflicting with the notion for committer.}
\begin{corollary}
\label{cor:extract_and_simulate}
Let $\mathsf{Com}$ be a statistically-binding commitment scheme. 
Let $\langle\mathcal{A}(\rho),\mathcal{B}\rangle(1^\lambda,\mathsf{com})$ be an interactive protocol between QPT algorithms $\mathcal{A}$ and $\mathcal{B}$ where $\mathcal{A}$ takes as an advice a polynomial-size quantum state $\rho$ and 
$\mathcal{A}$ and $\mathcal{B}$ take as common inputs the security parameter $1^\lambda$ and a commitment $\mathsf{com}$ of $\mathsf{Com}$. 
After the interaction, $\mathcal{A}$ outputs a quantum state $\rho_\mathsf{out}$ and $\mathcal{B}$ outputs $b\in \{\top,\bot\}$.
We denote this execution by $(\rho_\mathsf{out},b) \leftarrow \langle\mathcal{A}(\rho),\mathcal{B}\rangle(1^\lambda,\mathsf{com})$. 
\takashi{More precisely, $\rho$ and $\mathsf{com}$ are also parameterized by $\lambda$. Should we make this explicit?}

Suppose that there exists a QPT (oracle) algorithm $\mathcal{K}$ (referred to as a simulation-less extractor) that satisfies the following:
$\mathcal{K}$ takes as input the security parameter $1^\lambda$ and a commitment $\mathsf{com}$, accesses $\mathcal{A}$ as an oracle, and outputs $b\in \Set{\top,\bot}$ and a string $s$. 
Whenever $b=\top$, $s=\mathsf{val}(\mathsf{com})$ \xiao{Why do you want $\mathcal{K}$ to output the $b$? Isn't $s$ itself good enough?}\takashi{If it does not output $b$, one cannot know if $s=\mathsf{val}(\mathsf{com})$ and thus we cannot amplify the probability to get $\mathsf{val}(\mathsf{com})$. I think this problem already exists in the classical setting.}.
Moreover, for any polynomial-size quantum advice $\rho^*$, if 
$$
\Pr[b=\top : (\rho_\mathsf{out}, b) \leftarrow \langle\mathcal{A}(\rho^*),\mathcal{B}\rangle(1^\lambda,\mathsf{com})]\geq  1/\mathsf{poly}(\lambda), 
$$ 
then 
$$
\Pr[\mathcal{K}^{\mathcal{A}(\rho^*)}(1^\lambda,\mathsf{com})=(\top,\mathsf{val}(\mathsf{com}))]\geq   1/\mathsf{poly}(\lambda).
$$
\takashi{Recall that $\mathsf{val}(\mathsf{com})$ is the committed value as defined in CCLY. 
I also remark that two $\mathsf{poly}(\lambda)$ that appear in the above equalities may be different. 
If this is confusing, we can say like ``for any noticeable $\gamma$, there exists a noticeable $\delta$ such that if 
$$
\Pr[...]\geq \gamma,
$$
then 
$$
\Pr[...]\geq \delta.
$$
"
}

Then, there exists \xiao{Only requiring the existence of $\ensuremath{\mathcal{SE}}\xspace$ is not enough. It must be efficiently constructible. Thus, one way is to additionally give $\ensuremath{\mathcal{SE}}\xspace$ oracle access to $\mathcal{K}$. Alternatively, we can simply say that $\ensuremath{\mathcal{SE}}\xspace$ is efficiently constructible from $\mathcal{K}$.}
\takashi{This is a subtle issue, but I don't think we need to specify the dependence on $\mathcal{K}$. First, remark that $\mathcal{K}$ is a oracle quantum Turing machine whose description itself does not depend on $\mathcal{A}$ or $\rho$ (this might not be clear enough in the current statement). In particular, the description size of $\mathcal{K}$ is constant. Thus, we can ``hardwire" it into $\ensuremath{\mathcal{SE}}\xspace$.} is a QPT (oracle) algorithm $\ensuremath{\mathcal{SE}}\xspace$ such that for any noticeable $\epsilon$ and a commitment $\mathsf{com}$ \xiao{should the following equation conditioned on that the ``prefix'' leads to an accepting execution with ``high'' probability?}, 
$$
\{\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\rho)}(1^\lambda,1^{\epsilon^{-1}},\mathsf{com})\}_{\lambda}
\sind_{\epsilon} 
\{(\rho_\mathsf{out},\mathsf{val}_b(\mathsf{com})):(\rho_\mathsf{out},b)\leftarrow \langle\mathcal{A}(\rho),\mathcal{B}\rangle(1^\lambda,\mathsf{com})\}_{\lambda}
$$
where 
$$
\mathsf{val}_b(\mathsf{com}):= 
\begin{cases}
\mathsf{val}(\mathsf{com}) & \text{if}~ b=\top \\
\bot & \text{otherwise}
\end{cases}.
$$
\takashi{Remark that we do not require 
$$
\Pr[b=\top : (\rho_\mathsf{out}, b) \leftarrow \langle\mathcal{A}(\rho),\mathcal{B}\rangle(1^\lambda,\mathsf{com})]=1/\mathsf{poly}(\lambda).
$$ 
}
\end{corollary}
\takashi{Intuitively, $\mathcal{A}$ and $\mathcal{C}$ play the roles of the MIM attacker $M$ and the challenger of the NM game, respectively where the first round commitments by $\mathsf{Com}$ is fixed. (Imagine a NM commitment scheme where the committer first commits by $\mathsf{Com}$ followed by the interactive verification phase.)
$\mathsf{com}$ is the commitment of $\mathsf{Com}$ in the right session, 
$\rho$ is $M$'s state at this point,
$\rho_\mathsf{out}$ is the final state of $M$, and $b$ is the decision bit indicating if $M$ passes all the verification.\\ 
Then, the assumption of the above lemma means that if $M$ passes all the verification with a noticeable probability, then we can extract the committed message with a noticeable probability. 
This is exactly the main lemma we have been discussing. I believe that the classical proof for that can be easily extended to the quantum one.\\
Let me briefly mention how to prove the above lemma. First, remark that the classical version of the above lemma is almost trivial: $\ensuremath{\mathcal{SE}}\xspace$ runs $\mathcal{K}$ many times as look-ahead threads to extract $\mathsf{val}(\mathsf{com})$, after which it runs the main thread.
The simulation fails only if it fails to extract $\mathsf{val}(\mathsf{com})$ but the main thread returns $b=\top$, which happens with probability at most $\epsilon + \mathsf{negl}(\lambda)$ if we run sufficiently many look-ahead threads. (The number of required repetitions depends on $\epsilon$.) 
For the quantum version, the proof is almost the same as that of the simulate-and-extract lemma of CCLY. 
Namely, we consider the Jordan decomposition w.r.t. $\mathcal{K}$, and just ignores the subspaces with small eigenvalues ($=$ small success probabilities of $\mathcal{K}$, which implies small acceptance probabilities of $\mathcal{A}$ by the assumption).\\
It seems possible to prove a slightly stronger version of the above lemma where the simulation error is negligible with a expected-polytime $\ensuremath{\mathcal{SE}}\xspace$ by using LMS21. But this will not be needed for our purpose. 
}


\takashi{The following is a more general version of the lemma. I believe the it implies the above version by considering $\mathcal{A}$ as the combination of $\mathcal{A}$ and $\mathcal{C}$ in the above version.}

\xiao{I guess the hard step is to construct $\mathcal{K}$. We need to handle polynomially many rewindings against the quantum man-in-the-middle, for which Unruh's approach does not work any more. Is it true that we need to rely on \cite{chiesa2021post}  for this purpose?}

\takashi{I think we can just use post-quantum WIAoK with the simulation property in a black-box manner. 
Specifically, $\mathcal{K}$ is constructed as follows:\\
1. Consider an experiment where the challenger uses $\tilde{x}_i$ for random $i$ in WIAoK$_1$ in the right session, and think of the combination of MIM and the challenger in the right session as a cheating prover against the WIAoK$_1$ of the left session. 
We call this cheating prover $P^*_1(\rho)$, where $\rho$ is MIM's state after generating the prefix.\\ 
2. Run the simulation-extractor $\ensuremath{\mathcal{SE}}\xspace_1$ of the WIAoK$_1$ in the left session w.r.t. the cheating prover $P^*_1(\rho)$.
Then, $\ensuremath{\mathcal{SE}}\xspace_1$ outputs $\rho_{\mathsf{mid}}$, which is the simulation of MIM's state after finishing the WIAoK$_1$ stage, and an extracted witness $x_j$ (or $\bot$ in case of rejection).\\   
3. Consider an experiment where the challenger uses the extracted $x_j$ in WIAoK$_2$ in the left session, and think of the combination of MIM and the challenger in the left session as a cheating prover against  WIAoK$_2$ in the right session.
We call this cheating prover $P^*_2(\rho_{\mathsf{mid}})$. \\ 
4.  Run the simulation-extractor $\ensuremath{\mathcal{SE}}\xspace_2$ of the WIAoK$_2$ in the right session w.r.t. the cheating prover $P^*_2(\rho_{\mathsf{mid}})$. 
Then, $\ensuremath{\mathcal{SE}}\xspace_2$ outputs a simulated state $\rho_\mathsf{out}$ and an extracted witness $(\tilde{m},\tilde{r})$ or $\tilde{x}_i$ for some $i$ (or $\bot$ in the case of rejection).\\
5. Output $\tilde{m}$ if $\ensuremath{\mathcal{SE}}\xspace_2$ outputs $(\tilde{m},\tilde{r})$ and otherwise $\bot$. \\
The analysis of $\mathcal{K}$ should be almost the same as the classical one.}
\fi

\section{Post-Quantum Non-Malleable Commitments}\label{sec:full:pq:nmcom}

In this section, we construct a full-fledged post-quantum non-malleable commitment scheme that supports an exponential-size tag space and is secure against QPT asynchronous MIM adversaries. 


\subsection{Small-Tag, One-sided, Synchronous, Post-Quantum Setting}\label{summary:pq:sec:small-tag-one-sided-sync-pq}
First, we show that the \Cref{prot:one-sided:classical} given in \Cref{sec:small-tag-one-sided-sync-classical} is post-quantumly secure if we instantiate it with post-quantum building-blocks. Specifically, let $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ be \Cref{prot:one-sided:classical} instantiated with post-quantum Naor's commitment $\mathsf{Com}$ (which is constructed based on post-quantum OWFs), post-quantum injective OWF $f$, and  a post-quantum witness-distinguishable {\emph arguments} of knowledge with $\epsilon$-close emulation as per \Cref{def:PQWIAoK} (see \Cref{pq:prot:one-sided:classical} in \Cref{pq:sec:small-tag-one-sided-sync-pq} for the full description of $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$). 
Then, we can prove the following theorem:
\begin{theorem}\label{summary:pq:thm:one-sided:non-malleability}
The commitment scheme $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ is non-malleable against  one-sided synchronous QPT adversaries with tag space $[n]$, with $n$ being any polynomial on $\lambda$. 
\end{theorem}	

We remark that the injectivity assumption for $f$ can be removed in exactly the same way as in the classical setting (as explained in \Cref{sec:removing-injectivity}). 

The proof of \Cref{summary:pq:thm:one-sided:non-malleability} is very similar to that of its classical counterpart (\Cref{thm:one-sided:non-malleability}) except for one step as explained below. Thus, we only give a proof sketch below, and defer the full proof to \Cref{pq:sec:small-tag-one-sided-sync-pq}.

\begin{proof}[Proof of \Cref{summary:pq:thm:one-sided:non-malleability} (sketch)]
We observe that all steps of the proof of \Cref{thm:one-sided:non-malleability}, except for the proof of \Cref{lem:small-tag:proof:se} (in particular, \Cref{lem:small-tag:proof:se:proof:K} in \Cref{lem:small-tag:proof:se:proof}), can be translated into the post-quantum setting easily with the following remarks. The only difference in those steps (except for some superficial differences like PPT vs QPT) is that we only have WIAoK with $\epsilon$-close emulation (as per \Cref{def:PQWIAoK}) instead of WIPoK (with negligibly-close emulation). First, the AoK property instead of the PoK property suffices because we run witness-extended emulators only for (possibly non-uniform) efficient cheating provers. Second, the $\epsilon$-close emulation (in contrast to negligibly-close emulation) also suffices, because we can take a sufficiently small noticeable error parameter such that it is much smaller than the MIM adversary's advantage. With these modifications, the whole proof will go through.  

Thus, the only remaining issue is how to prove the post-quantum version of \Cref{lem:small-tag:proof:se} (using a post-quantum version of \Cref{lem:small-tag:proof:se:proof:K}). Roughly, we have to construct a simulation-extractor $\mathcal{SE}$ that extracts the right committed message $\mathsf{val}(\tilde{\tau})$ while simulating $\mathcal{M}$'s final state from a simulation-less extractor $\mathcal{K}$, which extracts $\mathsf{val}(\tilde{\tau})$ with a noticeable probability {\em without simulating $\mathcal{M}$'s final state}. This task is exactly what can be achieved by our new extract-and-simulate lemma~(\Cref{lem:extract_and_simulate}). Indeed, the requirements for $\mathcal{K}$ in \Cref{lem:small-tag:proof:se:proof:K} (more precisely, its post-quantum version~\Cref{pq:lem:small-tag:proof:se:proof:K}) exactly correspond to the assumptions of \Cref{lem:extract_and_simulate}. Therefore, this step can be completed by reducing it to \Cref{lem:extract_and_simulate}. (We believe that readers with good understanding of the classical case can directly go to {\em Proof of \Cref{pq:lem:small-tag:proof:se}} in  \Cpageref{pageref:different_part} after checking the statements of \Cref{pq:lem:small-tag:proof:se:proof:K,pq:lem:small-tag:proof:se} and relevant definitions  
to see how this step exactly works.) 

\end{proof}





\subsection{Small-Tag, Asynchronous, Post-Quantum Setting}
\label{sec:full:pq:nmcom:async}
Next, we explain how to make $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ (shown in \Cref{pq:prot:one-sided:classical}) secure against two-sided asynchronous adversaries. We emphasize that this subsection still focuses on the small-tag setting.  
This step is essentially the same as its classical counterpart in \Cref{sec:small-tag:classical:sync,sec:small-tag:async:classical}
except for that we rely on post-quantum building blocks.

We present our construction in \Cref{prot:small-tag:pq}.
This protocol makes use of the following building blocks.
 \begin{itemize}
 \item
A post-quantum OWF $f$; 
\item
Naor's commitment $\mathsf{Com}$ that is implemented with a post-quantum OWF;
\item
A post-quantum witness-indistinguishable argument of knowledge with $\epsilon$-close emulation $\ensuremath{\mathsf{WIAoK}}\xspace$ 
(as per \Cref{def:PQWIAoK}); 
\item A post-quantum $\epsilon$-simulatable extractable commitment $\ensuremath{\mathsf{ExtCom}}\xspace$ (as per \Cref{def:epsilon-sim-ext-com:pq}).
We denote by $\ensuremath{\mathsf{Verify}}\xspace_{\ensuremath{\mathsf{ExtCom}}\xspace}$ the verification algorithm of $\ensuremath{\mathsf{ExtCom}}\xspace$ in the decommit stage.  
\end{itemize} 

Similarly to \Cref{sec:small-tag:async:classical}, we recursively define $n_5,...,n_9$ so that 
$n_i$ is greater than the total round complexity of Steps $1$ to $i-1$. We also require that $n_5$ is greater than the round complexities of $\ensuremath{\mathsf{WIAoK}}\xspace$ and $\ensuremath{\mathsf{ExtCom}}\xspace$. It is easy to see that we can set $n_i$ to a constant if both $\ensuremath{\mathsf{WIPoK}}\xspace$ and $\ensuremath{\mathsf{ExtCom}}\xspace$ have constant rounds. In particular, \Cref{prot:small-tag:pq} runs in constant rounds.  


\begin{ProtocolBox}[label={prot:small-tag:pq}]{Post-Quantum Small-Tag Asynchronous NMCom \textnormal{$\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$}}
The tag space is defined to be $[n]$ where $n$ is a polynomial on $\lambda$. Let $t \in [n]$ be the tag for the following interaction. Let $m$ be the message to be committed to. 

\para{Commit Stage:}
\begin{enumerate}
\item\label[Step]{item:small-tag:async:step:Naor-rho:pq}
Receiver $R$ samples and sends the first message $\beta$ for Naor's commitment.
\item\label[Step]{item:small-tag:async:step:committing:pq}
Committer $C$ commits to $m$ using the second message of Naor's commitment. $C$ also sends a $\beta'$ that will be used as the first Naor's message for $R$ to generate a commitment in next step. Formally, $C$ samples $r$ and $\beta'$ and sends the tuple $\big(\mathsf{com} = \mathsf{Com}_\beta(m;r),~\beta'\big)$. 

\item\label[Step]{item:small-tag:async:step:W-td:pq}  $R$ and $C$ do the following:
\begin{enumerate}
\item {\bf (TrapGen.)}\label[Step]{item:small-tag:async:step:W-td:Z:pq}
$R$ computes $V_0=f(v_0)$ and $V_1=f(v_1)$ with $v_0,v_1\ensuremath{\leftarrow}\xspace \{0,1\}^\lambda$ and sends $(V_0,V_1)$ to $C$ 
\item \label[Step]{item:small-tag:async:step:W-td:WIPoK:pq} {\bf (WIAoK-Trap.)}
$R$ and $C$ execute an instance of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of $V_0$ or $V_1$.
Formally, $R$ proves that $(V_0,V_1) \in \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$, where
\begin{equation}\label[Language]{eq:small-tag:async:Lang:TD:pq}
\ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}} \coloneqq \big\{(V_0,V_1)~\big|~\exists v ~s.t.~~f(v)=V_0~\vee~f(v)=V_1
\big\}.
\end{equation}
Note that $R$ uses $v_0$ as the witness when executing this $\ensuremath{\mathsf{WIAoK}}\xspace$.
\end{enumerate}

\item\label[Step]{item:small-tag:async:step:OWFs:pq}
$R$ performs the following computation:
\begin{enumerate}
\item \label[Step]{item:small-tag:async:step:OWFs:A:pq}
$R$ computes $\Set{y^A_i = f(x^A_i)}_{i \in [t]}$ with $x^A_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [t]$, and sets $Y^A \coloneqq (y^A_1, \ldots, y^A_t)$. $R$ also computes $\Set{\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i;r^A_i)}_{i\in [t]}$, where $r^A_i$ is a random string for each $i\in [t]$.  
\item \label[Step]{item:small-tag:async:step:OWFs:B:pq}
$R$ computes $\Set{y^B_i = f(x^B_i)}_{i \in [n-t]}$ with $x^B_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [n-t]$, and sets $Y^B \coloneqq (y^B_1, \ldots, y^B_{n-t})$. $R$ also computes $\Set{\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i;r^B_i)}_{i\in [n-t]}$, where $r^B_i$ is a random string for each $i\in [n-t]$.  
\end{enumerate}
$R$ sends the tuple $\big(Y^A,~\Set{\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i;r^A_i)}_{i\in [t]},~Y^B,~\Set{\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i;r^B_i)}_{i\in [n-t]}\big)$.

\item\label[Step]{item:small-tag:async:step:ExtCom:1:pq}
{\bf (ExtCom-1 $\times~n_5$.)}
$C$ and $R$ sequentially execute $n_5$ instances of $\ensuremath{\mathsf{ExtCom}}\xspace$ where $C$ commits to $m$. Let $\tau^1_i$ and $\ensuremath{\mathsf{decom}}\xspace^1_i$ be the transcript and decommitment (privately obtained by $C$) of the $i$-th execution. 


\item\label[Step]{item:small-tag:async:step:WIPoK:1A:pq}
{\bf (WIAoK-1-A $\times~n_6$.)} $R$ and $C$ sequentially execute $n_6$ instances of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y^A_i$ contained in $Y^A$, and $y^A_i$ are consistent with $\mathsf{com}^A_i$ (as defined in \Cref{item:small-tag:async:step:OWFs:A:pq}). Formally, $R$ proves that $(Y^A, \Set{\mathsf{com}^A_i}_{i\in[t]}) \in \ensuremath{\mathcal{L}}\xspace^t_{f,\beta'}$, where
\begin{equation}\label[Language]{eq:small-tag:async:Lang:OWF:A:pq}
\ensuremath{\mathcal{L}}\xspace^t_{f,\beta'} \coloneqq \Bigg\{(y^A_1, \ldots, y^A_t), (\mathsf{com}^A_1, \ldots, \mathsf{com}^A_t)~\Bigg|~\exists (i, x^A_i, r^A_i) ~s.t.~~
\begin{array}{l}
i \in [t] ~\wedge \\
y^A_i = f(x^A_i) ~\wedge \\
\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i; r^A_i)
\end{array}\Bigg\}.
\end{equation}
Note that $R$ uses $(1, x^A_1, r^A_1)$ as the witness when executing this $\ensuremath{\mathsf{WIAoK}}\xspace$.


\item\label[Step]{item:small-tag:async:step:ExtCom:2:pq}
{\bf (ExtCom-2 $\times~n_7$.)}
$C$ and $R$ sequentially execute $n_7$ instances of $\ensuremath{\mathsf{ExtCom}}\xspace$ where $C$ commits to $m$. Let $\tau^2_i$ and $\ensuremath{\mathsf{decom}}\xspace^2_i$ be the transcript and decommitment (privately obtained by $C$) of the $i$-th execution. 



\item\label[Step]{item:small-tag:async:step:WIPoK:1B:pq}
{\bf (WIAoK-1-B $\times~n_8$)} $R$ and $C$ sequentially execute $n_8$ instances of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y^B_i$ contained in $Y^B$, and $y^B_i$ are consistent with $\mathsf{com}^B_i$ (as defined in \Cref{item:small-tag:async:step:OWFs:B:pq}). Formally, $R$ proves that $(Y^B, \Set{\mathsf{com}^B_i}_{i\in[n-t]}) \in \ensuremath{\mathcal{L}}\xspace^{n-t}_{f,\beta'}$, where
\begin{equation}\label[Language]{eq:small-tag:async:Lang:OWF:B:pq}
\ensuremath{\mathcal{L}}\xspace^{n-t}_{f,\beta'} \coloneqq \Bigg\{(y^B_1, \ldots, y^B_{n-t}), (\mathsf{com}^B_1, \ldots, \mathsf{com}^B_{n-t})~\Bigg|~\exists (i, x^B_i, r^B_i) ~s.t.~~ 
\begin{array}{l}
i \in [n-t] ~\wedge \\
y^B_i = f(x^B_i) ~\wedge \\
\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i; r^B_i)
\end{array}\Bigg\}.
\end{equation}
Note that $R$ uses $(1, x^B_1, r^B_1)$ as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.


\item\label[Step]{item:small-tag:async:step:ExtCom:3:pq}
{\bf (ExtCom-3 $\times~n_9$.)}
$C$ and $R$ sequentially execute $n_9$ instances of $\ensuremath{\mathsf{ExtCom}}\xspace$ where $C$ commits to $m$. Let $\tau^2_i$ and $\ensuremath{\mathsf{decom}}\xspace^2_i$ be the transcript and decommitment (privately obtained by $C$) of the $i$-th execution.



\item\label[Step]{item:small-tag:async:step:WIPoK:2:pq}
{\bf (WIAoK-2.)} $C$ and $R$ execute an instance of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $C$ proves to $R$ that he ``knows'' the (same) message committed in $\mathsf{com}$ (defined in \Cref{item:small-tag:async:step:committing:pq}) and all commitments $\tau^c_i$ of $\ensuremath{\mathsf{ExtCom}}\xspace$ (in \Cref{item:small-tag:async:step:ExtCom:1:pq,item:small-tag:async:step:ExtCom:2:pq,item:small-tag:async:step:ExtCom:3:pq}), {\em or} a pre-image of some $y^A_i$ contained in $Y^A$ (defined in \Cref{item:small-tag:async:step:OWFs:A:pq}), {\em or} a pre-image of some $y^B_i$ contained in $Y^B$ (defined in \Cref{item:small-tag:async:step:OWFs:B:pq})
{\em or} a preimage of either of $V_0$ or $V_1$ (defined in \Cref{item:small-tag:async:step:W-td:Z:pq}). Formally, $C$ proves that $(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace}, Y^A, Y^B, V_0,V_1) \in \ensuremath{\mathcal{L}}\xspace_{\beta} \vee \ensuremath{\mathcal{L}}\xspace^t_f \vee \ensuremath{\mathcal{L}}\xspace^{n-t}_f \vee \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$,
where $\ensuremath{J}\xspace=(\{1\}\times [n_5])\cup (\{2\}\times [n_7])\cup (\{3\}\times [n_9])$, 
\begin{align}
& \ensuremath{\mathcal{L}}\xspace_{\beta} \coloneqq \Bigg\{(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace}) ~\Bigg|
\begin{array}{l}
~ \exists (m, r,\{\ensuremath{\mathsf{decom}}\xspace^c_i\}_{(c,i)\in \ensuremath{J}\xspace})~s.t.~\\ 
\begin{array}{l}
\mathsf{com} = \mathsf{Com}_\beta(m;r)~\wedge\\
\forall~(c,i)\in \ensuremath{J}\xspace,~ \ensuremath{\mathsf{Verify}}\xspace_{\ensuremath{\mathsf{ExtCom}}\xspace}(m,\tau^c_i,\ensuremath{\mathsf{decom}}\xspace^c_i)=\top\\
\end{array}
\end{array}
\Bigg\}
\label[Language]{eq:small-tag:async:Lang:Com:pq}\\
& \ensuremath{\mathcal{L}}\xspace^t_f \coloneqq \Set{(y^A_1, \ldots, y^A_t) ~|~ \exists (i, x^A_i)~s.t.~ i \in [t] \wedge y^A_i = f(x^A_i)}, \\
& \ensuremath{\mathcal{L}}\xspace^{n-t}_f \coloneqq \Set{(y^B_1, \ldots, y^B_{n-t}) ~|~ \exists (i, x^B_i)~s.t.~ i \in [n-t] \wedge y^B_i = f(x^B_i)},
\end{align}
and $\ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ is defined in \Cref{eq:small-tag:async:Lang:TD:pq}. 
Note that $C$ uses the $(m, r, \{\ensuremath{\mathsf{decom}}\xspace^c_i\}_{(c,i)\in\ensuremath{J}\xspace})$ defined in \Cref{item:small-tag:async:step:committing:pq,item:small-tag:async:step:ExtCom:1:pq,item:small-tag:async:step:ExtCom:2:pq,item:small-tag:async:step:ExtCom:3:pq} as the witness when executing this $\ensuremath{\mathsf{WIAoK}}\xspace$.

\end{enumerate}
\para{Decommit Stage:} 
$C$ sends $(m, r)$. $R$ accepts if $\mathsf{com} = \mathsf{Com}_\beta(m;r)$, and rejects otherwise.
\end{ProtocolBox}

We remark that \Cref{prot:small-tag:pq} is identical to \Cref{prot:small-tag:classical} except that we require post-quantum security for building blocks and use WIAoK instead of WIPoK. 

\para{Security.}
Completeness is straightforward. Statistical binding follows from that of Naor's commitment. 

For computational hiding and non-malleability, we observe that the proofs against classical adversaries in \Cref{sec:small-tag:async:classical} is already quantum-friendly, and they can be translated into proofs against quantum adversaries in a straightforward manner. The only difference is that we now have $\epsilon$-close simulation for $\ensuremath{\mathsf{WIAoK}}\xspace$ and $\ensuremath{\mathsf{ExtCom}}\xspace$ though the classical counterparts have negligible simulation errors. Thus, whenever we invoke extractors of $\ensuremath{\mathsf{WIPoK}}\xspace$ or $\ensuremath{\mathsf{ExtCom}}\xspace$ in the original proof in the classical setting, a noticeable error occurs in the post-quantum setting. However, this is not a problem since the error can be an \emph{arbitrarily small} noticeable function. Thus, by repeating the same proofs as those in the classical case, we can show that QPT MIM adversary's advantage is smaller than \emph{any} noticeable function in the security parameter. This means that the advantage is negligible, which is nothing but non-malleability in the standard sense. 
Thus, we obtain the following theorems. 

\begin{theorem}\label{thm:small-tag:async:classical:hiding:pq}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$ in \Cref{prot:small-tag:pq} is computationally hiding against QPT adversaries.
\end{theorem}
\begin{theorem}\label{thm:nm:small-tag:pq}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$ in \Cref{prot:small-tag:pq} is non-malleable against asynchronous QPT adversaries with tag space $[n]$, with $n$ being any polynomial on $\lambda$.
\end{theorem}

\subsection{Tag Amplification}
\label{sec:full:pq:nmcom:tag-amp}
Finally, we explain how to amplify the tag space of \Cref{prot:small-tag:pq}. For this step, we rely on the following variant of a theorem shown in \cite{BLS21}. 

\begin{theorem}[{\cite[Section 6]{BLS21}}]\label{thm:tag-amp}
Assume the existence of  
\begin{itemize}
\item
a post-quantum, $k_1$-round, $\epsilon$-simulatable extractable commitment (as per \Cref{def:epsilon-sim-ext-com:pq}), and
\item
a post-quantum, $k_2$-round, witness-indistinguishable argument. 
\end{itemize} 
Let $\langle C, R \rangle_{\mathsf{tg,PQ}}^{\mathsf{async}}$ be a post-quantumly non-malleable commitment scheme, where the subscript $\mathsf{tg}$ denotes the {\em length} of the maximum tag it can support. Assume  $\langle C, R \rangle_{\mathsf{tg,PQ}}^{\mathsf{async}}$ satisfies the following conditions: 
\begin{enumerate}
\item
$\langle C, R \rangle_{\mathsf{tg,PQ}}^{\mathsf{async}}$  supports $\mathsf{tg} \in \Set{3, 4, \ldots, O(\log \lambda)}$ bit tags, and  
\item \label[Condition]{item:BLS:tag-amp:condition:2}
$\langle C, R \rangle_{\mathsf{tg,PQ}}^{\mathsf{async}}$ is also a post-quantum $(k_1+k_2)$-robust $\epsilon$-simulatable extractable commitment scheme (as per \Cref{def:robust-epsilon-sim-ext-com:pq}).
\end{enumerate}
Then, there exists a post-quantum non-malleable commitment scheme $\langle C, R \rangle_{\mathsf{TG,PQ}}^{\mathsf{async}}$ which supports tags of $\mathsf{TG} = 2^{\mathsf{tg}-1}$ bits. Moreover, $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{TG,PQ}}$ has $k_1 + k_2 + O(1)$ rounds.
\end{theorem}
\begin{remark}
In the original version of the above theorem in \cite{BLS21}, they require $\mathsf{negl}$-simulatability instead of $\epsilon$-simulatability for the extractable commitment and the non-malleable commitment schemes (in \Cref{item:BLS:tag-amp:condition:2}). However, we can see that the $\epsilon$-simulatable version suffices due to a similar reason as explained in the end of the previous subsection. That is, if we use extractors with a noticeable error in their proof, we can show that the adversary's advantage is at most a noticeable function in $\lambda$. Since the noticeable error can be chosen to be arbitrarily small, this implies non-malleability in the standard sense. 
\end{remark}


Given the above \Cref{thm:tag-amp}, we only need to prove that $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$ in \Cref{prot:small-tag:pq} has $(k_1 + k_2)$-robust  $\epsilon$-simulatable extractability where $k_1$ and $k_2$ are the round complexities of $\ensuremath{\mathsf{ExtCom}}\xspace$ and $\ensuremath{\mathsf{WIAoK}}\xspace$ used in the construction of $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$.\footnote{For applying \Cref{thm:tag-amp}, we only need to require computational soundness for the witness indistinguishable argument rather than the witness-extended emulation property. But since the latter is stronger than the former, we can simply instantiate it with any $\ensuremath{\mathsf{WIAoK}}\xspace$ that satisfies \Cref{def:PQWIAoK}.} 
We show this below.
\begin{theorem}\label{thm:robust:pq}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$ in \Cref{prot:small-tag:pq} satisfies post-quantum $(k_1+k_2)$-robust $\epsilon$-simulatable extractability (as per \Cref{def:robust-epsilon-sim-ext-com:pq}) where $k_1$ and $k_2$ are round complexities of $\ensuremath{\mathsf{ExtCom}}\xspace$ and $\ensuremath{\mathsf{WIAoK}}\xspace$.  
\end{theorem}
\begin{proof}(sketch.)
We first remark that we have $n_9>k_1+k_2$ since we assume that $n_9$ is larger than the total round complexity of Steps \ref{item:small-tag:async:step:Naor-rho:pq} to \ref{item:small-tag:async:step:WIPoK:1B:pq}, which is clearly larger than $k_1+k_2$ since those steps include repetitions of $\ensuremath{\mathsf{ExtCom}}\xspace$ and $\ensuremath{\mathsf{WIAoK}}\xspace$.  
Then, by the pigeonhole principle, for each session with $O^\infty$, 
there is $i^*$ such that {\bf ExtCom-3-$i^*$} does not interleave with the interaction with the external $(k_1+k_2)$-round machine $B$ in the definition of $r$-robust $\epsilon$-simulatable extractability (in \Cref{def:robust-epsilon-sim-ext-com:pq}). Then, we can extract the committed message by running the extractor for  {\bf ExtCom-3-$i^*$} without rewinding $B$.\footnote{We can assume that such $i^*$ is known in advance w.l.o.g. by \Cref{lem:adaptive-predetermined:async}.} We can show that the extracted message is the correct committed message in $\mathsf{com}$ (in \Cref{item:small-tag:async:step:Naor-rho:pq}) whenever the receiver accepts except for a negligible probability similarly to \Cref{lem:ExtCom_soundness}. This enables us to simulate the oracle $O^{\infty}$ without rewinding $B$. 

\end{proof}

Finally, by combining \Cref{thm:nm:small-tag:pq,thm:tag-amp,thm:robust:pq}, we obtain the following theorem. 

\begin{theorem}\label{thm:nmcom_largetag_pq}
Assuming the existence of post-quantum OWFs, there exist constant-round post-quantum non-malleable commitments supporting tag space $[\Omega(2^\lambda)]$. 
\end{theorem}






\section{Introduction}

Commitments are one of the central primitives in modern cryptography. They are two-party protocols that enable a sender (or committer) to commit to a message to a receiver. It is required that an efficient receiver should learn nothing about the committed message until later the committer chooses to open (or decommit to) it. However, this vanilla promise of ``information hiding'' does not rule out the following mauling or man-in-the-middle (MIM) attack:
An adversary $\mathcal{M}$ could play the role of a receiver in one instance of the commitment (referred to as the {\em left session}), while simultaneously playing as a committer in another (referred to as the {\em right session}). In this situation, $\mathcal{M}$ can potentially make the value committed in the right session depend on the value in the left session, in a malicious manner that is to her advantage. Notice that this is not breaking the hiding property of the commitment scheme, as $\mathcal{M}$ could conduct the above attack without explicitly learning the value committed in the left session.	

To protect against such attacks, Dolev, Dwork, and Naor \cite{STOC:DolDwoNao91} introduced the concept of {\em non-malleable commitments}. They capture the MIM attack by requiring that in the MIM execution, the {\em joint distribution} of $\mathcal{M}$'s final output {\em and} the value committed in the right session is computationally indistinguishable for any values committed by the honest committer in the left session. Of course, $\mathcal{M}$ can always relay without any modifications the messages between the left honest committer and the right honest receiver. This is handled by augmenting the commitment scheme with a {\em tag}, and $\mathcal{M}$ is considered winning the MIM game only if she does not use the same tag on both sides.\footnote{Copying the tag can be shown equivalent to copying the entire interaction assuming (quantum) one-way functions.}


Non-malleable commitments have found several applications in cryptography. They turn out to be a critical ingredient in resolving the exact round complexity of secure multiparty computation in the standard (plain) model \cite{EC:KatOstSmi03,C:PanPasVai08,FOCS:Wee10,STOC:Goyal11,EC:GMPP16,C:BGJKKS18,EPRINT:CCGJO19}, as well as protecting such protocols against concurrent attacks \cite{JC:Canetti00,FOCS:Canetti01,STOC:CLOS02,EC:Pass03,STOC:PraSah04,FOCS:MicPasRos06,EC:BDHMN17,ICALP:ChaLiaPan20}.

Since their introduction, the central question in this area has been the construction of {\em constant-round} non-malleable commitments under the minimal assumption that one-way functions (OWFs) exist. The original work of Dolev et al.\ presented a logarithmic-round construction assuming only OWFs. The works of Barak \cite{FOCS:Barak02}, and Pass and Rosen \cite{STOC:PasRos05} succeeded in obtaining constant-round constructions under the (stronger but standard) assumption of  (polynomially-hard) collision-resistant hash functions; this assumption is inherited due to the use of non-black-box simulation techniques \cite{FOCS:Barak01}. After a long line of follow up works \cite{C:PanPasVai08,TCC:LinPasVen08,STOC:LinPas09,FOCS:Wee10}, constant-round non-malleable commitments assuming only OWFs were first constructed in independent and concurrent works of Goyal \cite{STOC:Goyal11} and Lin and Pass \cite{STOC:LinPas11}. Since then, several constructions optimizing various aspects of this primitive, such as the {\em exact} round complexity \cite{TCC:Pass13,FOCS:GRRV14,STOC:GoyPanRic16,C:COSV17,FOCS:LinPasSon17,TCC:Khurana17,FOCS:KhuSah17,TCC:BitLin18,FOCS:GoyRic19,EC:Khurana21} and black-box usage of primitives \cite{FOCS:Wee10,STOC:Goyal11,FOCS:GLOV12}, have been proposed, thus achieving an almost complete understanding of this primitive in the {\em classical} setting where all parties, including the adversary, as well as the communication are classical.



Unfortunately, the results in the classical setting do not usually translate to the quantum setting where one or more parties may be quantum machines. Existing classical techniques often require the ability to rewind and copy the adversaries' code, both of which are not possible in the quantum setting due to the no-cloning theorem \cite{wootters1982single} and quantum state disturbance \cite{fuchs1996quantum}.






These issues, together with the fact that quantum computers might be possible one day, have resulted in a significant push towards developing tools and techniques to reason about security in the presence of quantum adversaries. Some examples include zero-knowledge \cite{STOC:Watrous06,STOC:BitShm20}, signatures \cite{C:BonZha13}, pseudo-random functions \cite{FOCS:Zhandry12}, secure computation \cite{C:BCKM21b,EC:ABGKM21}, and so on.

\para{Post-Quantum Non-Malleable Commitments.} A particularly appealing goal in this direction is the construction of the so-called {\em post-quantum} secure protocols, where the honest parties and their communication channels are entirely {\em classical} but the adversary is allowed to be a {\em quantum} (polynomial-time) algorithm. Such protocols have the feature that even if the adversary somehow gains early access to quantum computing capabilities, the honest parties are not required to catch up to remain protected against it.

Agarwal, Bartusek, Goyal, Khurana, and Malavolta \cite{EC:ABGKM21}---in their pursuit of constant-round post-quantum secure multiparty computation---construct a constant-round post-quantum non-malleable commitments w.r.t. the special case of {\em synchronous schedules} where, upon receiving a message in the left session, $\mathcal{M}$ must respond with the corresponding message of the right session immediately, in reach round of the protocol. They achieve this assuming super-polynomial quantum hardness of the learning with errors (QLWE) problem



In the general (i.e., asynchronous) setting, the first positive result was recently obtained by Bitansky, Lin, and Shmueli \cite{BLS21} who, in the  post-quantum setting, construct a $\log^*(\lambda)$-round protocol assuming only post-quantum OWFs. They present a general compiler to convert any $k$-round  ($\epsilon$-simulatable) post-quantum extractable commitment to $k^{O(1)}\cdot \log^*(\lambda)$-round post-quantum non-malleable commitments, and then rely on (the very recent) work of Chia, Chung, Liang, and Yamakawa \cite{cryptoeprint:2021:1516} where such an extractable commitment protocol is constructed in constant rounds from only post-quantum OWFs (see also \cite[Section 1.2]{cryptoeprint:2021:1516}). This brings us tantalizingly close to constant rounds. However, the techniques in \cite{BLS21} rely on scheduling and amplification techniques, which inherently require non-constant rounds to support (the standard requirement of) large tags or identities. It is unclear if these techniques can yield constant rounds.

\iffalse
In the general (i.e., asynchronous) setting, the first positive result is obtained by Bitansky, Lin, and Shmueli \cite{BLS21} who (in the  post-quantum setting where the protocols must be classical) construct:
(i) a $\log^*(\lambda)$-round protocol based on quantum fully-homomorphic encryption (QFHE) as well as QLWE, and (ii)
a polynomial-round protocol based on post-quantum oblivious transfers. More accurately, they present a general compiler that converts any $k$-round post-quantum extractable commitments to $k^{O(1)}\cdot \log^*(\lambda)$-round post-quantum non-malleable commitments. 

\om{Since CCLY only suggest but do not claim the NMCOM result, I have modified the paragraph after submission. Original paragraph is commented in case we want to revert back to it.}

In a recent work, Chia, Chung, Liang, and Yamakawa \cite{cryptoeprint:2021:1516} obtain an $\epsilon$-simulatable version of post-quantum extractable commitments from post-quantum OWFs, and observe that this may suffice for the Bitansky et al.'s compiler \cite[Section 1.2]{cryptoeprint:2021:1516}. This has the potential to yield an $\Omega(\log^*\lambda)$-round construction under the minimal assumption of post-quantum OWFs. However, this approach too is unlikely to yield a constant round construction.
\fi





The central question in this area thus still remains open:
\begin{quote}
{\bf Question 1:} {\em Do constant-round post-quantum non-malleable commitments, assuming only post-quantum one-way functions, exist?}
\end{quote}

\subsection{Challenge: Robust Simulatable Extraction}\label{sec:challenge}
Toward answering {\bf Question 1}, let us first discuss about the challenges.

As mentioned above, proving non-malleability of a commitment scheme requires one to show that the {\em joint distribution} of the final state of the MIM $\mathcal{M}$ (denoted by $\mathsf{st}_\mathcal{M}$) {and} the value committed in the right session (denoted by $\tilde{m}$) are computationally indistinguishable when the left-session committed value changes from any $m_0$ to any $m_1 \ne m_0$. Typically, this is done by a careful design of a sequence of hybrids, where the left value is gradually changed from $m_0$ to $m_1$; And non-malleability will then be established by showing that the joint distribution of $(\mathsf{st}_\mathcal{M}, \tilde{m})$ are indistinguishable between each pair of adjacent hybrids. As in many other cryptographic proofs, one usually needs to reduce the indistinguishability between adjacent hybrids to some computational hardness assumptions. But this step is especially hard for non-malleability proofs due to the following ``inefficient testability'' issue---The value $\tilde{m}$ is hidden in the transcript of the right interaction, and no efficient machine could obtain it. Thus, the event that ``the joint distribution of $(\mathsf{st}_\mathcal{M}, \tilde{m})$ changes'' is not efficiently testable, thus forbidding an efficient reduction to the underlying assumptions.

The most common template to address the above issue is to (efficiently) extract the value $\tilde{m}$ from some extractable gadget in the right session. The hope is: if the extracted value, denoted by $\tilde{m}'$, is equal to $\tilde{m}$ with good-enough probability, then one can conduct the above reduction using $(\mathsf{st}_{\mathcal{M}}, \tilde{m}')$ in place of $(\mathsf{st}_{\mathcal{M}}, \tilde{m})$. That is, since the extraction of $\tilde{m}'$ is efficient, it saves the reduction from the aforementioned inefficient testability issue.

To properly implement this template, it is crucial to maintain the following conditions (the combination of which we will informally refer to as {\em Robust Simulatable Extractability}.)
\begin{itemize}
\item
{\bf Extractability:} One can extract the committed message $\tilde{m}$ in the right session by rewinding;
\item
{\bf Simulatability:} One can simulate $\mathcal{M}$'s final state while extracting $\tilde{m}$;
\item
{\bf Robustness:} The rewinding for the extraction does not harm the hiding property of the left session (or some gadget whose hiding property the security reduction relies on). 
\end{itemize}
Roughly, previous designs of non-malleable protocols (in the classical setting) can be thought of as developing different (and better-and-better) techniques that ensure the above robust simulatable extractability.

However, robust simulatable extractability turns out to be hard to obtain {\em in the post-quantum setting}.   First, as mentioned earlier, special techniques are needed to perform simulation for quantum adversaries due to the no-cloning theorem; Extracting a desired value while simultaneously simulating the quantum adversaries' internal state is even harder. Fortunately, the recent works \cite{cryptoeprint:2021:1516,cryptoeprint:2021:1543} did provide a constant-round solution to simulatable extractability based solely on post-quantum OWFs. 
But the picture becomes unclear when we additionally require robustness. Known simulatable extraction techniques treat the adversary as a single reversible operation (i.e., unitary) and ``rewind'' it coherently. However, if the adversary talks in straight-line with the external left committer $C$ (that cannot be rewound), those techniques seem  inapplicable. Actually, this robustness issue already appeared in the classical setting. But we would like to point out that the quantum power of adversaries complicates it further: it is reasonable to expect that the extractor (to be constructed) may need to ``read'' the messages exchanged between the MIM adversary $\mathcal{M}$ and the left committer $C$. However, known quantum rewinding strategies need to treat the adversary as a reversible operation. When we view $(C,\mathcal{M})$ as a joint adversary to perform quantum rewinding, it is unclear if the simulator can read (technically, measure) the messages exchanged between $C$ and $\mathcal{M}$, because this may irreversibly collapse the internal quantum state of $(C,\mathcal{M})$ adversary. Therefore, it is unclear if existing post-quantum rewinding techniques could be used in the MIM setting. This represents the major difficulty when one tries to build constant-round post-quantum non-malleable commitments by quantizing the security proofs of the classical ones (e.g., \cite{STOC:Goyal11,STOC:LinPas11,FOCS:GLOV12,FOCS:GRRV14,STOC:GoyPanRic16,C:COSV17,FOCS:GoyRic19}).








\para{Existing Techniques.} The two recent works mentioned earlier
showed how to address the robust simulatable extractability issue, if one is willing to make stronger hardness assumptions, {\em or} does not insist on constant rounds:
\begin{itemize}
\item
\cite{BLS21} drew inspirations from the classical work of \cite{STOC:DolDwoNao91}.
Roughly speaking, the idea is to introduce enough rewinding opportunities (usually referred to as ``slots'') in the construction such that there is always a ``free slot'', namely, a slot that does not interleave with any messages exchange between $\mathcal{M}$ and the left committer $C$ (who will become the external challenger of the hardness-providing gadget in the security proof); Then, one can extract $\tilde{m}$ from this free slot using known post-quantum rewinding strategies. This approach is unlikely to give a constant-round construction (even in the classical setting). The constructions from \cite{BLS21} require at least $\log^*(\lambda)$ rounds.
\item
\cite{EC:ABGKM21} took a similar approach as in \cite{EC:PasWee10,FOCS:KhuSah17}, which essentially obtained robust simulatable extractability via {\em complexity leveraging}. At a high level, the idea is to hide the committed value in some computationally hard gadget, whose hardness depends on the tag. This hard gadget is cleverly designed to admit the following strategy: In the MIM execution, because of the asymmetry of the left and right tags (i.e., $t \ne \tilde{t}$), the reduction can extract $\tilde{m}$ by breaking the right hard gadget via brute force in some slightly super-polynomial time $T(\lambda)$, however, the MIM adversary cannot break the left hard gadget in time $\mathsf{poly}\big(T(\lambda)\big)$. Since the extraction in this template is conducted via brute force, the robust simulatable extraction issue can be circumvented. However, this approach is unlikely to work without super-polynomial hardness assumptions due to the use of complexity leveraging.
\end{itemize}












\subsection{Our Results}
In this work, we answer {\bf Question 1} affirmatively by providing the first constant-round construction of post-quantum non-malleable commitments assuming only post-quantum one-way functions.

As discussed above, major classical approaches to OWF-based constant-round non-malleable commitments seem not to be ``quantum-friendly.'' Therefore, we first present a new classical construction whose security proof is quantum-friendly. That is, when designing our new protocol, we restrict ourselves to techniques that avoid state-cloning and the above robust simulatable extractability issue. We find this result already interesting as it improves the diversity of the approaches known in the classical setting.

Next, we show that our new classical construction can be made quantum-secure once its building blocks are replaced by their post-quantum counterparts. Of course, this is possible because our classical construction is designed to be quantum-friendly deliberately. 
\begin{theorem}[Informal]
Assuming the existence of post-quantum one-way functions, there exists a constant-round construction of post-quantum non-malleable commitments.
\end{theorem}

Finally, we show an application to post-quantum {\em multi-party computation} (MPC). The recent work by Agarwal et al.\ \cite{EC:ABGKM21} presents the first post-quantum MPC in constant rounds, from a mildly super-polynomial {\em quantum hardness of Learning with Errors} (QLWE) assumption and an LWE-based circular security assumption. They need the super-polynomial hardness of QLWE (only) to build constant-round post-quantum non-malleable commitments, which serve as a building block to their MPC protocol. Plugging our non-malleable commitment into their framework yields the following result:
\begin{corollary}[Informal]
Assuming (polynomial) QLWE and an QLWE-based circular security assumption (as in~\cite{EC:ABGKM21}), there exists a constant-round construction of post-quantum MPC.
\end{corollary}




\section{Small-Tag, One-sided, Synchronous, Post-Quantum Setting}\label{sec:small-tag-one-sided-sync-pq}
In this section, we prove that \Cref{prot:one-sided:classical} is post-quantumly secure if we rely on post-quantum building-blocks. 
Similarly to the classical case in \Cref{sec:small-tag-one-sided-sync-classical}, we present the construction assuming the existence of post-quantum {\em injective} OWFs.  
The assumption can be relaxed to  {\em any} OWFs by an appropriate modification to the protocol similarly to the classical case.  
Since this is exactly the same as that in the classical setting, which is explained in \Cref{sec:removing-injectivity}, we do not repeat it in this section. 

Our construction is based on the following building blocks:
\begin{itemize}
\item
A post-quantum {\em injective} OWF $f$; 
\item
Naor's commitment $\mathsf{Com}$ that is implemented with a post-quantum OWF.\footnote{In this way, the Naor's commitment is statistically-binding and {\em post-quantumly} computationally-hiding.};
\item
A post-quantum witness-indistinguishable argument of knowledge with $\epsilon$-close emulation $\ensuremath{\mathsf{WIAoK}}\xspace$
(as per \Cref{def:PQWIAoK}). 
\end{itemize}

\begin{ProtocolBox}[label={prot:one-sided:pq}]{Small-Tag One-Sided Synchronous Post-Quantum NMCom \textnormal{$\langle C, R\rangle^{\mathsf{OneSided}-\mathsf{pq}}_{\mathsf{tg}}$}}
The tag space is defined to be $[2n]$ where $n$ is a polynomial on $\lambda$. Let $t \in [2n]$ be the tag for the following interaction. Let $m$ be the message to be committed to. \red{Why $2n$ instead of $n$?}

\para{Commit Stage:}
\begin{enumerate}
\item\label[Step]{item:one-sided:pq:step:Naor-rho}
Receiver $R$ samples and sends the first message $\gamma$ for Naor's commitment; 
\item\label[Step]{item:one-sided:pq:step:committing}
Committer $C$ commits to $m$ using the second message of Naor's commitment. Formally, $C$ samples a random tape $r$ and sends $\mathsf{com} = \mathsf{Com}_\gamma(m;r)$;
\item\label[Step]{item:one-sided:pq:step:OWFs}
$R$ computes $\Set{y_i = f(x_i)}_{i \in [t]}$ with $x_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [t]$. $R$ sends $Y = (y_1, \ldots, y_t)$ to $C$;
\item\label[Step]{item:one-sided:pq:step:WIAoK:1}
{\bf (WIAoK-1.)} $R$ and $C$ execute an instance of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y_i$ contained in $Y$ (defined in \Cref{item:one-sided:pq:step:OWFs}). Formally, $R$ proves that $Y \in \ensuremath{\mathcal{L}}\xspace^t_f$, where \begin{equation}\label[Language]{eq:one-sided:pq:Lang:OWF}
\ensuremath{\mathcal{L}}\xspace^t_f \coloneqq \Set{(y_1, \ldots, y_t)~|~\exists (i, x_i) ~s.t.~ i \in [t] \wedge y_i = f(x_i)}.
\end{equation}
Note that $R$ uses $(1,x_1)$ as the witness when executing this $\ensuremath{\mathsf{WIAoK}}\xspace$.
\item\label[Step]{item:one-sided:pq:step:WIAoK:2}
{\bf (WIAoK-2.)} $C$ and $R$ execute an instance of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $C$ proves to $R$ that he ``knows'' {\em either} the message committed in $\mathsf{com}$ (defined in \Cref{item:one-sided:pq:step:committing}), {\em or} a pre-image of some $y_i$ contained in $Y$ (defined in \Cref{item:one-sided:pq:step:OWFs}). Formally, $C$ proves that $(\mathsf{com}, Y) \in \ensuremath{\mathcal{L}}\xspace_\gamma \vee \ensuremath{\mathcal{L}}\xspace^t_f$, where $\ensuremath{\mathcal{L}}\xspace_\gamma \vee \ensuremath{\mathcal{L}}\xspace^t_f$ denotes the  OR-composed language (as per \Cref{def:OR-Comp}), $\ensuremath{\mathcal{L}}\xspace^t_f$ was defined in \Cref{eq:one-sided:pq:Lang:OWF} and 
\begin{equation}\label[Language]{eq:one-sided:pq:Lang:Com}
\ensuremath{\mathcal{L}}\xspace_\gamma\coloneqq \Set{\mathsf{com} ~|~ \exists (m, r)~s.t.~ \mathsf{com} = \mathsf{Com}_\gamma(m;r)}.
\end{equation}
Note that $C$ uses the $(m, r)$ defined in \Cref{item:one-sided:pq:step:committing} as the witness when executing this $\ensuremath{\mathsf{WIAoK}}\xspace$.
\end{enumerate}
\para{Decommit Stage:} 
$C$ sends $(m, r)$. $R$ accepts if $\mathsf{com} = \mathsf{Com}_\gamma(m;r)$, and rejects otherwise.
\end{ProtocolBox}

Remark that the above protocol is exactly the same as \Cref{prot:one-sided:pq} except that we use WIAoK instead of WIPoK and and assume post-quantum security for all  building-blocks.
Completeness, post-quantum computational hiding, and statistical binding hold similarly to the classical case in \Cref{sec:small-tag-one-sided-sync-classical}. 

\if0
Formally, we prove the following theorem.
\begin{theorem}
\Cref{prot:one-sided:classical} is a one-sided non-malleable commitment
scheme secure against synchronous QPT adversaries when the building blocks satisfies the following requirements:
\begin{itemize}
\item
	Naor's commitment is implemented with a post-quantum OWF.\footnote{In this way, the Naor's commitment is statistically-binding and {\em post-quantumly} computationally-hiding.}
\item
The injective OWF $f$ is a post-quantum one-way function
\item
The WIAoK satisfies \red{give the definition and Cref to it}
\end{itemize} 
\end{theorem}
\fi 


\subsection{Proving Non-Malleability}
\label{one-sided:pq:non-malleability:proof}

\begin{theorem}\label{thm:one-sided:pq:non-malleability}
The commitment scheme $\langle C, R\rangle^{\mathsf{OneSided}-\mathsf{pq}}_{\mathsf{tg}}$ in \Cref{prot:one-sided:pq} is a one-sided non-malleable commitment scheme secure against synchronous QPT adversaries.
\end{theorem}	
In the rest of this section, we write $\langle C, R \rangle$ to mean $\langle C, R\rangle^{\mathsf{OneSided}-\mathsf{pq}}_{\mathsf{tg}}$ for notational simplicity. 

We prove \Cref{thm:one-sided:pq:non-malleability} in \Cref{one-sided:pq:non-malleability:proof,sec:one-sided:pq:core-lemma:proof,lem:small-tag:proof:se:proof:pq,sec:lem:small-tag:proof:se:proof:K:proof:pq,sec:lem:bound:Ki:proof:pq}.
The proof follows the same template used in \Cref{one-sided:non-malleability:proof:classical}.
Almost all steps in the proof of \Cref{thm:one-sided:non-malleability} are directly translated into the post-quantum setting. The only exception is the proof of \Cref{lem:small-tag:proof:se} (whose post-quantum counterpart is \Cref{lem:small-tag:proof:se:pq}) where we amplify the extractor $\mathcal{K}$ to the simulation-extractor $\mathcal{SE}$ by rewinding. Since we cannot rewind quantum algorithms in general, we rely on an alternative argument based on the extract-and-simulate lemma~(\Cref{lem:extract_and_simulate}).


We use the same notation as in the proof of \Cref{thm:one-sided:non-malleability}, with the only difference that now the adversaries are QPT machines (instead of PPT machines). It is worth noting that the honest committer and receiver are still classical (i.e., PPT) machines. 

\para{Game $H^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda)$:\label{gameH:description:pq}} This game is identical to the classical counterpart defined on \Cpageref{gameH:description}, except that $\mathcal{M} = \Set{\mathcal{M}_\lambda, \rho_\lambda}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}$ now is a QPT machine.
That is, this is the man-in-the-middle execution of the commit stage of the $\langle C, R \rangle$ defined in \Cref{prot:one-sided:pq}, where the left committer commits to $m$ and $\mathcal{M}$'s non-uniform advice is $\rho_\lambda$. 
The output of $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$ is again defined to be $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}, \tilde{\tau}, b)$, where $\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}$ is the (quantum) output of $\mathcal{M}_\lambda(\rho_\lambda)$ at the end of this game, $\tilde{\tau}$ consists of the \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} messages in the right session, and $b \in \Set{\top, \bot}$ is the honest receiver's decision.

\para{Notation.} 
\xiao{Provide more explanation of notation. In particular, the MIM game for QPT adversaries are denoted as $\bar{\mathsf{mim}}^{\mathcal{M}_\lambda}_{\langle C, R \rangle}(m, \rho_\lambda)$. See \Cref{def:NMCom:pq}.}\takashi{Is the following okay?}

Recall that the man-in-the middle game for a QPT adversary $\mathcal{M}$ is denoted by $\bar{\mathsf{mim}}^{\mathcal{M}_\lambda}_{\langle C, R \rangle}(m, \rho_\lambda)$ as defined in \Cref{def:NMCom:pq}. 
Remark that ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace$'' refers to {\em quantum} computational indistinguishability throughout this section.

For any $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}, \tilde{\tau}, b)$ in the support of $H^{\mathcal{M}_\lambda}(\lambda,m,z)$, we define $\mathsf{val}_b(\tilde{\tau})$ similarly to the classical case, i.e., 
$$
\mathsf{val}_b(\tilde{\tau}) \coloneqq 
\begin{cases}
\mathsf{val}(\tilde{\tau}) & b = \top\\
\bot & b = \bot
\end{cases},
$$
where $\mathsf{val}(\tilde{\tau})$ denote the value statistically-bounded in \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} of the right session.


Similarly to \Cref{eq:classical:mim-H}, we have
\begin{align}
\big\{\bar{\mathsf{mim}}^{\mathcal{M}_\lambda}_{\langle C, R \rangle}(m, \rho_\lambda)\big\} \ensuremath{\stackrel{\text{i.d.}}{=\mathrel{\mkern-3mu}=}}\xspace \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, \mathsf{val}_b(\tilde{\tau})\big): (\ensuremath{\mathsf{OUT}}\xspace, \tilde{\tau}, b) \gets H^{\mathcal{M}_\lambda}(m,\rho_\lambda) \big\},
\end{align}
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.

Then, similarly to \Cref{eq:classical:H:m-0:m-1}, the post-quantum non-malleability can be reduced to establishing the following equation:
\begin{align*}
&\big\{\big(\ensuremath{\mathsf{OUT}}\xspace^0, \mathsf{val}_{b^0}(\tilde{\tau}^0)\big): (\ensuremath{\mathsf{OUT}}\xspace^0, \tilde{\tau}^0, b^0) \gets H^{\mathcal{M}_\lambda}(m_0,\rho_\lambda) \big\} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~& 
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace^1, \mathsf{val}_{b^1}(\tilde{\tau}^1)\big): (\ensuremath{\mathsf{OUT}}\xspace^1, \tilde{\tau}^1, b^1) \gets H^{\mathcal{M}_\lambda}(m_1,\rho_\lambda) \big\} \numberthis \label{eq:classical:H:m-0:m-1:pq},
\end{align*}
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $(m_0, m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.

\para{Proof by Contradiction.} Similarly to \Cref{eq:one-sided:proof:contra-assump}, we assume for contradiction that there are a (possibly non-uniform) QPT distinguisher $\mathcal{D} = \Set{\mathcal{D}_\lambda, \sigma_\lambda}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}$ and a function $\delta(\lambda) = 1/\mathsf{poly}(\lambda)$ such that for infinitely many $\lambda \in \ensuremath{\mathbb{N}}\xspace$, it holds that
\begin{equation}\label[Inequality]{eq:one-sided:pq:proof:contra-assump}
\bigg|\Pr[\mathcal{D}_\lambda\big(\ensuremath{\mathsf{OUT}}\xspace^0, \mathsf{val}_{b^0}(\tilde{\tau}^0); \sigma_\lambda\big)=1] - \Pr[\mathcal{D}_\lambda\big(\ensuremath{\mathsf{OUT}}\xspace^1, \mathsf{val}_{b^1}(\tilde{\tau}^1); \sigma_\lambda\big)=1] \bigg|\ge 3 \cdot \delta(\lambda),
\end{equation}
where the first probability is taken over the random procedure $(\ensuremath{\mathsf{OUT}}\xspace^0, \tilde{\tau}^0, b^0) \gets H^{\mathcal{M}_\lambda}(m_0,\rho_\lambda)$,
and the second probability is taken over the random procedure $(\ensuremath{\mathsf{OUT}}\xspace^1, \tilde{\tau}^1, b^1) \gets H^{\mathcal{M}_\lambda}(m_1,\rho_\lambda)$ (and the randomness due to the measurement performed by $\mathcal{D}_\lambda$ if any for both probabilities).

Then, we show the following \Cref{lem:one-sided:pq:proof:core}, which should be understood as the quantum counterpart of \Cref{lem:one-sided:proof:core}. 
\begin{lemma}\label{lem:one-sided:pq:proof:core}
For the above $\delta(\lambda)$,
there exits a hybrid $G$ such that for any QPT $\mathcal{M}=\Set{\mathcal{M}_\lambda, \rho_\lambda}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}$, the following holds
\begin{enumerate}
\item\label[Property]{item:lem:one-sided:pq:proof:core:1}
$\big\{(\ensuremath{\mathsf{OUT}}\xspace^0, \msf{Val}^0):(\ensuremath{\mathsf{OUT}}\xspace^0, \msf{Val}^0) \gets G^{\mathcal{M}_\lambda}(\lambda,m_0,\rho_\lambda) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{(\ensuremath{\mathsf{OUT}}\xspace^1, \msf{Val}^1):(\ensuremath{\mathsf{OUT}}\xspace^1, \msf{Val}^1) \gets G^{\mathcal{M}_\lambda}(\lambda,m_1,\rho_\lambda) \big\}$,
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $(m_0, m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.
\item\label[Property]{item:lem:one-sided:pq:proof:core:2}
\begingroup\fontsize{9.5pt}{0}\selectfont
$\big\{(\ensuremath{\mathsf{OUT}}\xspace^{G}, \msf{Val}^{G}):(\ensuremath{\mathsf{OUT}}\xspace^{G}, \msf{Val}^{G}) \gets G^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda) \big\}
\ensuremath{\stackrel{\text{s}}{\approx}}\xspace_{\delta(\lambda)} 
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace^{H}, \mathsf{val}_{b^{H}}(\tilde{\tau}^{H})\big): (\ensuremath{\mathsf{OUT}}\xspace^{H}, \tilde{\tau}^{H}, b^{H}) \gets H^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda) \big\}$,
\endgroup  
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.
\end{enumerate}
\end{lemma}

It is easy to see that if \Cref{lem:one-sided:pq:proof:core} is true, it contradicts our assumption in \Cref{eq:one-sided:pq:proof:contra-assump}. Therefore, it will finish the proof of non-malleability. Indeed, this lemma is the most technically involved part. We prove it in \Cref{sec:one-sided:pq:core-lemma:proof}.


\subsection{Proof of \Cref{lem:one-sided:pq:proof:core}}
\label{sec:one-sided:pq:core-lemma:proof}

In \Cref{hybrid:H:reinterpretation:pq}, we provide a new but equivalent interpretation of the game $H^{\mathcal{M}}(\lambda, m, \rho_\lambda)$.
\begin{AlgorithmBox}[label={hybrid:H:reinterpretation:pq}]{Re-interpretation of Game \textnormal{$H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$}}
Game $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ can be split into the following stages:
\begin{enumerate}
\item \label[Stage]{hybrid:H:reinterpretation:1:pq}
{\bf Prefix Generation:}
First, execute \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} of the man-in-the-middle game of \Cref{prot:one-sided:classical}---it plays as the honest committer in the left committing to $m$ and the honest receiver in the right session, with $\mathcal{M}_\lambda(\rho_\lambda)$ being the man-in-the-middle adversary.

\subpara{Notation:} Let $\mathsf{st}_{\mathcal{M}}$ denote the state of $\mathcal{M}$ at the end of \Cref{item:one-sided:pq:step:committing}; let $\mathsf{st}_C$  (resp.\ $\mathsf{st}_R$) denote the state of the honest committer (resp.\ receiver) at the end of \Cref{item:one-sided:pq:step:committing}; let $\tilde{\tau}$ denote the tuple $(\tilde{\gamma}, \tilde{\mathsf{com}})$\footnote{Recall that $\tilde{\gamma}$ and  $\tilde{\mathsf{com}}$ are the \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} messages in the right session; they constitutes an execution of Naor's commitment.}. In terms of notation, we denote the execution of this stage by 
\begin{equation}\label[Expression]{expression:hybrid:H:prefix:pq}
(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})\gets H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda).
\end{equation}
We will call the tuple $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$ the {\em prefix} and denote it by $\mathsf{pref}$. It is worth noting that this $\mathsf{pref}$ contains all the information such that a QPT machine can ``complete'' the remaining execution of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ starting from $\mathsf{pref}$.

\item \label[Stage]{stage:hybrid:H:remainder:pq}
{\bf The Remainder:}
Next, it simply resumes from where the {\bf Prefix Generation} stage stops, to finish the remaining steps of the man-in-the-middle execution $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$.

\subpara{Notation:} We introduce the following notations to describe this stage. Define a QPT machine $\ensuremath{\mathcal{A}}\xspace$ that takes as input $(\mathsf{st}_{\mathcal{M}}, \tilde{\tau})$; Machine $\mathcal{A}$ is supposed to run the residual strategy of $\mathcal{M}_\lambda$ starting from $\mathsf{st}_{\mathcal{M}}$. Also, define a QPT machine $\mathcal{B}$ that takes as input $(\mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$; Machine $\mathcal{B}$ is supposed to run the residual strategies of the honest committer $C$ and receiver $R$, starting from 
$\mathsf{st}_C$ and $\mathsf{st}_R$ respectively\footnote{Note that it is not necessary to give $\tilde{\tau}$ as common input to these parties; indeed, it can be included in their respective internal states. We choose to make $\tilde{\tau}$ explicit only to match the syntax of \Cref{lem:extract_and_simulate}.}. With the above notations, we can denote the execution of the remaining steps of $H^{\mathcal{M}_\lambda}(\lambda, m,z)$ by
\begin{equation}\label[Expression]{expression:hybrid:H:remainder:pq}
(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b)\gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau}),
\end{equation}
where $\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}$ is the output of $\mathcal{A}$, and $b \in \Set{\bot, \top}$ is the output of the honest receiver $R$ (in the right), indicating if the man-in-the-middle's commitment (i.e., the right session) is accepted ($b = \top$) or not ($b = \bot$). (We remark that $\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace$ is nothing but the man-in-the-middle $\mathcal{M}$'s final output.)

\item
{\bf Output:} It outputs the tuple $(\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace, \tilde{\tau}, b)$.  
\end{enumerate}
\end{AlgorithmBox}

We prove the following lemma. which is the counterpart of \Cref{lem:small-tag:proof:se}. 
\begin{lemma}\label{lem:small-tag:proof:se:pq}
Let $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, $\mathcal{A}$, $\mathcal{B}$ be as defined in \Cref{hybrid:H:reinterpretation:pq}.
There exists a QPT machine $\mathcal{SE}$ (the simulation-extractor) such that for any $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$ in the support of $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, any noticeable $\epsilon(\lambda)$, it holds that
\begin{align*}
& \big\{ (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) : (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{s}}{\approx}}\xspace_{\epsilon(\lambda)} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, \mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} 
\end{align*} 
\end{lemma}
\Cref{lem:small-tag:proof:se:pq} is the main technical lemma for the current proof of \Cref{lem:one-sided:pq:proof:core}. We present its proof in \Cref{lem:small-tag:proof:se:proof:pq}. In the following, we finish the proof of \Cref{lem:one-sided:pq:proof:core}  assuming that \Cref{lem:small-tag:proof:se:pq} is true.


Now, we are ready to present the description of $G$.
\begin{AlgorithmBox}[label={hybrid:G:pq}]{Hybrid \textnormal{${G}^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$}}
This hybrid proceeds as follows:
\begin{enumerate}
\item
{\bf Prefix Generation:}
This stage is identical to \Cref{hybrid:H:reinterpretation:1:pq} of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$. Formally, it executes 
$$(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau}) \gets H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda),$$
where $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$ is defined in \Cref{hybrid:H:reinterpretation:1:pq} of \Cref{hybrid:H:reinterpretation:pq}.
\item
{\bf The Remainder:}
Define $\mathcal{A}$ in the same way as in \Cref{stage:hybrid:H:remainder:pq} of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$. With this $\mathcal{A}$  and the prefix $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$ from the previous stage, ${G}^{\mathcal{M}}(\lambda, m, \rho_\lambda)$ invokes the $\mathcal{SE}$ prescribed in \Cref{lem:small-tag:proof:se}. Formally, it does the following:
$$(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\delta^{-1}},\tilde{\tau}),$$
where the $\delta$ is the statistical distance that we want to show for \Cref{item:lem:one-sided:pq:proof:core:2} of \Cref{lem:one-sided:pq:proof:core}.

\item
{\bf Output:}
It outputs $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}})$.\footnote{Note that $b_{\mathcal{SE}}$ is not included in the output of $G$. Indeed, $b_{\mathcal{SE}}$ is not important for the current machine $G^{\mathcal{M}}(\lambda, m, \rho_\lambda)$. We choose to include it in the output of $\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\delta^{-1}},\tilde{\tau})$ only for notational convenience when we define/prove properties about $\mathcal{SE}$ itself.}
\end{enumerate}
\end{AlgorithmBox}

\para{Proving \Cref{item:lem:one-sided:pq:proof:core:1} of \Cref{lem:one-sided:pq:proof:core}.} Observe that hybrid $G^{\mathcal{M}}(\lambda, m, \rho_\lambda)$ is an efficient machine, since both $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$ and $\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\delta^{-1}},\tilde{\tau})$ are efficient. Moreover, it does not rewind \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} of the man-in-the-middle execution. Therefore, \Cref{item:lem:one-sided:pq:proof:core:1} of \Cref{lem:one-sided:proof:core} follows immediately from the computationally-hiding property of the left Naor's commitment (i.e., \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} in the left session).

\para{Proving \Cref{item:lem:one-sided:pq:proof:core:2} of \Cref{lem:one-sided:pq:proof:core}.}  First, observe that the distribution of the prefix is identical in $G^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ and $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$.
For each fixed prefix, \Cref{lem:small-tag:proof:se:pq} implies that the trace distance between the outputs of $G^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ and $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ are at most $\delta(\lambda)$ where we remark that we run $\mathcal{SE}$ with the second input $1^{\delta^{-1}}$ in $G^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$. 
This immediately implies \Cref{item:lem:one-sided:pq:proof:core:2} of \Cref{lem:one-sided:pq:proof:core}. 

\subsection{Proof of \Cref{lem:small-tag:proof:se:pq}}
\label{lem:small-tag:proof:se:proof:pq}
First, we show a technical lemma that gives an extractor $\mathcal{K}$ without the simulation property, which is the counterpart of  \Cref{lem:small-tag:proof:se:proof:K:pq}. 

\begin{lemma}\label{lem:small-tag:proof:se:proof:K:pq}
Let $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, $\mathcal{A}$, $\mathcal{B}$ be as defined in \Cref{hybrid:H:reinterpretation:pq}. There exists a QPT machine $\mathcal{K}$ such that for any $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$ in the support of $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$ and any noticeable $\epsilon(\lambda)$, the following holds:
\begin{enumerate}
\item \label[Property]{property:small-tag:proof:se:proof:K:syntax:pq}
{\bf (Syntax.)} $\mathcal{K}$ takes as input $(1^\lambda, \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$ and makes oracle access to $\ensuremath{\mathcal{A}}\xspace(\mathsf{st}_{\mathcal{M}})$. It output a value $\mathsf{Val}_{\mathcal{K}} \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \cup \Set{\bot}$ such that $\mathsf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val}_{\mathcal{K}} \ne \bot$.

\item \label[Property]{property:small-tag:proof:se:proof:K:pq}
If $\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b)\gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})] \ge \epsilon(\lambda)$, then it holds that
$$\Pr[\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau}) : \msf{Val}_{\mathcal{K}} \gets \mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}}, \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})] \ge \frac{\epsilon'(\lambda)}{\tilde{t}},$$
where  $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{10t^2}$.
\end{enumerate}
\end{lemma}
\begin{remark}
Unlike in the classical counterpart (\Cref{lem:small-tag:proof:se:proof:K:pq}), $\mathcal{K}$ in \Cref{lem:small-tag:proof:se:proof:K:pq} takes $1^{\epsilon^{-1}}$ as an additional input. This is needed because we only require witness-extended $\epsilon$-close emulation property (as per \Cref{def:PQWIAoK}) for $\ensuremath{\mathsf{WIAoK}}\xspace$, which causes an (arbitrarily small) noticeable simulation error. 
Note that this is enough for applying the extract-and-simulate lemma (\Cref{lem:extract_and_simulate}). 
As a positive effect of the above difference, $\mathcal{K}$ in \Cref{lem:small-tag:proof:se:proof:K:pq} runs in \emph{strict} QPT whereas it runs in \emph{expected} PPT in  \Cref{lem:small-tag:proof:se:proof:K:pq}. 
\end{remark}

We prove \Cref{lem:small-tag:proof:se:proof:K:pq} in \Cref{sec:lem:small-tag:proof:se:proof:K:proof:pq}.
\takashi{I believe we can defer the proof of \Cref{lem:small-tag:proof:se:proof:K:pq} to Appendix in the final version. That is really the same as the classical case.} \xiao{Sure! You can leave all the figure-making task to me.}
In the rest of this subsection, we finish the proof of \Cref{lem:small-tag:proof:se:pq} assuming \Cref{lem:small-tag:proof:se:proof:K:pq} is true.
\begin{proof}[Proof of \Cref{lem:small-tag:proof:se:pq}]
We apply \Cref{lem:extract_and_simulate} where we think of $\langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle$ of \Cref{lem:small-tag:proof:se:proof:K:pq} as $\mathcal{A}$ in \Cref{lem:extract_and_simulate}. Then, the two properties of \Cref{lem:small-tag:proof:se:proof:K:pq} directly imply the two requirements of \Cref{lem:extract_and_simulate} where we think of $\mathsf{val}(\tilde{\tau})$ as $s^*$ in \Cref{lem:extract_and_simulate} 
noting that $\frac{\epsilon'(\lambda)}{\tilde{t}}$ is noticeable when $\epsilon(\lambda)$ is noticeable. Thus, \Cref{lem:extract_and_simulate} gives $\mathcal{SE}$ that satisfies the requirements of \Cref{lem:small-tag:proof:se:pq}.
\end{proof}

\subsection{Extractor $\mathcal{K}$ (Proof of \Cref{lem:small-tag:proof:se:proof:K:pq})}
\label{sec:lem:small-tag:proof:se:proof:K:proof:pq}

In this section, we prove \Cref{lem:small-tag:proof:se:proof:K:pq}. 
The proof is very similar to the proof of \Cref{lem:small-tag:proof:se:proof:K} in \Cref{sec:lem:small-tag:proof:se:proof:K:proof:pq} and the following proof is taken verbatim from there except for some adaptations. 
The only difference is that we need to carefully set a sufficiently small simulation error parameter for the extractor of $\ensuremath{\mathsf{WIAoK}}\xspace$. (Recall that we relied on an extractor for $\ensuremath{\mathsf{WIAoK}}\xspace$ with a negligible error in the classical counterpart.)
The main differences from the classical counterpart are highlighted by {\color{red} red color}.


We will construct the extractor $\mathcal{K}$ prescribed in \Cref{lem:small-tag:proof:se:proof:K:pq}, and show that it satisfies the required properties. 
We will build the extractor $\mathcal{K}$
gradually, starting by defining several intermediate machines.
The description of $\mathcal{K}$ will appear toward the end of this subsection (on \Cpageref{extractorK:description:pq}). We found this arrangement most reader-friendly. We illustrate all the intermediate machines in \Cref{figure:one-sided:pq:games}.
\takashi{@Xiao can you make a new figure where WIAoK is replaced with WIAoK and $H^{\mathcal{M}}(\lambda,m,z)$ is replaced with $H^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda)$? I believe no other change is needed.}
{\color{red}
\begin{remark}\label{rem:hardwire_epsilon}
In the following descriptions, 
we fix the noticeable function $\epsilon(\lambda)$ in \Cref{lem:small-tag:proof:se:proof:K:pq} and describe these machines as if $\epsilon$ is hardwired into them. However, it is easy to see that we can construct similar machines that work similarly when $1^{\epsilon^{-1}}$ is given as an additional input instead of being hardwired. 
\takashi{Here is a subtlety about the dependence on the parameter $\epsilon$. Does the above explanation make sense?}
\end{remark}
}




\para{Machine $\mathcal{G}_{i}$ ($i \in [\tilde{t}]$):\label{machine:Gi:pq}} (Illustrated in \Cref{figure:one-sided:pq:Gi}.) 
Recall that we re-interpreted the man-in-the-middle execution $H^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda)$ defined on \Cpageref{gameH:description:pq} (and depicted in \Cref{figure:one-sided:pq:H}) as \Cref{hybrid:H:reinterpretation:pq}. We now define $\mathcal{G}_1(\mathsf{pref})$ as the machine corresponding to \Cref{stage:hybrid:H:remainder} of \Cref{hybrid:H:reinterpretation:pq}.  That is, on input the prefix $\mathsf{pref}$ (defined in \Cref{hybrid:H:reinterpretation:1:pq} of \Cref{hybrid:H:reinterpretation:pq}), $\mathcal{G}_1(\mathsf{pref})$ behaves identically as the $\langle\mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})$ defined in \Cref{expression:hybrid:H:remainder:pq}. In particular, $\mathcal{G}_1(\mathsf{pref})$ uses the witness $(1, \tilde{x}_1)$ to go through the right {\bf WIAoK-1}. (The subscript ``1'' is meant to indicate the fact that $(1,\tilde{x}_1)$ was used).

Then, for any $i \in [\tilde{t}]\setminus \Set{1}$, we define $\mathcal{G}_{i}(\mathsf{pref})$ as the machine that behaves identically to $\mathcal{G}_1(\mathsf{pref})$, except that $\mathcal{G}_i(\mathsf{pref})$ uses the witness $\tilde{x}_{i}$ in the right {\bf WIAoK-1}.

For a prefix $\mathsf{pref} = (\mathsf{st}_{\mathcal{M}}, \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$, let us define a notation that describes the probability that $\mathsf{pref}$ leads to an accepting execution:
\begin{definition}\label{def:p-tau:2:pq}
For any $\mathsf{pref} = (\mathsf{st}_{\mathcal{M}}, \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda,m,z)$, we define
\begin{equation}\label{eq:def:p-tau:pq}
p_{\mathsf{pref}} \coloneqq \Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{pref})].
\end{equation}
\end{definition}
\begin{remark}\label{rmk:redefine:p-pref:pq}
It is worth noting that the above $p_{\mathsf{pref}}$ is exactly the following probability that appeared in \Cref{property:small-tag:proof:se:proof:K:pq} of \Cref{lem:small-tag:proof:se:proof:K:pq}: $p_{\mathsf{pref}} = \Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b)\gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})]$.
\end{remark}

We first claim that the accepting probabilities for $\mathcal{G}_i(\mathsf{pref})$'s with different $i \in [\tilde{t}]$  are almost the same.
\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=1]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:pq:H}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=2]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:pq:Gi}
     \end{subfigure}
     \vskip\baselineskip
      \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=3]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:pq:G'i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=4]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:pq:G''i}
     \end{subfigure}
     \vskip\baselineskip
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=5]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:pq:Ki}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=6]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:pq:K}
     \end{subfigure}
     \caption{Different Hybrids/Machines \scriptsize{(Changes between adjacent machines are highlighted by red color)}}
     \label{figure:one-sided:pq:games}
\end{figure}

\begin{MyClaim}\label{claim:bound:Gi:pq}  
$\forall i \in [\tilde{t}], ~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_i(\mathsf{pref})] \ge p_{\mathsf{pref}} - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
Note that the machine $\mathcal{G}_i(\mathsf{pref})$ does not rewind the right {\bf WIAoK-1}, and for any $i \in [\tilde{t}] \setminus \Set{1}$, $\mathcal{G}_i(\mathsf{pref})$ differs from $\mathcal{G}_1(\mathsf{pref})$ only by the witness used in the right {\bf WIAoK-1}. Therefore, it follows from the WI property of the right {\bf WIAoK-1} that for any $i \in [\tilde{t}]$,
$$\big| \Pr[b_i = \top : (\ensuremath{\mathsf{OUT}}\xspace_i, b_i) \gets \mathcal{G}_i(\mathsf{pref})] - \Pr[b_1 = \top : (\ensuremath{\mathsf{OUT}}\xspace_1, b_1) \gets \mathcal{G}_1(\mathsf{pref})]\big| \le \mathsf{negl}(\lambda).$$
Then, by the definition of $p_{\mathsf{pref}}$ (as per \Cref{eq:def:p-tau:pq}), \Cref{claim:bound:Gi:pq} follows.
\end{proof}

\para{Machine $\mathcal{G}'_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:pq:G'i}.) On input $\mathsf{pref}$, $\mathcal{G}'_i(\mathsf{pref})$ behaves identically to $\mathcal{G}_i(\mathsf{pref})$, except the following change. Instead of executing the left {\bf WIAoK-1} (i.e., \Cref{item:one-sided:pq:step:WIAoK:1} in the left) honestly, $\mathcal{G}'_i$ invokes the emulation-extractor $\ensuremath{\mathcal{SE}}\xspace$ {\color{red} with the simulation error parameter $\epsilon_\mathsf{wiaok}(\lambda):= \frac{t+1}{t^2+5t+2}\cdot \epsilon'(\lambda)=\frac{t+1}{10t^2(t^2+5t+2)}\cdot \epsilon(\lambda)$} to emulate the left {\bf WIAoK-1} while extracting some $w'$, which is the third output of $\mathcal{SE}$ (see \Cref{item:PQWEE} of \Cref{def:PQWIAoK}).\footnote{Do not confuse it with $\mathcal{SE}$ in \Cref{lem:small-tag:proof:se:pq}. $\mathcal{SE}$ always means that in \Cref{item:PQWEE} of \Cref{def:PQWIAoK} throughout this and the next subsection.} Depending on the value of $w'$, there are two possibilities:
\begin{enumerate}
\item
{\bf Case $w' \in \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace^t_f}(Y)$:} This is the case that $w'$ is a valid witness for the statement proven by the left {\bf WIAoK-1}. That is, $w'$ equals to some $(j,x_j) \in \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace^t_f}(Y)$ (see \Cref{eq:one-sided:pq:Lang:OWF}). In this case, $\mathcal{G}'_i(\mathsf{pref})$ continues to finish the execution identically as $\mathcal{G}_i(\mathsf{pref})$.
\item
{\bf Case $w' \notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace^t_f}(Y)$:} In this case, $\mathcal{G}'_i(\mathsf{pref})$ aborts immediately, outputting $(\ensuremath{\mathsf{OUT}}\xspace, b) \coloneqq (\bot, \bot)$.
\end{enumerate}
It is worth noting that although $\ensuremath{\mathcal{SE}}\xspace$ may extract a valid $(j, x_j)$ pair, $\mathcal{G}'_i(\mathsf{pref})$ does {\em not} use it yet.  

\begin{MyClaim}\label{claim:bound:G'i:pq}
$\forall i \in [\tilde{t}], ~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_i(\mathsf{pref})] \ge p_{\mathsf{pref}}{\color{red}-\epsilon_\mathsf{wiaok}(\lambda)}  - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows immediately from \Cref{claim:bound:Gi:pq} and the witness-extended $\epsilon_\mathsf{wiaok}$-close emulation property (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}) of the left {\bf WIAoK-1}.
\end{proof}


\para{Machine $\mathcal{G}''_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:pq:G''i}.) On input $\mathsf{pref}$, $\mathcal{G}''_i(\mathsf{pref})$ behaves identically to $\mathcal{G}'_i(\mathsf{pref})$, except that $\mathcal{G}''_i(\mathsf{pref})$ uses the $w'=(j, x_j)$ (extracted in $\mathcal{G}'_i(\mathsf{pref})$, if it is a valid witness) to finish the left {\bf WIAoK-2} (i.e., \Cref{item:one-sided:pq:step:WIAoK:2} in the left execution).
\begin{MyClaim}\label{claim:bound:G''i:pq}  
$\forall i \in [\tilde{t}], ~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}''_i(\mathsf{pref})] \ge p_{\mathsf{pref}}{\color{red}-\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows immediately from \Cref{claim:bound:G'i:pq} and the WI property of the left {\bf WIAoK-2}.
\end{proof}


\para{Machine $\mathcal{K}_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:pq:Ki}.) On input a prefix $\mathsf{pref}$, $\mathcal{K}_i(\mathsf{pref})$ behaves identically to $\mathcal{G}''_i(\mathsf{pref})$, except for the following difference. Machine $\mathcal{K}_i(\mathsf{pref})$ uses the witness-extended emulator $\ensuremath{\mathcal{SE}}\xspace$ {\color{red} with the simulation error parameter $\epsilon_\mathsf{wiaok}(\lambda)$} to finish the right {\bf WIAoK-2}, instead of playing the role of the honest receiver. 

\subpara{$\mathcal{K}_i$'s Output:\label{subpara:K-i:output:pq}} Let $w'$ denote the third output of $\ensuremath{\mathcal{SE}}\xspace$ (see \Cref{item:PQWEE} of \Cref{def:PQWIAoK}), which is supposed to be the witness used by $\mathcal{M}$ in the right {\bf WIAoK-2} (for the statement $(\tilde{\mathsf{com}}, \tilde{Y}$) w.r.t.\ the language $\ensuremath{\mathcal{L}}\xspace_{\tilde{\gamma}}\vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$). Depending on the value of $w'$, we define a value $\mathsf{Val} \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \cup \Set{\bot_{\tilde{Y}}, \bot_{\mathsf{invalid}}}$ as follows:
\begin{enumerate}
\item \label[Case]{K-i:output:case:1:pq}
If $w'$ is a valid witness for $(\tilde{\mathsf{com}}, \tilde{Y}) \in \ensuremath{\mathcal{L}}\xspace_{\tilde{\gamma}}\vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$. Then, there are tow sub-cases:
\begin{enumerate}
\item \label[Case]{K-i:output:case:1a:pq}
$w'$ is a valid witness for $\tilde{\mathsf{com}} \in \ensuremath{\mathcal{L}}\xspace_{\tilde{\gamma}}$. In this case, $w'$ consists of the value $\mathsf{val}(\tilde{\tau})$, i.e., the value committed in $\tilde{\tau}=(\tilde{\gamma}, \tilde{\mathsf{com}})$, and the randomness $\tilde{r}$. We set $\mathsf{Val} \coloneqq \mathsf{val}(\tilde{\tau})$. Importantly, notice that we do {\em not} include the randomness $\tilde{r}$ in $\mathsf{Val}$.
\item \label[Case]{K-i:output:case:1b:pq}
$w'$ is a valid witness for $\tilde{Y} \in \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$: In this case, we set $\mathsf{Val} \coloneqq \bot_{\tilde{Y}}$.
\end{enumerate}

\item \label[Case]{K-i:output:case:2:pq}
Otherwise, set $\mathsf{Val} \coloneqq \bot_{\mathsf{invalid}}$.
\end{enumerate}


The output of $\mathcal{K}_i$ is defined to be $\mathsf{Val}$. Note that this is in contrast to all previous machines, for which the output is defined to be the main-in-the-middle's output and the honest receiver's decision bit. We emphasize that such a $\mathsf{Val}$ satisfies the syntax requirement in \Cref{property:small-tag:proof:se:proof:K:syntax} of \Cref{lem:small-tag:proof:se:proof:K:pq}. In particular, {\em $\mathsf{Val} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val} \ne \bot$}.\footnote{Note that here we defined two types of abortion: $\bot_{\tilde{Y}}$ and $\bot_{\mathsf{invalid}}$, while \Cref{property:small-tag:proof:se:proof:K:syntax} of \Cref{lem:small-tag:proof:se:proof:K:pq} only allows a single abortion symbol $\bot$. We remark that this is only a cosmetic difference---It can be made consistent using the following rules: $\bot = \bot_{\tilde{Y}}$ {\em and} $\bot = \bot_{\mathsf{invalid}}$ (i.e., $\mathsf{Val} \ne \bot  \Leftrightarrow (\mathsf{Val} \ne \bot_{\tilde{Y}} \wedge \mathsf{Val} \ne \bot_{\mathsf{invalid}})$).}

\begin{MyClaim}\label{claim:bound:Ki:pq}
$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val} \gets \mathcal{K}_i(\mathsf{pref})] \ge p_{\mathsf{pref}} {\color{red}-2\epsilon_\mathsf{wiaok}(\lambda)}- \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows immediately from \Cref{claim:bound:G''i:pq} and the witness-extended $\epsilon_\mathsf{wiaok}$-close emulation property (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}) of the right {\bf WIAoK-2}.
\end{proof}

Finally, we are ready to define the extractor $\mathcal{K}$. Intuitively, $\mathcal{K}$ can be conceived as an average-case version of $\Set{\mathcal{K}_i}_{i\in[\tilde{t}]}$:

\para{Extractor $\mathcal{K}$:\label{extractorK:description:pq}} (Illustrated in \Cref{figure:one-sided:pq:K}.)  On input $\mathsf{pref}$, $\mathcal{K}(\mathsf{pref})$ samples uniformly at random an index $i \ensuremath{\leftarrow}\xspace [\tilde{t}]$, executes $\mathcal{K}_i(\mathsf{pref})$, and outputs whatever $\mathcal{K}_i(\mathsf{pref})$ outputs.


\begin{remark}[On the Notation of $\mathcal{K}$]\label{rmk:notation-K:pq}
It is worth noting that in the above, we write machine $\mathcal{K}$ as $\mathcal{K}(\mathsf{pref})$, while it was written as in \Cref{lem:small-tag:proof:se:proof:K:pq} as $\mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}} \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$. This is only a cosmetic difference---
First, we remark that we consider $\epsilon$ to be hardwired into $\mathcal{K}$ for simplicity as remarked in \Cref{rem:hardwire_epsilon}. 
Then, $\mathcal{K}(\mathsf{pref})$ can be explained in the following way: first, parse $\mathsf{pref}$ as $(\mathsf{st}_{\mathcal{M}},\mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$; then, run $\mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$. 
\end{remark}


Next, we show that the extractor $\mathcal{K}$ satisfies the requirements in \Cref{lem:small-tag:proof:se:proof:K:pq}.

\para{Running Time of $\mathcal{K}$.} Observe that for each $i \in [\tilde{t}]$, $\mathcal{K}_i(\mathsf{pref})$ is the same as the real man-in-the-middle execution conditioned on the prefix $\mathsf{pref}$, except that $(i,\tilde{x}_i)$ is used in the right {\bf WIAoK-1} and the witness-extended emulator $\ensuremath{\mathcal{SE}}\xspace$ is used in the right {\bf WIAoK-2} and the left {\bf WIAoK-1}. Since $\ensuremath{\mathcal{SE}}\xspace$ runs in QPT, so does $\mathcal{K}_i(\mathsf{pref})$. Therefore, $\mathcal{K}(\mathsf{pref})$ also runs in QPT.

\para{Proving \Cref{property:small-tag:proof:se:proof:K:syntax:pq} of \Cref{lem:small-tag:proof:se:proof:K:pq}.} It is straightforward to see that the $\mathcal{K}$ defined above satisfies the syntax requirement in \Cref{lem:small-tag:proof:se:proof:K:pq} (see also \Cref{rmk:notation-K:pq}). In particular, we have $\mathsf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val}_{\mathcal{K}} \ne \bot$, because this is true for each $\mathcal{K}_i$ by definition (see the paragraph for ``\underline{$\mathcal{K}_i$'s Output}'' on \Cpageref{subpara:K-i:output:pq}).


\para{Proving \Cref{property:small-tag:proof:se:proof:K:pq} of \Cref{lem:small-tag:proof:se:proof:K:pq}.} First, recall that \Cref{property:small-tag:proof:se:proof:K:pq} requires that 
for any $\mathsf{pref}$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ , if $p_{\mathsf{pref}} \ge \epsilon(\lambda)$ (see \Cref{rmk:redefine:p-pref}), then it holds that
\begin{equation}\label[Inequality]{eq:bound:averageK:pq}
\Pr[\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau}) : \msf{Val}_{\mathcal{K}} \gets \mathcal{K}(\mathsf{pref})] \ge \frac{\epsilon'(\lambda)}{\tilde{t}}.
\end{equation} 
Also recall that $\mathcal{K}(\mathsf{pref})$ is defined to execute the machine $\mathcal{K}_i(\mathsf{pref})$  with  $i$ uniformly sampled from $[\tilde{t}]$. Therefore, \Cref{eq:bound:averageK:pq} can be reduced to the following \Cref{lem:bound:Ki:pq}. We will prove \Cref{lem:bound:Ki:pq} in \Cref{sec:lem:bound:Ki:proof}, which will eventually finish the current proof of \Cref{lem:small-tag:proof:se:proof:K:pq}.
\begin{lemma}\label{lem:bound:Ki:pq}
Let $\epsilon(\lambda) = \frac{1}{\mathsf{poly}(\lambda)}$ and $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{t^2}$.
For any $\mathsf{pref} = (\mathsf{st}_{\mathcal{M}},\mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$, if $p_\mathsf{pref} \ge \epsilon(\lambda)$, then there exists an $i \in [\tilde{t}]$ such that 
$$\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau}) :\msf{Val} \gets \mathcal{K}_i(\mathsf{pref})] \ge \epsilon'(\lambda).$$
\end{lemma}

\subsection{Proof of \Cref{lem:bound:Ki:pq}}
\label{sec:lem:bound:Ki:proof:pq}
The proof of \Cref{lem:bound:Ki:pq} is almost identical to the proof of \Cref{lem:bound:Ki:pq} in \Cref{sec:lem:bound:Ki:proof:pq}. 
The main differences from the classical counterpart are highlighted by {\color{red} red color}.

\para{Notation.} We highly recommend reviewing the ``\underline{$\mathcal{K}_i$'s Output}'' part on \Cpageref{subpara:K-i:output:pq} (in particular, the meanings of $\mathsf{Val}$, $\bot_{\tilde{Y}}$, and $\bot_{\mathsf{invalid}}$) before starting reading this subsection.  Recall that $\mathcal{K}_i$'s output $\mathsf{Val}$ is determined by the $w'$ output by the right {\bf WIAoK-2} simulation-extractor $\mathcal{SE}$. In this subsection, we will need to refer to this $w'$, although it is not included as a part of $\mathcal{K}_i$'s output. Particularly, we will make use of the following notation: whenever we write an expression of the form 
 $$\Pr[\text{Some Event $E_{w'}$ about $w'$}: \mathsf{Val} \gets \mathcal{K}_i(\mathsf{pref})],$$
it should be understood as the provability of $E_{w'}$, where $w'$ refers to the $w'$ generated during the random procedure $\mathsf{Val} \gets\mathcal{K}_i(\mathsf{pref})$, over which the probability is taken. 

Using these notations, we can partition the event $\mathsf{Val} = \bot_{\tilde{Y}}$ as the following {\em mutually exclusive} events: $w' = (1, \tilde{x}_1)$, or, $\ldots$, or $w' =(\tilde{t}, \tilde{x}_{\tilde{t}})$, where $\tilde{y}_i = \tilde{f}(\tilde{x}_i)$ for each $i \in [\tilde{t}]$.   Formally, we express this relation by 
\begin{equation}\label{eq:bot-tilde-Y:partition:pq}
\Pr[\mathsf{Val} = \bot_{\tilde{Y}}: \mathsf{Val} \gets \mathcal{K}_i(\mathsf{pref})] = \sum_{i = 1}^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i): \mathsf{Val} \gets \mathcal{K}_i(\mathsf{pref})]
\end{equation}

With the above notations, we start proving \Cref{lem:bound:Ki:pq} in the following.

\para{The Actual Proof for \Cref{lem:bound:Ki:pq}.} We assume for contradiction that for some $\mathsf{pref}$ satisfying $p_{\mathsf{pref}} \ge \epsilon(\lambda)$, it holds that 
\begin{equation}\label[Inequality]{eq:proof:averageK:contra-assump:pq}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau}) :\msf{Val} \gets \mathcal{K}_i(\mathsf{pref})] < \epsilon'(\lambda).
\end{equation}
\begin{MyClaim}\label{claim:bound:Ki-xi:pq}
Under the assumption in \Cref{eq:proof:averageK:contra-assump:pq}, it holds that 
$$\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i) :\msf{Val} \gets \mathcal{K}_i(\mathsf{pref})] \ge p_{\mathsf{pref}}  {\color{red}-2\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof}

 First, notice that
\begin{align*}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot_{\mathsf{invlid}}] 
& = 
\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] +  \Pr[\msf{Val} = \bot_{\tilde{Y}}] \\
\text{(by \Cref{eq:bot-tilde-Y:partition:pq})} ~& = 
\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] + \Pr[w' = (i, \tilde{x}_i)] + \sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j, \tilde{x}_j)], \numberthis \label{eq:bound:Ki-xi:1:pq}
\end{align*}
where all the probabilities are taken over the random procedure $\msf{Val} \gets \mathcal{K}_i(\mathsf{pref})$.

Then, the following holds
(all the probabilities below are taken w.r.t.\ $\msf{Val} \gets \mathcal{K}_i(\mathsf{pref})$):
\begingroup\fontsize{9.5pt}{0pt}\selectfont
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i)] 
& = 
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}] - \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j, \tilde{x}_j)] \bigg)  \label{eq:bound:Ki-xi:derive:1:pq} \\
& \ge p_{\mathsf{pref}} {\color{red}-2\epsilon_\mathsf{wiaok}(\lambda)}- \mathsf{negl}(\lambda) - \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j,\tilde{x}_j)] \bigg)  \label[Inequality]{eq:bound:Ki-xi:derive:2:pq}\\
& \ge p_{\mathsf{pref}} {\color{red} -2\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) - \epsilon'(\lambda) -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j,\tilde{x}_j)] \bigg), \label[Inequality]{eq:bound:Ki-xi:derive:3:pq}
\end{align}
\endgroup
where \Cref{eq:bound:Ki-xi:derive:1:pq} follows from \Cref{eq:bound:Ki-xi:1:pq}, \Cref{eq:bound:Ki-xi:derive:2:pq} follows from \Cref{claim:bound:Ki:pq}, and \Cref{eq:bound:Ki-xi:derive:3:pq} follows from \Cref{eq:proof:averageK:contra-assump:pq}.

Now, to prove \Cref{claim:bound:Ki-xi:pq}, it suffices to show that 


\begin{equation}
\forall i \in [\tilde{t}],~\forall j \in [\tilde{t}]\setminus \Set{i}, ~\Pr[w' = (j,\tilde{x}_j) : \msf{Val} \gets \mathcal{K}_i(\mathsf{pref})] = \mathsf{negl}(\lambda).
\end{equation}
This can be reduced via standard techniques to the one-wayness of the OWF $\tilde{f}$ in \Cref{item:one-sided:pq:step:OWFs} of the right execution. In more details, we assume for contradiction that there exist $i^*, j^* \in [\tilde{t}]$ such that $i^* \ne j^*$ and that the probability $\Pr[w' = (j^*, \tilde{x}_{j^*}) : \msf{Val} \gets \mathcal{K}_{i^*}(\mathsf{pref})]$ is non-negligible, where, by definition, $\tilde{x}_{j^*}$ is the preimage of $\tilde{y}_{j^*}$ under the right OWF $\tilde{f}$. Then, we can build a QPT adversary $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ breaking one-wayness in the following way: $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ obtains the challenge $y^*$ from the external one-wayness challenger; it then runs the machine $\mathcal{K}_{i^*}(\mathsf{pref})$ internally, for which $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ uses $y^*$ in place of $\tilde{y}_{j^*}$ when executing \Cref{item:one-sided:pq:step:OWFs} in the right. Note that the internal execution of $\mathcal{K}_{i^*}(\mathsf{pref})$ is identically to the real execution of $\mathcal{K}_{i^*}$, thus the extracted $w' =(j^*, \tilde{x}_{j^*})$ must satisfy $\tilde{f}(\tilde{x}_{j^*}) = \tilde{y}_j^*~(=y^*)$ with non-negligible probability, breaking one-wayness. 

This finishes the proof of \Cref{claim:bound:Ki-xi:pq}.
\end{proof}

\takashi{@Xiao Can I ask you to replace WIPoK with WIAoK in \Cref{figure:one-sided:K'i-K''i:pq}
?} \xiao{Yes, I'll do that. Actually, I'll considering replacing WIPoK by WIAoK throughout the whole paper.}

\para{Machine $\mathcal{K}'_i$ ($i \in [\tilde{t}]$):\label{machineK':description:pq}} (Illustrated in \Cref{figure:one-sided:K'i:pq}.) On input a prefix $\mathsf{pref}$, $\mathcal{K}'_i(\mathsf{pref})$ proceeds as follows:
\begin{enumerate}
\item
$\mathcal{K}'_i(\mathsf{pref})$ first finishes \Cref{item:one-sided:pq:step:OWFs} of the man-in-the-middle execution in the same way as $\mathcal{K}_i(\mathsf{pref})$. In particular, it will see in the left execution the values $Y = (y_1, \ldots, y_t)$ sent from $\mathcal{M}$; 
\item
$\mathcal{K}'_i(\mathsf{pref})$ recovers $(x_1, \ldots, x_t)$ by brute-force: Namely, for each $i \in [t]$, it inverts the OWF $f$ to find $x_i$ s.t.\ $f(x_i) = y_i$. It is possible that there exist some ``bad'' $y_i$'s that are not in the range of $f$. For such bad $i$'s, it sets $x_i = \bot$. If all the $x_i$'s are bad, $\mathcal{K}'_i(\mathsf{pref})$ halts and outputs $\mathsf{Fail}$;
\item \label[Step]{item:machineK':3:pq}
If this step is reached, we know that $(x_1, \ldots, x_t)$ cannot be all $\bot$. $\mathcal{K}'_i(\mathsf{pref})$ then picks an $(s, x_s)$ uniformly at random from the good (i.e.\ non-$\bot$) $x_i$'s.
\item
$\mathcal{K}'_i(\mathsf{pref})$ continues to finish the execution in the same way as $\mathcal{K}_i(\mathsf{pref})$, except that it uses $(s, x_s)$ as the witness when executing the left {\bf WIAoK-2}. 
\end{enumerate}
It is worth noting that the $(j, x_j)$ extracted by the witness-extended emulator for the left {\bf WIAoK-1} (inherited from $\mathcal{K}_i(\mathsf{pref})$) is not used any more by $\mathcal{K}'_i(\mathsf{pref})$. 

It is easy to see that if the $(s, x_s)$ picked by $\mathcal{K}'_i(\mathsf{pref})$ is equal to the $(j, x_j)$ extracted in $\mathcal{K}_i(\mathsf{pref})$ from its left {\bf WIAoK-1}, then $\mathcal{K}'_i(\mathsf{pref})$ and $\mathcal{K}_i(\mathsf{pref})$ are identical (see \Cref{rmk:injectivity-of-OWF:pq}). Since $\mathcal{K}'_i(\mathsf{pref})$ samples $(s,x_s)$ uniformly from all the good $(i, x_i)$'s, then $(s, x_s) = (j,x_j)$ with probability at least $1/t$.  Therefore, the following must hold: 
\begin{equation}\label[Inequality]{eq:bound:K'i:pq}
\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i) : \msf{Val} \gets \mathcal{K}'_i(\mathsf{pref})] \ge \frac{1}{t}\cdot \Pr[w' = (i, \tilde{x}_i) : \msf{Val} \gets \mathcal{K}_i(\mathsf{pref})].
\end{equation}
\begin{remark}[On Injectivity of the OWF]\label{rmk:injectivity-of-OWF:pq}
We emphasize that throughout the proof of non-malleability, this is {\em the only} place where we rely on the injectivity of the OWF. In particular, we rely on the injectivity of the OWF $f$ in the left session to ensure that there is a unique preimage for each $\Set{{y}_i}_{i \in [t]}$. Thus, if both the $x_s$ with $s = j$ (sampled by $\mathcal{K}'_i(\mathsf{pref})$) and the extracted $x_j$ (in $\mathcal{K}_i(\mathsf{pref})$) are a valid preimage for the same $y_j$, then $x_s$ must equal $x_j$.
The requirement of injectivity can be removed similarly to the classical case, which is explained in \Cref{sec:removing-injectivity}. 
\end{remark}
\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=7]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:K'i:pq}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=8]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:K''i:pq}
     \end{subfigure}
     \caption{Machines $\mathcal{K}'_i(\mathsf{pref})$ and $\mathcal{K}''_i(\mathsf{pref})$ \scriptsize{(Changes between adjacent machines are highlighted by red color)}}
     \label{figure:one-sided:K'i-K''i:pq}
\end{figure}

\para{Machine $\mathcal{K}''_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:K''i:pq}.) On input a prefix $\mathsf{pref}$,  $\mathcal{K}''_i(\mathsf{pref})$ behaves identically to $\mathcal{K}'_i(\mathsf{pref})$ except that it plays as the honest committer in the left {\bf WIAoK-1}, instead of running the witness-extended emulator. Recall that starting from $\mathcal{K}'_i$, the witness $(j, x_j)$ extracted by the witness-extended emulator from the left {\bf WIAoK-1} is not used any more. Thus, machine $\mathcal{K}''_i$ does not need to perform this witness-extended emulation.

By the witness-extended $\epsilon_\mathsf{wiaok}$-close emulation property (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}) of the left {\bf WIAoK-1}, it is easy to see that 
\begin{equation}\label[Inequality]{eq:relation:K'-K'':pq}
\forall i \in [\tilde{t}], ~\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i(\mathsf{pref})] \ge \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}'_i(\mathsf{pref})] {\color{red}-\epsilon_\mathsf{wiaok}(\lambda)} -\mathsf{negl}(\lambda).
\end{equation}
Also, by the WI property of the right {\bf WIAoK-1}, the following must hold
\begin{equation}\label[Inequality]{eq:relation:K:WI:pq}
\forall i \in [\tilde{t}], ~\big|\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i(\mathsf{pref})] - \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1(\mathsf{pref})]\big|  \le \mathsf{negl}(\lambda).
\end{equation}
Then, we have the following claim:
\begin{MyClaim}\label{claim:bound:K''1:pq}
$\forall i \in [\tilde{t}], ~\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] \ge \frac{1}{t} \cdot \big(p_{\mathsf{pref}} {\color{red}-(t+2)\epsilon_\mathsf{wiaok}(\lambda)} -\epsilon'(\lambda)\big) - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof} 
This claim follows from \Cref{claim:bound:Ki-xi:pq} and \Cref{eq:bound:K'i:pq,eq:relation:K'-K'':pq,eq:relation:K:WI:pq}. Formally,
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] 
 & \ge \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i({\mathsf{pref}})]{\color{red}-\epsilon_\mathsf{wiaok}(\lambda)}  - \mathsf{negl}(\lambda)
\label[Inequality]{claim:bound:K''1:proof:1:pq}\\
 & \ge 
\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}'_i({\mathsf{pref}})]  {\color{red}-\epsilon_\mathsf{wiaok}(\lambda)}- \mathsf{negl}(\lambda) 
\label[Inequality]{claim:bound:K''1:proof:2:pq}\\
 & \ge 
\frac{1}{t}\cdot\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}_i({\mathsf{pref}})] {\color{red}-\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) 
\label[Inequality]{claim:bound:K''1:proof:3:pq}\\
& \ge 
\frac{1}{t} \cdot \big(p_{\mathsf{pref}} {\color{red}-2\epsilon_\mathsf{wiaok}(\lambda)} -\epsilon'(\lambda)\big) {\color{red}-\epsilon_\mathsf{wiaok}(\lambda)}- \mathsf{negl}(\lambda), \label[Inequality]{claim:bound:K''1:proof:4:pq}
\end{align}
where \Cref{claim:bound:K''1:proof:1:pq} follows from \Cref{eq:relation:K:WI:pq}, \Cref{claim:bound:K''1:proof:2:pq} follows from \Cref{eq:relation:K'-K'':pq}, \Cref{claim:bound:K''1:proof:3:pq} follows from \Cref{eq:bound:K'i:pq}, and \Cref{claim:bound:K''1:proof:4:pq} follows from \Cref{claim:bound:Ki-xi:pq}.

\end{proof}

Now, we show the last claim which, together with \Cref{claim:bound:K''1:pq}, will lead to the desired contradiction.
\begin{MyClaim}\label{claim:K'':non-abort:pq}
$\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}:\msf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] \le p_{\mathsf{pref}}{\color{red} +2\epsilon_\mathsf{wiaok}(\lambda)} + \mathsf{negl}(\lambda)$.
\end{MyClaim}
\para{Deriving the Contradiction.} Before proving \Cref{claim:K'':non-abort:pq}, we first show why \Cref{claim:bound:K''1:pq,claim:K'':non-abort:pq} are contradictory. In the following, all the probabilities are taken over $\msf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})$:
\begin{align*}
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}] 
& = \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})]  + \Pr[\msf{Val} = \bot_{\tilde{Y}}] \\
& = \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] + \sum_{i =1 }^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i)] \numberthis \label{eq:bound:Ki:final-contradiction:0:pq}\\
& \ge  \sum_{i =1 }^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i)] \\
&\ge \tilde{t} \cdot \frac{1}{t} \cdot \big(p_{\mathsf{pref}}{\color{red}-(t+2)\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:1:pq}\\
& \ge (1+\frac{1}{t}) \cdot (p_{\mathsf{pref}}{\color{red}-(t+2)\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda)) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:2:pq}\\
& = (1+\frac{1}{t}) \cdot \bigg(p_{\mathsf{pref}}{\color{red}-\frac{t^2+5t+2}{t+1}\cdot\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda)\bigg){\color{red}+ 2\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) \\
& = (1+\frac{1}{t}) \cdot \bigg(p_{\mathsf{pref}}{\color{red}- 2\epsilon'(\lambda)}\bigg){\color{red}+ 2\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) \numberthis \label{eq:bound:Ki:final-contradiction:2.5:pq}\\
& = p_{\mathsf{pref}}{\color{red}+ 2\epsilon_\mathsf{wiaok}(\lambda)} + \bigg(\frac{p_{\mathsf{pref}}}{t} {\color{red}- 2\epsilon'(\lambda) - \frac{2\epsilon'(\lambda)}{t}}\bigg) - \mathsf{negl}(\lambda)\\
& \ge p_{\mathsf{pref}}{\color{red}+ 2\epsilon_\mathsf{wiaok}(\lambda) + \frac{5t^2 - t -1}{5t^3}\cdot \epsilon(\lambda)} - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:3:pq}\\
\end{align*}
where \Cref{eq:bound:Ki:final-contradiction:0:pq} follows from \Cref{eq:bot-tilde-Y:partition:pq}, \Cref{eq:bound:Ki:final-contradiction:1:pq} follows from \Cref{claim:bound:K''1:pq}, \Cref{eq:bound:Ki:final-contradiction:2:pq} follows from the assumption that $\tilde{t} \ge t+1$, 
{\color{red} \Cref{eq:bound:Ki:final-contradiction:2.5:pq} follows from our parameter setting $\epsilon_\mathsf{wiaok}(\lambda)=\frac{t+1}{t^2+5t+2}\cdot \epsilon'(\lambda)$,} and
\Cref{eq:bound:Ki:final-contradiction:3:pq} follows from the assumption that $p_{\mathsf{pref}} \ge \epsilon(\lambda)$ and our parameter setting $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{10t^2}$.

Recall that $t$ is the tag taking values from $[2n]$ with $n$ being a polynomial of $\lambda$. Also recall that $\epsilon(\lambda)$ is an inverse polynomial on $\lambda$. Therefore, \Cref{eq:bound:Ki:final-contradiction:3:pq} can be written as:
$$\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}:\msf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] \ge p_{\mathsf{pref}} {\color{red}+ 2\epsilon_\mathsf{wiaok}(\lambda)}+ \frac{1}{\mathsf{poly}(\lambda)} - \mathsf{negl}(\lambda),$$
which contradicts \Cref{claim:K'':non-abort:pq}.

This eventually finishes the proof of \Cref{lem:bound:Ki:pq} (modulo the proof of \Cref{claim:K'':non-abort:pq} which we will show next).



\begin{proof}[Proof of {\Cref{claim:K'':non-abort:pq}}]
We first define two extra machines $\mathcal{K}^{**}_1$ and $\mathcal{K}^*_1$.

\takashi{@Xiao Can I ask you to replace WIPoK with WIAoK in \Cref{figure:one-sided:K**1-K*1:pq}
?}

\para{Machine $\mathcal{K}^{**}_1$:} (Illustrated in \Cref{figure:one-sided:K**i:pq}.) On input a prefix $\mathsf{pref}$, $\mathcal{K}^{**}_1(\mathsf{pref})$ behaves identically as $\mathcal{K}''_1(\mathsf{pref})$ except that $\mathcal{K}^{**}_1(\mathsf{pref})$ finishes the right {\bf WIAoK-2} using the honest receiver's algorithm, instead of using the witness-extended emulator. 

\subpara{$\mathcal{K}^{**}_1$'s Output.} We define the output of $\mathcal{K}^{**}_1(\mathsf{pref})$ to be the honest receiver's decision $b \in \Set{\top, \bot}$. This is in contrast to previous hybrids (i.e., $\mathcal{K}'_i(\mathsf{pref})$, $\mathcal{K}''_i(\mathsf{pref})$, and $\mathcal{K}_i(\mathsf{pref})$, whose output is defined to be the value $\mathsf{Val}$ that depends on the value $w'$ extracted by the $\mathcal{SE}$ for the right {\bf WIAoK-2}.

 By the witness-extended $\epsilon_\mathsf{wiaok}$-close emulation property (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}), it holds that
\begin{equation}\label[Inequality]{eq:K''1-K**1:pq}
\big|\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val}\gets \mathcal{K}''_1(\mathsf{pref})] - \Pr[b = \top : b\gets \mathcal{K}^{**}_1(\mathsf{pref})] \big| \le {\color{red} \epsilon_\mathsf{wiaok}(\lambda)} + \mathsf{negl}(\lambda).
\end{equation}

\para{Machine $\mathcal{K}^{*}_1$:} (Illustrated in \Cref{figure:one-sided:K*i:pq}.) On input a prefix $\mathsf{pref}$, $\mathcal{K}^{*}_1({\mathsf{pref}})$ behaves identically as $\mathcal{K}^{**}_1({\mathsf{pref}})$ except for the witness used in the left {\bf WIAoK-2}: $\mathcal{K}^{*}_1({\mathsf{pref}})$ use the $(m, r)$ used to generated $\mathsf{com} = \mathsf{Com}_\gamma(m;r)$ as the witness to finish the left {\bf WIAoK-2}. (Note that this witness pair $(m,r)$ must be contained in ${\mathsf{pref}}$---because ${\mathsf{pref}}$ is corresponding to the first two steps of the man-in-the-middle execution, and the left execution is done by the honest committer.) It is worth noting that machine $\mathcal{K}^*_1$ is actually identical to the machine $\mathcal{G}_1$ we defined on \Cpageref{machine:Gi:pq}. Therefore, it holds that
\begin{equation}\label{eq:K*1-G1:pq}
\Pr[b^* = \top: b^* \gets \mathcal{K}^{*}_1(\mathsf{pref})] = \Pr[ b_{\mathcal{G}_1}=\top:(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{G}_1}, b_{\mathcal{G}_1})\gets \mathcal{G}_1(\mathsf{pref})] = p_{\mathsf{pref}}, 
\end{equation}
where the last equivalence follows by definition (see \Cref{def:p-tau:2:pq}).

\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=9]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:K**i:pq}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=10]{figures/figures.pdf}
         }
         \caption{}
         \label{figure:one-sided:K*i:pq}
     \end{subfigure}
     \caption{Machines $\mathcal{K}^{**}_1(\mathsf{pref})$ and $\mathcal{K}^*_1(\mathsf{pref})$ \scriptsize{(Changes between adjacent machines are highlighted by red color)}}
     \label{figure:one-sided:K**1-K*1:pq}
\end{figure}

Next, let us recall the witness used by $\mathcal{K}^{**}_1$ for the left {\bf WIAoK-2}. By definition, machine $\mathcal{K}^{**}_1(\mathsf{pref})$ performs brute-force to extract $(x_1, \ldots, x_t)$,\footnote{This brute-forcing was there starting from $\mathcal{K}'_1$ (defined on \Cpageref{machineK':description:pq}), and was inherited by $\mathcal{K}''_1$, $\mathcal{K}^{**}_1$, and eventually by $\mathcal{K}^{*}_1$.} and samples a random {\em good}\footnote{Recall from \Cref{item:machineK':3:pq}
 of $\mathcal{K}'_i(\mathsf{pref})$ (\Cpageref{machineK':description:pq}) that ``good'' means that $x^*_j$ is a valid pre-image of $y_j$.} $x^*_j$ as the witness to go through the left {\bf WIAoK-2}. 

Thus, there are the following two differences between $\mathcal{K}^{*}_1$ and $\mathcal{K}^{**}_1$:
 \begin{enumerate}
\item If the left {\bf WIAoK-1} accepts and there is at least one $j$ such that $y_j$ has a preimage, they use different witnesses in the left {\bf WIAoK-2};
\item If the left {\bf WIAoK-1} accepts and there is \emph{no} $j$ such that $y_j$ has a preimage, $\mathcal{K}^{**}_1$ aborts whereas $\mathcal{K}^{*}_1$ does not.  
 \end{enumerate}
It is easy to see that the second case occurs with probability {\color{red} at most $\epsilon_\mathsf{wiaok}(\lambda)$} by the witness-extended $\epsilon_\mathsf{wiaok}$-close emulation property of the left {\bf WIAoK-1}.  
For the first case, we note that neither $\mathcal{K}^{*}_1$ nor $\mathcal{K}^{**}_1$ rewinds the {\bf WIAoK-2} because we already get rid of the witness-extended emulation starting from $\mathcal{K}^{**}_1$. 
Therefore, 
by the (non-uniform) WI property of the left {\bf WIAoK-2}, it holds that
\begin{equation}\label[Inequality]{eq:K**1-K*1:pq}
\big|\Pr[b = \top : b \gets \mathcal{K}^{**}_1({\mathsf{pref}})] - \Pr[b^* = \top : b^* \gets \mathcal{K}^{*}_1({\mathsf{pref}})] \big| \le {\color{red} \epsilon_\mathsf{wiaok}(\lambda)}+ \mathsf{negl}(\lambda).
\end{equation}
Therefore, the following holds:

\begin{align}
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val}\gets \mathcal{K}''_1({\mathsf{pref}})] & \le \Pr[b = \top : b\gets \mathcal{K}^{**}_1(\mathsf{pref})]\le {\color{red} +\epsilon_\mathsf{wiaok}(\lambda)} +  \mathsf{negl}(\lambda) \label[Inequality]{eq:K'':non-abort:final:1:pq} \\
& \le \Pr[b^* = \top : b^* \gets \mathcal{K}^{*}_1({\mathsf{pref}})] \le {\color{red} +2\epsilon_\mathsf{wiaok}(\lambda)}+ \mathsf{negl}(\lambda) \label[Inequality]{eq:K'':non-abort:final:2:pq} \\
& = p_{\mathsf{pref}} {\color{red} +2\epsilon_\mathsf{wiaok}(\lambda)}+ \mathsf{negl}(\lambda), \label{eq:K'':non-abort:final:3:pq}
\end{align}
where \Cref{eq:K'':non-abort:final:1:pq} follows from \Cref{eq:K''1-K**1:pq}, \Cref{eq:K'':non-abort:final:2:pq} follows from \Cref{eq:K**1-K*1:pq}, and \Cref{eq:K'':non-abort:final:3:pq} follows from \Cref{eq:K*1-G1:pq}. 

This finishes the proof of \Cref{claim:K'':non-abort:pq}.
\end{proof}



\if0
\red{\noindent\makebox[\linewidth]{\rule{\paperwidth-8em}{2pt}Update upto here}}

\xiao{@Takashi: Everything below this red line is not up to date. They are old stuff before I finished the new version of \Cref{sec:small-tag-one-sided-sync-classical}. So, you may find they are not consistent in terms of notation and logic flow from their classical counterpart i.e.,  \Cref{sec:small-tag-one-sided-sync-classical}. Since you anyway will redo this part, feel free to delete these old stuff.}

We now prove \Cref{lem:one-sided:pq:proof:core:} by constructing the machine $G$ prescribed in \Cref{lem:one-sided:pq:proof:core:} and proving that it satisfies the required properties. At a high-level, $G$ works similarly as the $G^{\mathcal{M}}$ presented in \Cref{hybrid:G}. \xiao{Talk about their difference. In particular, stress that we will use the extraction-simulator from \Cref{lem:extract_and_simulate}.}








In \Cref{hybrid:H:pq:reinterpretation}, we provide a new but equivalent interpretation of the game $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$.
\begin{AlgorithmBox}[label={hybrid:H:pq:reinterpretation}]{Re-interpretation of Game \textnormal{$H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$}}
Game $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$ can be split into the following stages:
\begin{enumerate}
\item \label[Stage]{hybrid:H:pq:reinterpretation:1}
{\bf Prefix Generation:}
First, execute \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} of the man-in-the-middle game of \Cref{prot:one-sided:classical}---it plays as the honest committer in the left committing to $m$ and the honest receiver in the right session, with $\mathcal{M}_\lambda(\rho_\lambda)$ being the man-in-the-middle adversary.

\subpara{Notation:} Let $\rho'_\lambda$ denote the quantum state of $\mathcal{M}_\lambda$ at the end of \Cref{item:one-sided:pq:step:committing}; let $\mathsf{st}_C$  (resp.\ $\mathsf{st}_R$) denote the state of the honest committer (resp.\ receiver) at the end of \Cref{item:one-sided:pq:step:committing}; let $\tau$ denote the tuple $(\tilde{\gamma}, \tilde{\mathsf{com}})$\footnote{Recall that $\tilde{\gamma}$ and  $\tilde{\mathsf{com}}$ are the \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} messages in the right session; they constitutes an execution of Naor's commitment.}. In terms of notation, we denote the execution of this stage by 
\begin{equation}\label[Expression]{expression:hybrid:H:pq:prefix}
(\rho'_\lambda,  \mathsf{st}_C, \mathsf{st}_R, \tau)\getsH^{\mathcal{M}_\lambda}_{\mathsf{pre}}(m,\rho_\lambda).
\end{equation}

\item \label[Stage]{stage:hybrid:H:pq:remainder}
{\bf The Remainder:}
Next, it simply resumes from where the {\bf Prefix Generation} stage stops, to finish the remaining steps of the man-in-the-middle execution $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$.

\subpara{Notation.} We introduce the following notation to captures this step. Define a QPT machine $\ensuremath{\mathcal{A}}\xspace$ that takes as input $(\rho'_\lambda, \tau)$; machine $\mathcal{A}$ is supposed to run the residual strategy of $\mathcal{M}_\lambda$ starting from $\rho'_\lambda$. Also, define a PPT machine $\mathcal{B}$ that takes as input $(\mathsf{st}_C, \mathsf{st}_R, \tau)$; machine $\mathcal{B}$ is supposed to run the residual strategies of the honest committer $C$ and receiver $R$, starting from 
$\mathsf{st}_C$ and $\mathsf{st}_R$ respectively\footnote{Note that it is not necessary to give $\tau$ as common input to these parties; indeed, it can be included in their respective internal states. We choose to make $\tau$ explicit only to match the syntax of \Cref{lem:extract_and_simulate}.}. With the above notations, we can denote the execution of the remainder steps of $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$ by
\begin{equation}\label[Expression]{expression:hybrid:H:pq:remainder}
(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b)\gets \langle \mathcal{A}(\rho'_\lambda), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tau),
\end{equation}
where $\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}$ is the output of $\mathcal{A}$, and $b \in \Set{\bot, \top}$ is the output of the honest receiver $R$ (in the right), indicating if the man-in-the-middle's commitment (i.e., the right session) is accepted ($b = \top$) or not ($b = \bot$).
\item
{\bf Output:} It sets $\ensuremath{\mathsf{OUT}}\xspace_{H} \coloneqq \ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}$ and sets $\mathsf{trans}$ to the transcript of the right session. In particular, $\mathsf{trans}$ includes the $b$ defined in \Cref{expression:hybrid:H:pq:remainder}, indicating if the honest receiver accepts or not. It outputs $(\ensuremath{\mathsf{OUT}}\xspace_{H}, \mathsf{trans})$.  
\end{enumerate}
\end{AlgorithmBox}

\xiao{Say that this is the major lemma for this proof. It is the quantum counterpart of lemma XXX in the classical case...}
\begin{lemma}\label{lem:small-tag:pq:proof:sim-less}
There exists a QPT algorithm $\mathsf{Ext}_{\ensuremath{\mathsf{Sim}\text{-}\mathsf{less}}\xspace}$ such that for machines $\mathcal{A}$ and $\mathcal{B}$ defined in \Cref{stage:hybrid:H:pq:remainder} of \Cref{hybrid:H:pq:reinterpretation}, for any tuple $(\rho'_\lambda, \mathsf{st}_C, \mathsf{st}_R, \tau)$ in the support of $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(m,\rho_\lambda)$ (defined in \Cref{expression:hybrid:H:pq:prefix}), the following requirements are satisfies:
\begin{enumerate}
\item {\bf (Syntax.)}
$\mathsf{Ext}_{\ensuremath{\mathsf{Sim}\text{-}\mathsf{less}}\xspace}$ takes as input the security parameter $1^\lambda$ and the commitment $\tau$, accesses $\ensuremath{\mathcal{A}}\xspace(\rho'_\lambda)$ as an oracle, and outputs a string $\mathsf{Val}$. We denote this procedure by $\mathsf{Val} \gets \mathsf{Ext}_{\ensuremath{\mathsf{Sim}\text{-}\mathsf{less}}\xspace}^{\ensuremath{\mathcal{A}}\xspace(\rho'_\lambda)}(1^\lambda, \tau)$.
\item 
if $\Pr[b = \top: (\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace, b) \leftarrow \langle\mathcal{A}(\rho'_\lambda),\mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda,\tau)]\geq  \delta(\lambda)$, then it holds that
$$
\Pr[\mathsf{Val}=\mathsf{val}(\tau): \mathsf{Val} \gets \mathsf{Ext}_{\ensuremath{\mathsf{Sim}\text{-}\mathsf{less}}\xspace}^{\ensuremath{\mathcal{A}}\xspace(\rho'_\lambda)}(1^\lambda, \tau)]\geq  \delta'(\lambda).
$$
\xiao{set $\delta'(\lambda)$ properly.}
\end{enumerate}
\end{lemma}
\xiao{Say that \Cref{lem:small-tag:pq:proof:sim-less} is the main technical lemma for the current proof of \Cref{item:lem:one-sided:pq:proof:core::2}. We present its proof in \Cref{sec:lem:small-tag:pq:proof:sim-less:proof}. In the following, we finish the proof of \Cref{item:lem:one-sided:pq:proof:core::2} assuming that \Cref{lem:small-tag:pq:proof:sim-less} is true.}

Combining \Cref{lem:extract_and_simulate,lem:small-tag:pq:proof:sim-less}, we obtain immediately the following  \Cref{cor:small-tag:pq:proof:sim}.

\begin{corollary}\label{cor:small-tag:pq:proof:sim} 
Let $(\ensuremath{\mathcal{A}}\xspace, \mathcal{B}, \rho'_\lambda, \mathsf{st}_C, \mathsf{st}_R, \tau)$ be the same as in \Cref{hybrid:H:pq:reinterpretation}. Then, there exists an efficiently constructible QPT (oracle) algorithm $\ensuremath{\mathcal{SE}}\xspace$ such that for any noticeable $\epsilon(\lambda)$, it holds that 
$$
\big\{\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\rho'_\lambda)}(1^\lambda,1^{\epsilon^{-1}},\tau)\big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}
\sind_{\epsilon} 
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{A}},\mathsf{val}_b(\tau)\big): (\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace, b) \leftarrow \langle\mathcal{A}(\rho'_\lambda),\mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda,\tau) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace},
$$
where 
$
\mathsf{val}_b(\tau):= 
\begin{cases}
\mathsf{val}(\tau) & \text{if}~ b=\top \\
\bot & \text{otherwise}
\end{cases}
$.
\end{corollary}

Now, we are ready to present the description of $G$.
\begin{AlgorithmBox}[label={hybrid:G:pq}]{Hybrid \textnormal{$G^{\mathcal{M}_\lambda}(m,\rho_\lambda)$}}
This hybrid proceeds as follows:
\begin{enumerate}
\item
{\bf Prefix Generation:}
This stage is identical to \Cref{hybrid:H:pq:reinterpretation:1} of $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$. Formally, it executes 
$$(\rho'_\lambda,  \mathsf{st}_C, \mathsf{st}_R, \tau)\getsH^{\mathcal{M}_\lambda}_{\mathsf{pre}}(m,\rho_\lambda),$$
where $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(m,\rho_\lambda)$ is defined in \Cref{hybrid:H:pq:reinterpretation:1} of \Cref{hybrid:H:pq:reinterpretation}.
\item
{\bf The Remainder:}
Define $\mathcal{A}$ in the same way as in \Cref{stage:hybrid:H:pq:remainder} of $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$. With this $\mathcal{A}$  and the $(\rho'_\lambda,  \mathsf{st}_C, \mathsf{st}_R, \tau)$ from the previous stage, $G^{\mathcal{M}_\lambda}(m,\rho_\lambda)$ invokes the $\mathcal{SE}$ prescribed in \Cref{cor:small-tag:pq:proof:sim}. Formally, it does the following:
$$(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\rho'_\lambda)}(1^\lambda,1^{\delta^{-1}},\tau),$$
where the $\delta$ is the statistical distance that we want to show for \Cref{item:lem:one-sided:pq:proof:core::2} of \Cref{lem:one-sided:pq:proof:core:}.

\item
{\bf Output:}
It outputs $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}})$.
\end{enumerate}
\end{AlgorithmBox}

\para{Proving \Cref{item:lem:one-sided:pq:proof:core::1} of \Cref{lem:one-sided:pq:proof:core:}.} This part is similar to its classical counterpart, i.e., the ``{\bf Proving \Cref{item:lem:one-sided:proof:core:1} in \Cref{lem:one-sided:proof:core}}'' on \Cpageref{para:lem:one-sided:proof:core:1}. Observe that hybrid $G^{\mathcal{M}_\lambda}(m,\rho_\lambda)$ is an efficient machine. \xiao{(this makes use of \Cref{item:extractorK:efficiency} in \Cref{lem:extractorK}) need to modify}. Moreover, it does not rewind \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} of the man-in-the-middle execution. Therefore, \Cref{item:lem:one-sided:pq:proof:core::1} of \Cref{lem:one-sided:pq:proof:core:} follows immediately from the computationally-hiding property of the left Naor's commitment (i.e., \Cref{item:one-sided:pq:step:Naor-rho,item:one-sided:pq:step:committing} in the left execution).

Then, to finish the proof of \Cref{lem:one-sided:pq:proof:core:}, we only need to prove \Cref{item:lem:one-sided:pq:proof:core::2}.


\para{Proving \Cref{item:lem:one-sided:pq:proof:core::2} of \Cref{lem:one-sided:pq:proof:core:}.} This part is similar to its classical counterpart, i.e., the ``{\bf Proving \Cref{item:lem:one-sided:proof:core:2} in \Cref{lem:one-sided:proof:core}}'' on \Cpageref{para:lem:one-sided:proof:core:2}. First, observe that $G^{\mathcal{M}_\lambda}(m,\rho_\lambda)$ and $H^{\mathcal{M}_\lambda}(m, \rho_\lambda)$ (as per \Cref{hybrid:H:pq:reinterpretation}) are identical up to the end of \Cref{item:one-sided:pq:step:committing} of the man-in-the-middle game of \Cref{prot:one-sided:classical}. \xiao{Say that this follows immediately from \Cref{cor:small-tag:pq:proof:sim}.}



\subsection{Proof of \Cref{lem:small-tag:pq:proof:sim-less}}
\label{sec:lem:small-tag:pq:proof:sim-less:proof}

\xiao{To do...}

\red{\noindent\makebox[\linewidth]{\rule{\paperwidth-8em}{2pt}Update upto here}}
\fi

\subsection{Extractor $\mathcal{K}$ (Proof of \Cref{lem:extractorK})}
\label{sec:lem:extractorK:proof}

\para{Machine $\mathcal{G}_{i}$ ($i \in [\tilde{t}]$):}\label{machine:Gi}
\xiao{We can interpret $H^{\mathcal{M}}(\lambda,m,z)$ as first generating prefix $\tau$, then running $\mathcal{G}_1(\tau)$. At the end, $\mathcal{G}_1(\tau)$ outputs the view of $\mathcal{M}$. The subscript $i$ indicates that the witness $\tilde{x}_1$ is used in the right {\bf WIPoK-1}. Then, for any $\tau$, $\mathcal{G}_{i}(\tau)$ is defined as machine that is identical to $\mathcal{G}_1(\tau)$ except that the witness $\tilde{x}_{i}$ is used in the right {\bf WIPoK-1}.}

\begin{xiaoenv}{}
For any $\tau$ that corresponds to the first 2 steps of the execution $H^{\mathcal{M}}(\lambda,m,z)$, we define
\begin{equation}\label{eq:def:p-tau}
p_\tau \coloneqq \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}: \ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}_1(\tau)].
\end{equation}
\end{xiaoenv}

\xiao{In the following, we need a noticeable function $\epsilon(\lambda)$. Will fix it later.}

\begin{MyClaim}\label{claim:bound:Gi}
$\forall i \in [\tilde{t}], ~\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
\xiao{This follows immediately from the WI property of the right {\bf WIPoK-1}.}
\end{proof}

\para{Machine $\mathcal{G}'_i$ ($i\in [\tilde{t}]$):} On any input $\tau$, $\mathcal{G}'_i(\tau)$ behaves identically to $\mathcal{G}_i(\tau)$, except the following change. Instead of executing \Cref{item:one-sided:step:WIPoK:1} in the left honestly, $H_1$ invokes the emulation-extractor $\mathcal{E}$ to simulate the \Cref{item:one-sided:step:WIPoK:1} transcript $\mathcal{T}$ while extracting a value $(j, x_j)$. Recall that the existence of $\mathcal{E}$ is guaranteed by the PoK property of $\ensuremath{\mathsf{WIPoK}}\xspace$ (see \Cref{def:WEE}). If  $(j, x_j) \notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace^t_f}(Y)$ (see \Cref{eq:one-sided:Lang:OWF}), $\mathcal{G}'_i(\tau)$ aborts; otherwise, $H_1$ continues to finish the execution as $\mathcal{G}_i(\tau)$. It is worth noting that although $\mathcal{E}$ may extract a valid $(j, x_j)$ pair, $\mathcal{G}'_i(\tau)$ does not use this pair.  

\begin{MyClaim}\label{claim:bound:G'i}
$\forall i \in [\tilde{t}], ~\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}'_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
\xiao{The claim follows immediately from \Cref{claim:bound:Gi} and the witness-extended emulation property of the left {\bf WIPoK-1}.}
\end{proof}

\para{Machine $\mathcal{G}''_i$ ($i\in [\tilde{t}]$):} On any input $\tau$, $\mathcal{G}''_i(\tau)$ behaves identically to $\mathcal{G}'_i(\tau)$, except that $\mathcal{G}''_i(\tau)$ use the $(j, x_j)$ (extracted in $\mathcal{G}'_i(\tau)$) to finish the left {\bf WIPoK-2} (i.e., \Cref{item:one-sided:step:WIPoK:2} in the left execution).

\begin{MyClaim}\label{claim:bound:G''i}
$\forall i \in [\tilde{t}], ~\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}''_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
\xiao{The claim follows immediately from \Cref{claim:bound:G'i} and the WI property of the left {\bf WIPoK-2}.}
\end{proof}

\para{Machine $\mathcal{K}_i$ ($i\in [\tilde{t}]$):} On any input $\tau$, $\mathcal{K}_i(\tau)$ behaves identically to $\mathcal{G}''_i(\tau)$, except for the following difference. Machine $\mathcal{K}_i(\tau)$ uses the witness-extended emulator $\ensuremath{\mathcal{SE}}\xspace$ to finish the right {\bf WIPoK-2}, instead of playing the role of the honest receiver. Let $\msf{Val}$ denote the witness extracted by $\ensuremath{\mathcal{SE}}\xspace$. We use $\msf{Val} = \bot$ to denote the situation where $\msf{Val}$ is not a valid witness for the statement $\big(\tilde{com}, (\tilde{y}_1, \ldots, \tilde{y}_{\tilde{t}})\big)$. (Recall that  $\big(\tilde{\mathsf{com}}, (\tilde{y}_1, \ldots, \tilde{y}_{\tilde{t}})\big)$ is supposed to be an instance in the language $\ensuremath{\mathcal{L}}\xspace_{\tilde{\rho}} \vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$.)
\begin{MyClaim}\label{claim:bound:Ki}
$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot :\msf{Val} \gets \mathcal{K}_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
\xiao{This claim follows immediately from \Cref{claim:bound:G''i} and the witness-extended emulation property of the right {\bf WIPoK-2}.}
\end{proof}

Next, we define a machine $\mathcal{K}$ that can be considered as an average-case machine of $\Set{\mathcal{K}_i}_{i\in[\tilde{t}]}$:

\para{Machine $\mathcal{K}$:} one any input $\tau$, $\mathcal{K}(\tau)$ samples uniformly at random an $i \ensuremath{\leftarrow}\xspace [\tilde{t}]$, executes $\mathcal{K}_i(\tau)$, and outputs whatever $\mathcal{K}_i(\tau)$ outputs.
\begin{lemma}\label{lem:bound:averageK}
For any $\tau$, if $p_\tau \ge \epsilon(\lambda)$, then it holds that
$$\Pr[\msf{Val} = \tilde{m}(\tau) :\msf{Val} \gets \mathcal{K}(\tau)] \ge \epsilon'(\lambda)/\tilde{t}.$$
\xiao{Need to define $\tilde{m}(\tau)$; also need to specify $\epsilon'$ (w.r.t.\ $\epsilon$)..}
\end{lemma}
\xiao{Say that we postpone the proof of \Cref{lem:bound:averageK} to \Cref{sec:proof:lem:bound:averageK}}

\xiao{Assume \Cref{lem:bound:averageK} is true, finish the proof of non-malleability.}

\subsection{Proof of \Cref{lem:bound:averageK}}
\label{sec:proof:lem:bound:averageK}


To prove \Cref{lem:bound:averageK}, it suffices to show that if $\tau$ satisfying $p_\tau \ge \epsilon(\lambda)$, then there exists an $i \in [\tilde{t}]$ such that $\Pr[\msf{Val} = \tilde{m}(\tau) :\msf{Val} \gets \mathcal{K}_i(\tau)] \ge \epsilon'(\lambda)$.

We assume for contradiction that (for $\tau$ satisfying $p_\tau \ge \epsilon(\lambda)$)
\begin{equation}\label[Inequality]{eq:proof:averageK:contra-assump}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{m}(\tau) :\msf{Val} \gets \mathcal{K}_i(\tau)] < \epsilon'(\lambda).
\end{equation}

\begin{MyClaim}\label{cliam:bound:Ki-xi}
For any $\tau$, if $p_\tau \ge \epsilon(\lambda)$, then it holds that
$$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}_i(\tau)] \ge p_\tau - \epsilon'(\lambda) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof}
\xiao{Follows from \Cref{claim:bound:Ki} and the one-wayness of $\tilde{f}$. Need to expand this argument.}
\end{proof}

\para{Machine $\mathcal{K}'_i$ ($i \in [\tilde{t}]$):} On any input $\tau$ that corresponding to the first 2 steps of the man-in-the-middle execution, 
\begin{xiaoenv}{}
Brute force to extract $(x_1, \ldots, x_t)$ from $\tau$. (Note that some $x_i$ may be ``bad''.) Pick a random $x^*_j$. It then finish the execution identically as $\mathcal{K}_i$, except that it uses $x^*_j$ as the witness when executing the left {\bf WIPoK-2}.
\end{xiaoenv}
It is worth noting that the $(j, x_j)$ extracted by the witness-extended emulator for the left {\bf WIPoK-1} is not used any more by $\mathcal{K}'_i(\tau)$. 

Obviously, if $\mathcal{K}'_i(\tau)$ picked the $x^*_j$ that is the same as the $x_j$ extracted by $\mathcal{K}_i(\tau)$ from its left {\bf WIPoK-1}, then $\mathcal{K}'_i(\tau)$ and $\mathcal{K}_i(\tau)$ are identical\footnote{In this step, we rely on the injectiveness of the OWF $f$ in the right. That is, there is a unique preimage for each image. Thus, if both the $x^*j$ (sampled by $\mathcal{K}'_i(\tau)$) and the extracted $x_j$ (in $\mathcal{K}_i(\tau)$) are a valid preimage for $y_j$, then it must be that $x^*_j = x_j$.}. Since $\mathcal{K}'_i(\tau)$ samples $x^*_j$ uniformly, then $x^*_j = x_j$ with probability exactly $1/t$. Therefore, the following must holds: \xiao{double check that we don't need an averaging argument here to fix the preamble before the WIPoK starts...}
\begin{equation}\label[Inequality]{eq:bound:K'i}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}'_i(\tau)] \ge \frac{1}{t}\cdot \Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}_i(\tau)].
\end{equation}

\para{Machine $\mathcal{K}''_i$ ($i\in [\tilde{t}]$):} On any input $\tau$,  $\mathcal{K}''_i(\tau)$ behaves identically to $\mathcal{K}'_i(\tau)$ except that it plays as the honest committer in the left {\bf WIPoK-1}, instead of running the witness-extended emulator. Recall that starting from $\mathcal{K}'_i$, the witness $(j, x_j)$ extracted by the witness-extended emulator for the left {\bf WIPoK-1} is not used any more. Thus, machine $\mathcal{K}''_i$ does not need to perform this witness-extended emulation.

By the witness-extended emulation property of the left {\bf WIPoK-1}, it is easy to see that 
\begin{equation}\label[Inequality]{eq:relation:K'-K''}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_i(\tau)] \ge \Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}'_i(\tau)] -\mathsf{negl}(\lambda).
\end{equation}
Moreover, by the WI property of the right {\bf WIPoK-1}, it is easy to see that
\begin{equation}\label[Inequality]{eq:relation:K:WI}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_i(\tau)] \ge \Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_1(\tau)] -\mathsf{negl}(\lambda).
\end{equation}

\begin{MyClaim}\label{claim:bound:K''1}
For any $\tau$, if $p_\tau \ge \epsilon(\lambda)$, then it holds that
$$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_1(\tau)] \ge \frac{1}{t} \cdot \big(p_\tau - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof}
This following immediately from \Cref{cliam:bound:Ki-xi,eq:bound:K'i,eq:relation:K'-K'',eq:relation:K:WI}.
\end{proof}

Now, we show a final claim which, together with \Cref{claim:bound:K''1}, will lead to the desired contradiction.
\begin{MyClaim}\label{claim:K'':non-abort}
$\Pr[\msf{Val} \ne \bot:\msf{Val} \gets \mathcal{K}''_1(\tau)] \le p_\tau + \mathsf{negl}(\lambda)$.
\end{MyClaim}
\xiao{Before proving \Cref{claim:K'':non-abort}, we first show why \Cref{claim:bound:K''1,claim:K'':non-abort} are contradicting.}

\begin{proof}[Proof of {\Cref{claim:K'':non-abort}}]
We first define two extra machines $\mathcal{K}^*_1$ and $\mathcal{K}^{**}_1$.

\para{Machine $\mathcal{K}^{**}_1$:} On any input $\tau$, $\mathcal{K}^{**}_1(\tau)$ behaves identically as $\mathcal{K}''_1(\tau)$ except that $\mathcal{K}^{**}_1(\tau)$ finishes the right {\bf WIPoK-2} using the honest receiver's algorithm, instead of using the witness-extended emulator. $\mathcal{K}^{**}_1(\tau)$ simply outputs the view of $\mathcal{M}$ during the execution. By the witness-extended emulation property, it holds that
\begin{equation}\label{eq:K''1-K**1}
\Pr[\msf{Val} \ne \bot :\msf{Val}\gets \mathcal{K}''_1(\tau)] = \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{**}_1(\tau)] \pm \mathsf{negl}(\lambda).
\end{equation}


\para{Machine $\mathcal{K}^{*}_1$:} On any input $\tau$, $\mathcal{K}^{*}_1(\tau)$ behaves identically as $\mathcal{K}^{**}_1(\tau)$ except for the witness used in the left {\bf WIPoK-2}: $\mathcal{K}^{*}_1(\tau)$ use the $(m, r)$ used to generated $\mathsf{com} = \mathsf{Com}_\rho(m;r)$ as the witness to finish the left {\bf WIPoK-2}. (Note that this witness pair $(m,r)$ must be contained in $\tau$---because $\tau$ is corresponding to the first steps of the man-in-the-middle execution, and the left execution is done by the honest committer.) It is worth noting that machine $\mathcal{K}^*_1$ is exactly the machine $\mathcal{G}_1$ we defined on \Cpageref{machine:Gi}. Therefore, it follows immediately that
\begin{equation}\label{eq:K*1-G1}
\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{*}_1(\tau)] = \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{G}_1(\tau)] = p_\tau, 
\end{equation}
where the last equivalence follows by definition (see \Cref{eq:def:p-tau}).

Next, let us recall the witness used by $\mathcal{K}^{**}_1$ for the left {\bf WIPoK-2}. Machine $\mathcal{K}^{**}_1(\tau)$ performed brute-force to extract $(x_1, \ldots, x_t)$ from $\tau$,\footnote{This brute-forcing is there starting from $\mathcal{K}'_1$, and inherited by $\mathcal{K}'_1$, $\mathcal{K}''_1$, $\mathcal{K}^{**}_1$, and eventually by $\mathcal{K}^{*}_1$.} and pick a random \xiao{valid} $x_i$ as the witness to go through the left {\bf WIPoK-2}. In summary, the only difference between $\mathcal{K}^{*}_1$ and $\mathcal{K}^{**}_1$ is the witness used in the left {\bf WIPoK-2}. Also, note that neither $\mathcal{K}^{*}_1$ nor $\mathcal{K}^{**}_1$ rewinds the {\bf WIPoK-2} because we already get rid of the witness-extended emulation starting from $\mathcal{K}^{**}_1$. Therefore, 
by the WI property of the left {\bf WIPoK-2}, it holds that
\begin{equation}\label{eq:K**1-K*1}
\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{**}_1(\tau)] = \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{*}_1(\tau)] \pm \mathsf{negl}(\lambda).
\end{equation}
Combining \Cref{eq:K''1-K**1,eq:K*1-G1,eq:K**1-K*1}
$$\Pr[\msf{Val} \ne \bot :\msf{Val}\gets \mathcal{K}''_1(\tau)] = p_\tau \pm \mathsf{negl}(\lambda).$$
This in particular implies the inequality in \Cref{claim:K'':non-abort}.
\end{proof}



\red{\noindent\makebox[\linewidth]{\rule{\paperwidth-8em}{2pt}Update upto here}}
\xiao{Old Stuff below}

\subsection{Proving Non-Malleability \red{(Old Stuff)}}
\begin{theorem}\label{thm:one-sided:non-malleability}
The commitment scheme $\langle C, R \rangle$ in \Cref{prot:one-sided:classical} is a one-sided non-malleable commitment scheme against synchronous PPT adversaries.
\end{theorem}	
To prove \Cref{thm:one-sided:non-malleability}, we show that
\begin{equation}\label[Expression]{eq:one-sided:goal}
\Set{\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_0, z)}_{\lambda, m_0, m_1, z} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \Set{\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_1, z)}_{\lambda, m_0, m_1, z},
\end{equation}
where $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^{\lambda}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.

\para{Focusing on Non-Trivial $\mathcal{M}$.} \xiao{(This part seems unnecessary. Delete it later)} First, observe that it is easy to establish \Cref{eq:one-sided:goal} if $\mathcal{M}$ makes $R$ accept in the man-in-the-middle execution $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_0, z)$ with negligible probability. This is because:
\begin{enumerate}
\item
by the computationally-hiding property of $\mathsf{Com}$, the probability that $\mathcal{M}$ makes $R$ accept in the  execution $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_1, z)$ must also be negligible; {\bf and}
\item 
when $R$ rejects, $\tilde{m}$ is defined to be $\bot$. 
\end{enumerate} 
Therefore, we only need to focus on $\mathcal{M}$ for which $R$ accepts with non-negligible probability. Formally, we assume w.l.o.g.\ that there is a polynomial $p(\lambda)$ and a PPT machine $\mathcal{D}$ s.t.\ for infinitely many $\lambda\in \ensuremath{\mathbb{N}}\xspace$, 
\begin{equation}
\left|\Pr[\mathcal{D}\left(\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_0, z)\right) = 1] - \Pr[\mathcal{D}\left(\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_1, z)\right) = 1] \right|\ge p(\lambda).
\end{equation}
We will refer to such $\mathcal{M}$ as a {\em non-trivial} $\mathcal{M}$.


\para{Hybrid Argument.} We will define a sequence of hybrids where the first and the last hybrids are the man-in-the-middle executions corresponding to the LHS and the RHS of \Cref{eq:one-sided:goal} respectively. We will argue that the joint distribution of $\mathcal{M}$'s view {\em and} the value $\tilde{m}$ committed by the right execution are computationally indistinguishable between adjacent hybrids. Obviously, this will imply \Cref{eq:one-sided:goal}.

In the following, we define the hybrids. In each hybrid, we use $(\ensuremath{\mathsf{v}}\xspace, \tilde{m})$ to denote the view of $\mathcal{M}$ and the value committed by the right execution. In particular, we assume it can be efficiently told from $\ensuremath{\mathsf{v}}\xspace$ if the right-side $R$ rejects or not. If $R$ rejects in $\ensuremath{\mathsf{v}}\xspace$, we define $\tilde{m} \coloneqq \bot$; otherwise, $\tilde{m}$ is defined to be the value statistically-bounded in the $\tilde{\sf{com}}$ in \Cref{item:one-sided:step:committing} of the right execution. \xiao{Is this ok? do we assume public verifiability??}

\subpara{Hybrid $H_0$:} This is the man-in-the-middle execution defined by $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_0, z)$. 

\subpara{Hybrid $H_1$:} This hybrid is identical to the previous one, except the following change. Instead of executing \Cref{item:one-sided:step:WIPoK:1} in the left honestly, $H_1$ invokes the emulation-extractor $\mathcal{E}$ to simulate the \Cref{item:one-sided:step:WIPoK:1} transcript $\mathcal{T}$ while extracting a value $(j, x_j)$. Recall that the existence of $\mathcal{E}$ is guaranteed by the PoK property of $\ensuremath{\mathsf{WIPoK}}\xspace$ (see \Cref{def:WEE}). If  $(j, x_j) \notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace^t_f}(Y)$ (see \Cref{eq:one-sided:Lang:OWF}), $H_1$ aborts; otherwise, $H_1$ continues to finish the execution as $H_0$. It is worth noting that although $\mathcal{E}$ may extract a valid $(j, x_j)$ pair, it is not used in this hybrid. 


\begin{MyClaim}\label{claim:H0-H1}
The distribution of $(\ensuremath{\mathsf{v}}\xspace, \tilde{m})$ in $H_0$ is statistically close to that in $H_1$.
\end{MyClaim}
\begin{proof}
This claim follows directly from the witness-extended emulation property (\Cref{def:WEE}) of $\mathcal{E}$, where the negligible error comes from \Cref{item:WEE:2}

\xiao{Need to make a remark: \Cref{def:WEE} only requires emulation of the transcript. It doesn't say that $\mathcal{M}$'s internal state can be simulated (such that when we continue the execution of after running $\mathcal{E}^{\mathcal{M}}$, $\mathcal{M}$ will behave identically as in $H_0$). But this is actually true as long as $\mathcal{M}$ is a classical machine.}
\end{proof}

\subpara{Hybrid $H_2$:} This hybrid is identical to the previous one, except that $H_2$ use the $(j, x_j)$ (extracted in $H_1$) to finish the \Cref{item:one-sided:step:WIPoK:2} $\ensuremath{\mathsf{WIPoK}}\xspace$ in the left execution.

\begin{MyClaim}\label{claim:H1-H2}
The distribution of $(\ensuremath{\mathsf{v}}\xspace, \tilde{m})$ in $H_1$ is computationally indistinguishable to that in $H_2$.
\end{MyClaim}
\begin{proof}
This claim follows directly from the (non-uniform) WI property of the \Cref{item:one-sided:step:WIPoK:2} $\ensuremath{\mathsf{WIPoK}}\xspace$ in the left execution.

\xiao{In more detail, ...}
\end{proof}

\subpara{Hybrid $H_3$:} This hybrid is identical to the previous one, except that in \Cref{item:one-sided:step:committing} of the left execution, $H_3$ sets (and sends) $\mathsf{com} =\mathsf{Com}_\rho(m_1;r)$ (instead of $\mathsf{com} = \mathsf{Com}_\rho(m_0;r)$).
\begin{MyClaim}\label{claim:H2-H3}
The distribution of $(\ensuremath{\mathsf{v}}\xspace, \tilde{m})$ in $H_2$ is computationally indistinguishable to that in $H_3$.
\end{MyClaim}
The proof of \Cref{claim:H2-H3} is the most involved part. We postpone it to \Cref{sec:one-sided:proof:claim:H2-H3}. For now, let us assume that \Cref{claim:H2-H3} is correct and proceed to finish the current proof of \Cref{thm:one-sided:non-malleability}. 


\subpara{Hybrid $H_4$:} This hybrid is identical to the previous one, except that $H_4$ use the $(m_1, r)$ to finish the \Cref{item:one-sided:step:WIPoK:2} $\ensuremath{\mathsf{WIPoK}}\xspace$ in the left execution.
\begin{MyClaim}\label{claim:H3-H4}
The distribution of $(\ensuremath{\mathsf{v}}\xspace, \tilde{m})$ in $H_3$ is computationally indistinguishable to that in $H_4$.
\end{MyClaim}
\begin{proof}
This proof is identical to that of \Cref{claim:H1-H2}. We omit the details.
\end{proof}


\subpara{Hybrid $H_5$:} This is the man-in-the-middle execution defined by $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_1, z)$. 
\begin{MyClaim}\label{claim:H4-H5}
The distribution of $(\ensuremath{\mathsf{v}}\xspace, \tilde{m})$ in $H_4$ is statistically close to that in $H_5$.
\end{MyClaim}
\begin{proof}
Note that the only difference between $H_4$ and $H_5$ is that $H_5$ does not run the emulation-extractor $\mathcal{E}$ to finish \Cref{item:one-sided:step:WIPoK:1} of the left execution; instead, it is using the honest $C$'s algorithm. $H_5$ can do this because starting from $H_4$, we no longer need the $(j, x_j)$ pair extracted by $\mathcal{E}$ from \Cref{item:one-sided:step:WIPoK:1} of the left execution. 

Thus, the switch between $H_4$ and $H_5$ is analogous to that between $H_0$ and $H_1$. Similar to the proof of \Cref{claim:H0-H1}, the statistical indistinguishability follows from the witness-extended emulation property (\Cref{def:WEE}) of the \Cref{item:one-sided:step:WIPoK:1} $\ensuremath{\mathsf{WIPoK}}\xspace$.
\end{proof}

Combining \Cref{claim:H0-H1,claim:H1-H2,claim:H2-H3,claim:H3-H4,claim:H4-H5} shows that \Cref{eq:one-sided:goal} holds. This finishes the proof of \Cref{thm:one-sided:non-malleability}.



\subsection{Proof of \Cref{claim:H2-H3} \red{(Old Stuff)}}
\label{sec:one-sided:proof:claim:H2-H3}

\begin{xiaoenv}
May need to define the output of each $H_i$ as $\ensuremath{\mathsf{View}}\xspace_{H_i}$, and the corresponding committed value as $\tilde{m}(\ensuremath{\mathsf{View}}\xspace_{H_i})$. which is defined as: 
\begin{itemize}
\item
If $\ensuremath{\mathsf{View}}\xspace_{H_i}$ is accepting, $\tilde{m}(\ensuremath{\mathsf{View}}\xspace_{H_i})$ is defined to be the value (statistically) committed in \Cref{item:one-sided:step:committing} of the right execution;
Otherwise, $\tilde{m}(\ensuremath{\mathsf{View}}\xspace_{H_i}) \coloneqq \bot$. 
\end{itemize}
\end{xiaoenv}



\xiao{In the following need to specify $\epsilon$ and $\epsilon'$.}




\begin{xiaoenv}{}
Define $H^{\mathcal{M}}[m]$ and $G^{\mathcal{M}}[m]$. Note that $H^{\mathcal{M}}[m_0] = H_2$ and $H^{\mathcal{M}}[m_1] = H_3$.

\para{Game $H^{\mathcal{M}}[m]$:} Identical to $H_2$ except that \Cref{item:one-sided:step:committing} is $\mathsf{Com}_\rho(m;r)$.

\para{Game $G^{\mathcal{M}}[m]$:} It first execute $\ensuremath{\mathsf{View}}\xspace_H \gets H^{\mathcal{M}}[m]$. It sets $\ensuremath{\mathsf{View}}\xspace_G \coloneqq \ensuremath{\mathsf{View}}\xspace_H$. Next, it sets $\mathsf{Val}$ in the following way:
\begin{itemize}
\item
If $\ensuremath{\mathsf{View}}\xspace_H$ is not accepting, let $\mathsf{Val} \coloneqq \bot$;
\item
Otherwise, it executes $\mathcal{E}$ on input $\tau(\ensuremath{\mathsf{View}}\xspace_H)$, and sets $\mathsf{Val}$ to the output of $\mathcal{E}(\tau)$.
\end{itemize}
\end{xiaoenv}


\begin{xiaoenv}{Define the simulation-extractor}

\para{Extractor $\mathcal{E}(\tau)$.} On input the prefix , it first continues to finish the execution as $H^\mathcal{M}[m]$ to learn the view $\ensuremath{\mathsf{View}}\xspace$ of $\mathcal{M}$. If $\ensuremath{\mathsf{View}}\xspace$ is not accepting, it outputs $\ensuremath{\mathsf{View}}\xspace$ and $\mathsf{Val} = \bot$; Otherwise, it rewinds the execution up to $\red{XXX}$ times. for $\red{j \in [XXX]}$, do the following:
\begin{itemize}
\item
to do...
\end{itemize} 
\end{xiaoenv}

\begin{xiaoenv}{finishing }
Note that assuming \Cref{lem:one-sided:proof:statsitcally-close} is true, \Cref{claim:H2-H3} follows from the computationally-hiding property of Naor's commitment. To do...

\end{xiaoenv}

\begin{lemma}\label{lem:one-sided:proof:statsitcally-close}
For any $m \in \ensuremath{\{0,1\}}\xspace^\lambda$ and any PPT machine $\mathcal{M}$, 
\begin{equation}\label[Expression]{eq:one-sided:proof:statsitcally-close}
\big\{\big(\ensuremath{\mathsf{View}}\xspace_{H}, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{H})\big):\ensuremath{\mathsf{View}}\xspace_{H} \gets H^{\mathcal{M}}[m] \big\} \ensuremath{\stackrel{\text{s}}{\approx}}\xspace_\epsilon \big\{(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}[m] \big\}.
\end{equation}
\end{lemma}
\begin{proof}
It follows from the definition of $G^\mathcal{M}[m]$ that 
$$\big\{\big(\ensuremath{\mathsf{View}}\xspace_{H}, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{H})\big):\ensuremath{\mathsf{View}}\xspace_{H} \gets H^{\mathcal{M}}[m] \big\} \ensuremath{\stackrel{\text{i.d.}}{=\mathrel{\mkern-3mu}=}}\xspace \big\{\big(\ensuremath{\mathsf{View}}\xspace_G, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})\big):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}[m] \big\}.$$
Thus, to establish \Cref{eq:one-sided:proof:statsitcally-close}, it suffices to show
\begin{equation}\label[Expression]{eq:one-sided:proof:statsitcally-close:goal}
\big\{\big(\ensuremath{\mathsf{View}}\xspace_G, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})\big):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}[m] \big\}\ensuremath{\stackrel{\text{s}}{\approx}}\xspace_\epsilon \big\{(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}[m] \big\}.
\end{equation}
To establish \Cref{eq:one-sided:proof:statsitcally-close:goal}, it suffices to show
\begin{equation}\label[Inequality]{eq:one-sided:proof:statsitcally-close:inequality}
\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}[m]] \le \epsilon(\lambda) + \mathsf{negl}(\lambda).
\end{equation}
We first define some events w.r.t.\ the random procedure $(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val}) \gets G^\mathcal{M}[m]$:
\begin{itemize}
\item
$E_1$: the event that $\ensuremath{\mathsf{View}}\xspace_G$ is an accepting view.
\item
$E_2$: the even that $p_{\tau(\ensuremath{\mathsf{View}}\xspace_G)} \le \epsilon(\lambda)$.
\end{itemize}
It follows by definition that the the probability for $(E_1 \wedge E_2)$ is upper-bounded by $\epsilon(\lambda)$. In more details,
\begin{equation}\label{eq:bounding-E1E2}
\Pr_{G^\mathcal{M}[m]}[E_1 \wedge E_2] 
= \Pr_{G^\mathcal{M}[m]}[E_1 ~|~ E_2] \cdot \Pr_{G^\mathcal{M}[m]}[E_2] 
 \le \Pr_{G^\mathcal{M}[m]}[E_1 ~|~ E_2] \cdot 1 = \epsilon(\lambda) \cdot 1.	
\end{equation}
Next, we upper-bound the LHS of \Cref{eq:one-sided:proof:statsitcally-close:inequality} by $\Pr[\msf{Val} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G)~|~E_1 \wedge \neg E_2]$:

\begin{MyClaim}\label{bound:Val-ne-m}
It holds that	
$$\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})] \le \epsilon(\lambda) + \Pr[\msf{Val} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G)~|~E_1 \wedge \neg E_2],$$ where both the probabilities are taken w.r.t.\ the random procedure ${(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val})\gets G^{\mathcal{M}}[m]}$.
\end{MyClaim}
\begin{proof}
All the probabilities below are taken w.r.t.\ the same random procedure $(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val})\gets G^{\mathcal{M}}[m]$. We thus omit it from the subscript.
\begin{align*}
\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})] 
& = \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_1] + \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge \neg E_1]	\\
& = \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_1] \numberthis \label{bound:Val-ne-m:step:1}	\\
& = \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_1 \wedge E_2] +\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_1 \wedge \neg E_2]	\\
& \le \epsilon(\lambda) +  \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_1 \wedge \neg E_2] \numberthis \label{bound:Val-ne-m:step:2}\\
&\le \epsilon(\lambda) +  \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) ~|
~ E_1 \wedge \neg E_2],
\end{align*}
where \Cref{bound:Val-ne-m:step:1} follows from the fact that if $\ensuremath{\mathsf{View}}\xspace_G$ is not accepting then $\msf{Val} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G) = \bot$, and \Cref{bound:Val-ne-m:step:2} follows from \Cref{eq:bounding-E1E2}.
\end{proof}
Recall that our goal is to establish \Cref{eq:one-sided:proof:statsitcally-close:inequality}. Because of \Cref{bound:Val-ne-m}, it is now sufficient to show 
\begin{equation}\label[Inequality]{bad:conditioned:E1-nE2}
\Pr_{(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val})\gets G^{\mathcal{M}}[m]}[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) ~|
~ E_1 \wedge \neg E_2] \le \mathsf{negl}(\lambda).
\end{equation} 
To prove \Cref{bad:conditioned:E1-nE2}, let us first interpret its LHS: 
\begin{itemize}
\item
Given $E_1$ (i.e., $\ensuremath{\mathsf{View}}\xspace_G$ is accepting), we know that $G^\mathcal{M}[m]$ must have invoked the machine $\mathcal{E}\big(\tau(\ensuremath{\mathsf{View}}\xspace_G)\big)$ and the value $\msf{Val}$ is defined to be its output.
\item
Given $\neg E_2$ (i.e., $p_{\tau(\ensuremath{\mathsf{View}}\xspace_G)} > \epsilon(\lambda)$), we know that $\mathcal{E}$ must have been invoked on a prefix $\tau(\ensuremath{\mathsf{View}}\xspace_G)$ that has the following property: starting from this $\tau(\ensuremath{\mathsf{View}}\xspace_G)$, $G^\mathcal{M}[m]$'s first output will be an accepting view with probability at least $\epsilon(\lambda)$. \xiao{May want to define the execution $G^\mathcal{M}_{\tau(\ensuremath{\mathsf{View}}\xspace_G)}[m]$ to specify the prefix. Remark that for $(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{val})\gets G^\mathcal{M}_{\tau}[m]$, we always have $\tau(\ensuremath{\mathsf{View}}\xspace_G) = \tau$.}
\end{itemize}
With the above understanding, it is easy to see that \Cref{bad:conditioned:E1-nE2} is equivalent to the following lemma.
\begin{lemma}\label{lemma:H2-H3:proof:final}
For any prefix $\tau$ corresponding to \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing}, if 
\begin{equation}\label[Inequality]{lemma:H2-H3:proof:final:condition}
\Pr[\ensuremath{\mathsf{View}}\xspace_G~\text{is accepting} : \ensuremath{\mathsf{View}}\xspace_G \gets G^\mathcal{M}_{\tau}[m]] \ge \epsilon(\lambda),
\end{equation} 
then it holds that 
\begin{equation}\label[Inequality]{lemma:H2-H3:proof:final:result}
\Pr[\msf{Val} \ne \tilde{m}(\tau): \msf{Val} \gets \mathcal{E}(\tau)] \le \mathsf{negl}(\lambda),
\end{equation}
 where $\tilde{m}(\tau)$ denote the value (statistically) bounded in the right-side Naor's commitment (i.e.\ \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing}) contained in $\tau$. 
\end{lemma}
We postpone the proof of \Cref{lemma:H2-H3:proof:final} to \Cref{sec:proof:lemma:H2-H3:proof:final}. Assuming that \Cref{lemma:H2-H3:proof:final} is true, it completes the current proof for \Cref{lem:one-sided:proof:statsitcally-close}. 
\end{proof}

\subsection{Proof of \Cref{lemma:H2-H3:proof:final} \red{(Old Stuff)}}
\label{sec:proof:lemma:H2-H3:proof:final}

We prove that under the promise of \Cref{lemma:H2-H3:proof:final:result}, it holds that

\begin{equation}\label[Inequality]{eq:lower-bound:E}
\Pr[\msf{Val} = \tilde{m}(\tau): \msf{Val} \gets \mathcal{E}(\tau)] \ge \epsilon'(\lambda)/\tilde{t}.
\end{equation}
\xiao{need to state the running time of $\mathcal{E}$ and the relation between $\epsilon'$ and $\epsilon$. Actually, the above $\mathcal{E}$ is the one-shot execution of the $\mathcal{E}$ we defined earlier. Will make this explicit later.}

\xiao{Define $\mathcal{E}_{\tilde{i}}(\tau)$. By the relation between $\mathcal{E}(\tau)$ and $\mathcal{E}_{\tilde{i}}(\tau)$, to prove \Cref{eq:lower-bound:E}, it suffices to prove the following lemma.}
\begin{lemma}\label{lem:lower-bound:Ei}
For any prefix $\tau$ corresponding to \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing}, if 
\begin{equation}\label[Inequality]{lem:lower-bound:Ei:condition}
\Pr[\ensuremath{\mathsf{View}}\xspace_G~\text{is accepting} : \ensuremath{\mathsf{View}}\xspace_G \gets G^\mathcal{M}_{\tau}[m]] \ge \epsilon(\lambda),
\end{equation} 
then
there exists $\tilde{i} \in [\tilde{t}]$ s.t.\ $$\Pr[\msf{Val} = \tilde{m}(\tau): \msf{Val} \gets \mathcal{E}_{\tilde{i}}(\tau)] \ge \epsilon'(\lambda).$$
\end{lemma}
\para{Proving \Cref{lem:lower-bound:Ei}.} In the remainder of this section, we prove \Cref{lem:lower-bound:Ei}, which eventually finishes the proof of \Cref{lemma:H2-H3:proof:final}.

We prove this lemma by contradiction. Under the condition of \Cref{lem:lower-bound:Ei:condition}, we assume for contradiction that 
$$\forall \tilde{i} \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{m}(\tau): \msf{Val} \gets \mathcal{E}_{\tilde{i}}(\tau)] < \epsilon'(\lambda).$$


\begin{MyClaim}
For any $\tau$ satisfying the assumption of \Cref{lem:lower-bound:Ei:condition}, the following holds:
$$\forall \tilde{i}\in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{X}_{\tilde{i}} : \msf{Val} \gets\mathcal{E}_{\tilde{i}}(\tau)] \ge \epsilon(\lambda)/\tilde{t} - \epsilon'(\lambda) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof}
\begin{xiaoenv}{Proof sketch}
\begin{itemize}
\item
Define $\mathcal{E}^*_{\tilde{i}}(\tau)$, which is identical to $\mathcal{E}_{\tilde{i}}(\tau)$ except that it plays the final \ensuremath{\mathsf{WIPoK}}\xspace in the right execution as the honest receiver, instead of running the emulation-extractor. $\mathcal{E}^*_{\tilde{i}}(\tau)$ outputs a view $\ensuremath{\mathsf{View}}\xspace_{\tilde{i}}$.
\item
By the property of the \ensuremath{\mathsf{WIPoK}}\xspace emulation-extractor, it holds that 
$$\forall \tilde{i} \in [\tilde{t}], ~\Pr[\msf{Val}\ne \bot:\msf{Val}\gets\mathcal{E}_{\tilde{i}}(\tau)] \ge \Pr[\ensuremath{\mathsf{View}}\xspace_{\tilde{i}}~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace_{\tilde{i}}\gets\mathcal{E}^*_{\tilde{i}}(\tau)] -\mathsf{negl}(\lambda).$$
where $\msf{Val} \ne \bot$ means that the extracted $\msf{Val}$ is a valid witness for the statement $\tilde{\mathsf{com}} \vee (\tilde{y}_1, \ldots, \tilde{y}_{\tilde{t}})$.
\item
We define the following machine $\mathcal{E}^*(\tau)$ that on any prefix $\tau$:	
\begin{itemize}
\item
sample a random $\tilde{i} \ensuremath{\leftarrow}\xspace [\tilde{t}]$;
\item
Run $\ensuremath{\mathsf{View}}\xspace\gets\mathcal{E}_{\tilde{i}}(\tau)$, and outputs $\ensuremath{\mathsf{View}}\xspace$.
\end{itemize}
It is obvious that 
$$\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets\mathcal{E}^*(\tau)] = \Pr[\ensuremath{\mathsf{View}}\xspace_G~\text{is accepting} : \ensuremath{\mathsf{View}}\xspace_G \gets G^\mathcal{M}_{\tau}[m]].$$
\item
Since $\tau$ satisfying \Cref{lem:lower-bound:Ei:condition}, we know that for such a $\tau$, 
$$\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets\mathcal{E}^*(\tau)] \ge \epsilon(\lambda).$$
\item
By the definition of $\mathcal{E}^*(\cdot)$, we know that for such a $\tau$, 
$$\exists \tilde{j} \in [\tilde{t}]~s.t.~\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets\mathcal{E}^*_{\tilde{j}}(\tau)] \ge \epsilon(\lambda)/\tilde{t}.$$
\end{itemize}
\end{xiaoenv}
\end{proof}
\section{Small-Tag, One-Sided, Synchronous, Classical Setting}
\label{sec:small-tag-one-sided-sync-classical}

In this section, we show the small-tag, one-sided, synchronous non-malleable commitment scheme $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ in the classical setting. 
Though our final goal is to construct \emph{post-quantum} non-malleable commitments, we give a classically-secure construction here since the security proof for its post-quantum version $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ (in \Cref{pq:sec:small-tag-one-sided-sync-pq}) is very similar to that in the classical case except for one step where we rely on the extract-and-simulate lemma (\Cref{lem:extract_and_simulate}).

\subsection{Construction of \textnormal{$\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$}}



An intuitive explanation of this construction is already provided in \Cref{sec:tech-overview:small-tag:one-sided}. We now present the formal description in \Cref{prot:one-sided:classical}. 
This construction is based on the following building blocks:
\begin{itemize}
\item
An {\em injective} OWF $f$; To convey the main idea better, we first present the construction assuming the existence of {\em injective} OWFs.  
We explain how to relax the assumption to the existence to {\em any} OWFs in \Cref{sec:removing-injectivity}. 
\item
Naor's commitment; We use $\beta$ to denote the first message for Naor's commitment, and $\mathsf{Com}_\beta(m;r)$ to denote the second message where a string $m$ is committed using randomness $r$.
\item
A witness-indistinguishable proof of knowledge $\ensuremath{\mathsf{WIPoK}}\xspace$.
\end{itemize}


\begin{ProtocolBox}[label={prot:one-sided:classical}]{Small-Tag One-Sided Synchronous NMCom \textnormal{$\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$}}
The tag space is defined to be $[n]$ where $n$ is a polynomial on $\lambda$. Let $t \in [n]$ be the tag for the following interaction. Let $m$ be the message to be committed to. 

\para{Commit Stage:}
\begin{enumerate}
\item\label[Step]{item:one-sided:step:Naor-rho}
Receiver $R$ samples and sends the first message $\beta$ for Naor's commitment; 
\item\label[Step]{item:one-sided:step:committing}
Committer $C$ commits to $m$ using the second message of Naor's commitment. Formally, $C$ samples a random tape $r$ and sends $\mathsf{com} = \mathsf{Com}_\beta(m;r)$;
\item\label[Step]{item:one-sided:step:OWFs}
$R$ computes $\Set{y_i = f(x_i)}_{i \in [t]}$ with $x_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [t]$. $R$ sends $Y = (y_1, \ldots, y_t)$ to $C$;
\item\label[Step]{item:one-sided:step:WIPoK:1}
{\bf (WIPoK-1.)} $R$ and $C$ execute an instance of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' the pre-image of some $y_i$ contained in $Y$ (defined in \Cref{item:one-sided:step:OWFs}). Formally, $R$ proves that $Y \in \ensuremath{\mathcal{L}}\xspace^t_f$, where \begin{equation}\label[Language]{eq:one-sided:Lang:OWF}
\ensuremath{\mathcal{L}}\xspace^t_f \coloneqq \Set{(y_1, \ldots, y_t)~|~\exists (i, x_i) ~s.t.~ i \in [t] \wedge y_i = f(x_i)}.
\end{equation}
Note that $R$ uses $(1,x_1)$ as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.
\item\label[Step]{item:one-sided:step:WIPoK:2}
{\bf (WIPoK-2.)} $C$ and $R$ execute an instance of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $C$ proves to $R$ that he ``knows'' {\em either} the message committed in $\mathsf{com}$ (defined in \Cref{item:one-sided:step:committing}), {\em or} the pre-image of some $y_i$ contained in $Y$ (defined in \Cref{item:one-sided:step:OWFs}). Formally, $C$ proves that $(\mathsf{com}, Y) \in \ensuremath{\mathcal{L}}\xspace_\beta \vee \ensuremath{\mathcal{L}}\xspace^t_f$, where $\ensuremath{\mathcal{L}}\xspace_\beta \vee \ensuremath{\mathcal{L}}\xspace^t_f$ denotes the  OR-composed language (as per \Cref{def:OR-Comp}), $\ensuremath{\mathcal{L}}\xspace^t_f$ was defined in \Cref{eq:one-sided:Lang:OWF} and 
\begin{equation}\label[Language]{eq:one-sided:Lang:Com}
\ensuremath{\mathcal{L}}\xspace_\beta\coloneqq \Set{\mathsf{com} ~|~ \exists (m, r)~s.t.~ \mathsf{com} = \mathsf{Com}_\beta(m;r)}.
\end{equation}
Note that $C$ uses the $(m, r)$ defined in \Cref{item:one-sided:step:committing} as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.
\end{enumerate}
\para{Decommit Stage:} 
$C$ sends $(m, r)$. $R$ accepts if $\mathsf{com} = \mathsf{Com}_\beta(m;r)$, and rejects otherwise.
\end{ProtocolBox}

\para{Security.} Completeness is straightforward from the description of \Cref{prot:one-sided:classical}. 
The statistical binding property follows from that of Naor's commitment. Hiding of any non-malleable commitment scheme follows directly from its non-malleability. So, we only need to prove the non-malleability of our protocol, which is established by the following theorem.
\begin{theorem}\label{thm:one-sided:non-malleability}
The commitment scheme $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ in \Cref{prot:one-sided:classical} is non-malleable against  one-sided synchronous PPT adversaries with tag space $[n]$, with $n$ being any polynomial on $\lambda$.
\end{theorem}	
We prove  \Cref{thm:one-sided:non-malleability} in subsequent subsections.

\subpara{Structure of the Proof of \Cref{thm:one-sided:non-malleability}.}
Since the proof of \Cref{thm:one-sided:non-malleability} is lengthy, we provide a road map here.
We prove \Cref{thm:one-sided:non-malleability} in \Cref{one-sided:non-malleability:proof:classical,sec:one-sided:core-lemma:proof,lem:small-tag:proof:se:proof,sec:lem:small-tag:proof:se:proof:K:proof,sec:lem:bound:Ki:proof,sec:proof:claim:K'':non-abort}.
In each subsection, we introduce a lemma or claim whose proof is deferred to the next subsection. Specifically,
\begin{itemize}
    \item In the rest of \Cref{one-sided:non-malleability:proof:classical}, we prove \Cref{thm:one-sided:non-malleability} assuming that \Cref{lem:one-sided:proof:core} is correct.
     \item In \Cref{sec:one-sided:core-lemma:proof}, we prove \Cref{lem:one-sided:proof:core} assuming that \Cref{lem:small-tag:proof:se} is correct.
      \item In  \Cref{lem:small-tag:proof:se:proof}, we prove \Cref{lem:small-tag:proof:se} assuming that \Cref{lem:small-tag:proof:se:proof:K} is correct.
        \item In  \Cref{sec:lem:small-tag:proof:se:proof:K:proof}, we prove \Cref{lem:small-tag:proof:se:proof:K} assuming that \Cref{lem:bound:Ki} is correct.
        \item  In  \Cref{sec:lem:bound:Ki:proof}, we prove \Cref{lem:bound:Ki} assuming that \Cref{claim:K'':non-abort} is correct.
        \item In \Cref{sec:proof:claim:K'':non-abort}, we prove \Cref{claim:K'':non-abort}. 
\end{itemize}
Putting everything together, we complete the proof of  \Cref{thm:one-sided:non-malleability}.
\begin{remark}
We remark that the proof of \Cref{lem:small-tag:proof:se} is the only step that cannot be directly translated to the post-quantum setting. Looking ahead, the post-quantum counterpart of this step (in \Cref{pq:lem:small-tag:proof:se}) will make use of a new \emph{post-quantum extract-and-simulate} lemma, which we state and prove in \Cref{sec:extract_and_simulate}.
\end{remark}
Moreover, we provide a moderately-detailed summary of this proof in \Cref{sec:proof:summar:one-sided}, with the hope to further elucidate the logic flow behind the proof of \Cref{thm:one-sided:non-malleability}. It is recommended that the reader start reading \Cref{sec:proof:summar:one-sided} after he/she has read  
\Cref{one-sided:non-malleability:proof:classical,sec:one-sided:core-lemma:proof,lem:small-tag:proof:se:proof,sec:lem:small-tag:proof:se:proof:K:proof,sec:lem:bound:Ki:proof,sec:proof:claim:K'':non-abort,sec:removing-injectivity} (at least once), because \Cref{sec:proof:summar:one-sided} uses several notations defined in preceding subsections.

\subsection{Proving Non-Malleability (Proof of \Cref{thm:one-sided:non-malleability})}
\label{one-sided:non-malleability:proof:classical}





In the rest of this section, we write $\langle C, R \rangle$ to mean $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ for notational simplicity. 
To prove \Cref{thm:one-sided:non-malleability}, let us first define the game that captures the man-in-the-middle execution corresponding to $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)$ w.r.t.\ the $\langle C, R \rangle$ defined in \Cref{prot:one-sided:classical}.

\para{Game $H^{\mathcal{M}}(\lambda,m,z)$:\label{gameH:description}} This is the man-in-the-middle execution of the commit stage of the $\langle C, R \rangle$ defined in \Cref{prot:one-sided:classical}, where the left committer commits to $m$ and $\mathcal{M}$'s non-uniform advice is $z$. The output of this game consists of the following three parts:
\begin{enumerate}
\item
$\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}$: this is the output of $\mathcal{M}$ at the end of this game;
\item
$\tilde{\tau}$: this is defined to be $\tilde{\tau} \coloneqq (\tilde{\beta}, \tilde{\mathsf{com}})$, where $\tilde{\beta}$ and $\tilde{\mathsf{com}}$ are the \Cref{item:one-sided:step:Naor-rho} and \Cref{item:one-sided:step:committing} messages exchanged between $\mathcal{M}$ and the honest receiver $R$ (i.e., in the right session);
\item
$b \in \Set{\top, \bot}$: this is the output of the honest receiver $R$, indicating if the man-in-the-middle's commitment (i.e., the right session) is accepted ($b = \top$) or not ($b = \bot$).
\end{enumerate}


\para{Notation.} For any $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}, \tilde{\tau}, b)$ in the support of $H^{\mathcal{M}}(\lambda,m,z)$, the following $\mathsf{val}_b(\tilde{\tau})$ defines the value committed in the man-in-the-middle's commitment (i.e.,  the right session):
\begin{equation}\label{eq:def:val-b-tau}
\mathsf{val}_b(\tilde{\tau}) \coloneqq 
\begin{cases}
\mathsf{val}(\tilde{\tau}) & b = \top\\
\bot & b = \bot
\end{cases},
\end{equation}
where $\mathsf{val}(\tilde{\tau})$ denote the value statistically-bound in \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the right session. (Recall that these two steps constitute a Naor's commitment.) Also, throughout this paper,  we assume for simplicity that Naor's commitment is perfectly binding (instead of only statistically binding). This assumption only suppresses an {\em additive error of negligible amount} in relevant lemmas, which will not affect any of our results.

By definition, it is easy to see that:
\begin{equation}\label{eq:classical:mim-H}
\big\{\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)\big\} \ensuremath{\stackrel{\text{i.d.}}{=\mathrel{\mkern-3mu}=}}\xspace \big\{\big(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}, \mathsf{val}_b(\tilde{\tau})\big): (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}, \tilde{\tau}, b) \gets H^{\mathcal{M}}(\lambda,m,z) \big\},
\end{equation}
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.

Therefore, to prove that \Cref{prot:one-sided:classical} satisfies \Cref{def:NMCom:classical}, it suffices to show the following:
\begin{align*}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace^0_{\mathcal{M}}, \mathsf{val}_{b^0}(\tilde{\tau}^0)\big): (\ensuremath{\mathsf{OUT}}\xspace^0_{\mathcal{M}}, \tilde{\tau}^0, b^0) \gets H^{\mathcal{M}}(\lambda,m_0,z) \big\} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace^1_{\mathcal{M}}, \mathsf{val}_{b^1}(\tilde{\tau}^1)\big): (\ensuremath{\mathsf{OUT}}\xspace^1_{\mathcal{M}}, \tilde{\tau}^1, b^1) \gets H^{\mathcal{M}}(\lambda,m_1,z) \big\}, \numberthis \label{eq:classical:H:m-0:m-1}
\end{align*}
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $(m_0, m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.


\para{Proof by Contradiction.} Our high-level strategy is proof by contradiction. We assume for contradiction that there are a (possibly non-uniform) PPT machine $\mathcal{D}$ and a function $\delta(\lambda) = 1/\mathsf{poly}(\lambda)$ such that for infinitely many $\lambda \in \ensuremath{\mathbb{N}}\xspace$,
\begin{equation}\label[Inequality]{eq:one-sided:proof:contra-assump}
\bigg|\Pr[\mathcal{D}\big(1^\lambda, \ensuremath{\mathsf{OUT}}\xspace^0_{\mathcal{M}}, \mathsf{val}_{b^0}(\tilde{\tau}^0)\big)=1] - \Pr[\mathcal{D}\big(1^\lambda, \ensuremath{\mathsf{OUT}}\xspace^1_{\mathcal{M}}, \mathsf{val}_{b^1}(\tilde{\tau}^1)\big)=1] \bigg|\ge 3 \cdot \delta(\lambda),
\end{equation}
where the first probability is taken over the random procedure $(\ensuremath{\mathsf{OUT}}\xspace^0_{\mathcal{M}}, \tilde{\tau}^0, b^0) \gets H^{\mathcal{M}}(\lambda,m_0,z)$ and the second probability is taken over the random procedure $(\ensuremath{\mathsf{OUT}}\xspace^1_{\mathcal{M}}, \tilde{\tau}^1, b^1) \gets H^{\mathcal{M}}(\lambda,m_1,z)$.

We then show the following lemma:
\begin{lemma}\label{lem:one-sided:proof:core}
There exists a hybrid $G$ such that for any PPT $\mathcal{M}$ and the $\delta(\lambda)$ defined above, the following holds
\begin{enumerate}
\item\label[Property]{item:lem:one-sided:proof:core:1}
$\big\{(\ensuremath{\mathsf{OUT}}\xspace^0, \msf{Val}^0) : (\ensuremath{\mathsf{OUT}}\xspace^0, \msf{Val}^0) \gets G^{\mathcal{M}}(\lambda,m_0,z) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{(\ensuremath{\mathsf{OUT}}\xspace^1, \msf{Val}^1) : (\ensuremath{\mathsf{OUT}}\xspace^1, \msf{Val}^1) \gets G^{\mathcal{M}}(\lambda,m_1,z) \big\}$, where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $(m_0, m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
\item\label[Property]{item:lem:one-sided:proof:core:2}
\begingroup\fontsize{9.5pt}{0pt}\selectfont
$\big\{(\ensuremath{\mathsf{OUT}}\xspace^G, \msf{Val}^G):(\ensuremath{\mathsf{OUT}}\xspace^G, \msf{Val}^G) \gets G^{\mathcal{M}}(\lambda,m,z) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\delta(\lambda)} \big\{ \big(\ensuremath{\mathsf{OUT}}\xspace^H, \mathsf{val}_{b^H}(\tilde{\tau}^H)\big): (\ensuremath{\mathsf{OUT}}\xspace^H, \tilde{\tau}^H, b^H) \gets H^{\mathcal{M}}(\lambda,m,z) \big\}$,
\endgroup  
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
\end{enumerate}
\end{lemma}
It is easy to see that if \Cref{lem:one-sided:proof:core} is true, it contradicts our assumption in \Cref{eq:one-sided:proof:contra-assump}. 
 Thus, it will finish the proof of non-malleability. Indeed, this lemma is the most technically involved part. We prove it in \Cref{sec:one-sided:core-lemma:proof}. 

\subsection{Proof of \Cref{lem:one-sided:proof:core}}
\label{sec:one-sided:core-lemma:proof}

First, we provide a new but equivalent interpretation of the game $H^{\mathcal{M}}(\lambda, m, z)$ in \Cref{hybrid:H:reinterpretation},. (We also provide a picture in \Cref{figure:one-sided:H:re-interpretation} to illustrate it.)
\begin{AlgorithmBox}[label={hybrid:H:reinterpretation}]{Re-interpretation of Game \textnormal{$H^{\mathcal{M}}(\lambda, m, z)$}}
Game $H^{\mathcal{M}}(\lambda, m, z)$ can be split into the following stages:
\begin{enumerate}
\item \label[Stage]{hybrid:H:reinterpretation:1}
{\bf Prefix Generation:}
First, execute \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the man-in-the-middle game of \Cref{prot:one-sided:classical}. That is, it plays as the left honest committer committing to $m$ and the right honest receiver, with $\mathcal{M}(1^\lambda,z)$ being the man-in-the-middle adversary.

\subpara{Notation:} Let $\mathsf{st}_{\mathcal{M}}$ denote the state of $\mathcal{M}$ at the end of \Cref{item:one-sided:step:committing}; Let $\mathsf{st}_C$ (resp.\ $\mathsf{st}_R$) denote the state of the honest committer (resp.\ receiver) at the end of \Cref{item:one-sided:step:committing}; Let $\tilde{\tau}=(\tilde{\beta}, \tilde{\mathsf{com}})$\footnote{Recall that $\tilde{\beta}$ and  $\tilde{\mathsf{com}}$ are the \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} messages in the right session; They constitute an execution of Naor's commitment.} and ${\tau}=({\beta}, {\mathsf{com}})$. In terms of notation, we denote the execution of this stage by 
\begin{equation}\label[Expression]{expression:hybrid:H:prefix}
(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})\gets H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z).
\end{equation}
We will call the tuple $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ the {\em prefix} and denote it by $\mathsf{pref}$. It is worth noting that this $\mathsf{pref}$ contains all the information such that a PPT machine can ``complete'' the remaining execution of $H^{\mathcal{M}}(\lambda, m, z)$ starting from $\mathsf{pref}$.

\item \label[Stage]{stage:hybrid:H:remainder}
{\bf The Remainder:}
Next, it simply resumes from where the {\bf Prefix Generation} stage stops, to finish the remaining steps of the man-in-the-middle execution $H^{\mathcal{M}}(\lambda, m, z)$.

\subpara{Notation:} We introduce the following notations to describe this stage. Define a PPT machine $\ensuremath{\mathcal{A}}\xspace$ that takes as input $(\mathsf{st}_{\mathcal{M}}, \tilde{\tau})$; Machine $\mathcal{A}$ is supposed to run the residual strategy of $\mathcal{M}$ starting from $\mathsf{st}_{\mathcal{M}}$. Also, define a PPT machine $\mathcal{B}$ that takes as input $(\mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$; Machine $\mathcal{B}$ is supposed to run the residual strategies of the honest committer $C$ and receiver $R$, starting from 
$\mathsf{st}_C$ and $\mathsf{st}_R$ respectively\footnote{Note that it is actually redundant to give $\tilde{\tau}$ as common input to these parties---It can be included in $\mathsf{st}_{\mathcal{M}}$ and $\mathsf{st}_R$. We choose to make $\tilde{\tau}$ explicit for notational convenience.}. With the above notations, we can denote the execution of the remaining steps of $H^{\mathcal{M}}(\lambda, m,z)$ by
\begin{equation}\label[Expression]{expression:hybrid:H:remainder}
(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b)\gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau}),
\end{equation}
where $\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}$ is the output of $\mathcal{A}$, and $b \in \Set{\bot, \top}$ is the output of the honest receiver $R$ (in the right), indicating if the man-in-the-middle's commitment (i.e., the right session) is accepted ($b = \top$) or not ($b = \bot$). (We remark that $\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace$ is nothing but the man-in-the-middle $\mathcal{M}$'s final output.)

\item
{\bf Output:} It outputs the tuple $(\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace, \tilde{\tau}, b)$.  
\end{enumerate}
\end{AlgorithmBox}

We claim the following lemma regarding \Cref{hybrid:H:reinterpretation}.
\begin{lemma}\label{lem:small-tag:proof:se}
Let $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, $\mathcal{A}$, $\mathcal{B}$ be as defined in \Cref{hybrid:H:reinterpretation}.
There exists a PPT machine $\mathcal{SE}$ (the simulation-extractor) such that for any $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, any noticeable $\epsilon(\lambda)$, it holds that
\begin{align*}
& \big\{ (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) : (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_{R},\tau, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon(\lambda)} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, \mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} 
\end{align*}
\end{lemma}
\begin{remark}
The third output $b_{\mathcal{SE}}$ of $\mathcal{SE}$ is redundant in the above lemma. We include it in the output of $\mathcal{SE}$ for convenience in the proof of this lemma in \Cref{lem:small-tag:proof:se:proof}.
\end{remark}

\Cref{lem:small-tag:proof:se} is the main technical lemma for the current proof of \Cref{lem:one-sided:proof:core}. We present its proof in \Cref{lem:small-tag:proof:se:proof}. In the following, we finish the proof of \Cref{lem:one-sided:proof:core}  assuming that \Cref{lem:small-tag:proof:se} is true.



Now, we are ready to present the description of $G$ as required by \Cref{lem:one-sided:proof:core}.
\begin{AlgorithmBox}[label={hybrid:G}]{Hybrid \textnormal{${G}^{\mathcal{M}}(\lambda, m, z)$}}
This hybrid proceeds as follows:
\begin{enumerate}
\item
{\bf Prefix Generation:}
This stage is identical to \Cref{hybrid:H:reinterpretation:1} of $H^{\mathcal{M}}(\lambda, m, z)$. Formally, it executes 
$$(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau}) \gets H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z),$$
where $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ is defined in \Cref{hybrid:H:reinterpretation:1} of \Cref{hybrid:H:reinterpretation}.
\item
{\bf The Remainder:}
Define $\mathcal{A}$ in the same way as in \Cref{stage:hybrid:H:remainder} of $H^{\mathcal{M}}(\lambda, m, z)$. With this $\mathcal{A}$  and the $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_R, \tau,\tilde{\tau})$ from the previous stage, ${G}^{\mathcal{M}}(\lambda, m, z)$ invokes the $\mathcal{SE}$ prescribed in \Cref{lem:small-tag:proof:se}. Formally, it executes the following procedure:
$$(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\delta^{-1}},\mathsf{st}_R,\tau,\tilde{\tau}),$$
where the $\delta$ is the statistical distance that we want to show for \Cref{item:lem:one-sided:proof:core:2} of \Cref{lem:one-sided:proof:core}.

\begin{remark}
We emphasize that in this stage, ${G}^{\mathcal{M}}(\lambda, m, z)$ does {\em not} make use of $\mathsf{st}_C$.
\end{remark}
\item
{\bf Output:}
It outputs $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}})$.\footnote{Note that $b_{\mathcal{SE}}$ is not included in the output of $G$. Indeed, $b_{\mathcal{SE}}$ is not important for the current machine $G^{\mathcal{M}}(\lambda, m, z)$. We choose to include it in the output of $\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\delta^{-1}},\mathsf{st}_R,\tilde{\tau})$ only for notational convenience when we define/prove properties about $\mathcal{SE}$ itself.}
\end{enumerate}
\end{AlgorithmBox}

\para{Proving \Cref{item:lem:one-sided:proof:core:1} of \Cref{lem:one-sided:proof:core}.} Observe that hybrid $G^{\mathcal{M}}(\lambda, m, z)$ is an efficient machine because both $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ and $\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\delta^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})$ are efficient. Moreover, it does not rewind \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the man-in-the-middle execution, and $\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\delta^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})$ does {\em not} need to know $\mathsf{st}_C$. Therefore, \Cref{item:lem:one-sided:proof:core:1} of \Cref{lem:one-sided:proof:core} follows immediately from the computationally-hiding property of the left Naor's commitment (i.e., \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} in the left session). 

\para{Proving \Cref{item:lem:one-sided:proof:core:2} of \Cref{lem:one-sided:proof:core}.} First, observe that the distribution of the prefix $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ is identical in $G^{\mathcal{M}}(\lambda, m, z)$ and $H^{\mathcal{M}}(\lambda, m, z)$.
For each fixed prefix, \Cref{lem:small-tag:proof:se} implies that $G^{\mathcal{M}}(\lambda, m, z)$ and $H^{\mathcal{M}}(\lambda, m, z)$ are $\delta(\lambda)$-computationally indistinguishable where we remark that $G^{\mathcal{M}}(\lambda, m, z)$ runs $\mathcal{SE}$ with the second input $1^{\delta^{-1}}$. 
This immediately implies \Cref{item:lem:one-sided:proof:core:2} of \Cref{lem:one-sided:proof:core}. 


\subsection{Proof of \Cref{lem:small-tag:proof:se}}
\label{lem:small-tag:proof:se:proof}

\begin{figure}[!h]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=1]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:H:re-interpretation}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=2]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:G1}
     \end{subfigure}
     \caption{Machines $H^{\mathcal{M}}$ and $\mathcal{G}_1$ {\scriptsize (Difference is highlighted in red color)}}
     \label{figure:one-sided:games:M:G1}
\end{figure}


Now, we prove \Cref{lem:small-tag:proof:se} by constructing the required machine $\mathcal{SE}$. Our machine $\mathcal{SE}$ (for \Cref{lem:small-tag:proof:se}) will make use of two machines: (1) a $\mathcal{G}_1$ that simulates the main-thread, and (2) an extractor $\mathcal{K}$ that extracts the value committed in $\tilde{\tau}$. 
Thus, in the following, we will first define these two machines, and then present the description of $\mathcal{SE}$ in \Cref{machine:se}.

First, we describe a machine $\mathcal{G}_1$ that simulates the real execution {\em without using $\mathsf{st}_C$}.   

\para{Machine $\mathcal{G}_1$:} (Illustrated in \Cref{figure:one-sided:G1}\label{pageref:one-sided:proof:G1}) For any prefix $\mathsf{pref}$, $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to \Cref{stage:hybrid:H:remainder} of $H^{\mathcal{M}}(\lambda, m, z)$ shown in \Cref{hybrid:H:reinterpretation} (and depicted in \Cref{figure:one-sided:H:re-interpretation}), except for the following difference: Instead of executing the left {\bf WIPoK-1} honestly, it uses the witness-extended emulator $\mathcal{WE}$ (as per \Cref{def:WEE}) of the left {\bf WIPoK-1} to extract a witness,
and

\begin{itemize}
\item
 If the left committer accepts the left {\bf WIPoK-1} and the extracted witness is valid (i.e., it is a $(j, x_j)$ pair such that $y_j = f(x_j)$ for some $j \in [t]$), $\mathcal{G}_1$ uses $(j, x_j)$ to finish the left {\bf WIPoK-2}. Similarly to $H^{\mathcal{M}}(\lambda, m, z)$, $\mathcal{G}_1$ eventually outputs $\mathcal{M}$'s final state and the right receiver's decision bit $b$; 
 \item
 If the left committer accepts the left {\bf WIPoK-1}  but the extracted witness is invalid, it aborts immediately and outputs $(\bot, \bot)$.
 \item If the left committer rejects the left {\bf WIPoK-1}, it runs the rest of execution of $H^{\mathcal{M}}(\lambda, m, z)$ to output $\mathcal{M}$'s final state and the right receiver's decision bit $b$.  Note that it does not need to run the left {\bf WIPoK-2} in this case since the left committer aborts after the left {\bf WIPoK-1}.
\end{itemize}
We denote the above procedure by $(\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$. 
It is worth noting that $\mathcal{G}_1$ does {\em not} need to know $\mathsf{st}_C$.

\begin{remark}[Precise Meaning of Extraction]\label{rem:meaning_extraction}
In the above description of $\mathcal{G}_1$, we say that ``it uses the witness-extended emulator of the left {\bf WIPoK-1} to extract a witness". 
More accurately, this means the following: We consider a cheating prover against the left {\bf WIPoK-1} that takes as advice the states of $\mathcal{M}$ and the right receiver right before the start of the left {\bf WIPoK-1}, interacts with the left committer by simulating $\mathcal{M}$ and the right receiver, and outputs the states of $\mathcal{M}$ and the right receiver at the end of the left {\bf WIPoK-1}. Machine $\mathcal{G}_1$ runs the witness-extended emulator of the left {\bf WIPoK-1} (as per \Cref{def:WEE}) w.r.t. the this cheating prover to simulate the states of $\mathcal{M}$ and the right receiver right at the end of the left {\bf WIPoK-1}, the decision bit of the left {\bf WIPoK-1} of the left committer, while extracting a (candidate of) witness of $\ensuremath{\mathcal{L}}\xspace_f^t$.  
We will use similar convention many times throughout this paper. 
\end{remark}



Next, we prove a lemma that shows that  $\mathcal{G}_1$ simulates the real MIM execution. 
\begin{lemma}\label{lem:main-thread:sim:real}
For the $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, $\mathcal{A}$, and $\mathcal{B}$ defined in \Cref{hybrid:H:reinterpretation}, for any $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, it holds that
\begin{align*}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b \big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, ~b\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}. 
\end{align*}
\end{lemma}
\begin{proof}
We first define a hybrid machine $\mathcal{G}'_1$ below.
\begin{figure}[!h]
\centering
\fbox{
     \includegraphics[width=0.55\textwidth,page=3]{figures/figures-new.pdf}
     }
     \caption{Machine $\mathcal{G}'_1$ {\scriptsize (Difference with $\mathcal{G}_1$ is highlighted in red color)}}
     \label{figure:one-sided:G'1}
\end{figure}

\para{Machine $\mathcal{G}'_1$:} (Illustrated in \Cref{figure:one-sided:G'1}\label{pageref:one-sided:proof:G'1}) For any prefix $\mathsf{pref}$, $\mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it uses $(m,r)$ as the witness in the left {\bf WIPoK-2} even if it succeeds in extracting a valid witness from the left {\bf WIPoK-1}.

By the WI property of the left {\bf WIPoK-2}, it holds that 
\begin{align} 
\begin{split}\label{eq:G1_to_G'1}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}
\end{split}.
\end{align}

Note that the only difference between $\mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ and $\langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})$ is that the former runs the witness-extended emulator of the left {\bf WIPoK-1} (but does not use the extracted witness at all). Thus, by the PoK property of the left {\bf WIPoK-1}, it holds that 
\begin{align} 
\begin{split}\label{eq:G'1_to_real}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, ~b\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\end{split}.
\end{align}

By combining \Cref{eq:G1_to_G'1,eq:G'1_to_real}, we obtain \Cref{lem:main-thread:sim:real}. 

\end{proof}

Next, we define the probability of $R$ being convinced in the execution of $\mathcal{G}_1$. This value plays an important role later in our proof.
\begin{definition}\label{def:p-sim-pref}
For any $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, we define the following value $p^{\mathsf{Sim}}_{\mathsf{pref}}$:
$$p^{\mathsf{Sim}}_{\mathsf{pref}} \coloneqq \Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_\mathcal{M}, \mathsf{st}_R, \tau,\tilde{\tau})].$$
\end{definition}

Next, we show a technical lemma that gives an extractor $\mathcal{K}$ {\em without the simulation property}. 
\begin{lemma}\label{lem:small-tag:proof:se:proof:K}
Let $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, $\mathcal{A}$, and $\mathcal{B}$ be as defined in \Cref{hybrid:H:reinterpretation}. There exists an expected PPT machine $\mathcal{K}$ such that for any $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ and any noticeable $\epsilon(\lambda)$, the following holds:
\begin{enumerate}
\item \label[Property]{property:small-tag:proof:se:proof:K:syntax}
{\bf (Syntax.)} $\mathcal{K}$ takes as input $(1^\lambda, \mathsf{st}_R, \tau,\tilde{\tau})$ and makes oracle access to $\ensuremath{\mathcal{A}}\xspace(\mathsf{st}_{\mathcal{M}})$. It outputs a value $\mathsf{Val}_{\mathcal{K}} \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \cup \Set{\bot}$ such that $\mathsf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val}_{\mathcal{K}} \ne \bot$.
(Also see \Cref{rmk:small-tag:proof:se:proof:K:output} for an intuitive explanation.)

\item \label[Property]{property:small-tag:proof:se:proof:K}
If $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, then it holds that
$$\Pr[\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau}) : \msf{Val}_{\mathcal{K}} \gets \mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau,\tilde{\tau})] \ge \frac{\epsilon'(\lambda)}{\tilde{t}},$$
where  $\epsilon'(\lambda) \coloneqq \frac{\epsilon(\lambda)}{10t^2}$.
\end{enumerate}

\end{lemma}
\begin{remark}[On the Output of $\mathcal{K}$]
\label{rmk:small-tag:proof:se:proof:K:output}
The output $\mathsf{Val}_{\mathcal{K}}$ is expected to be the value committed in $\tilde{\tau}$, i.e., $\mathsf{val}(\tilde{\tau})$. If $\mathsf{Val}_{\mathcal{K}} = \bot$, it indicates that $\mathcal{K}$ did not extract the correct $\mathsf{val}(\tilde{\tau})$. We explicitly include $\bot$ in the range of $\mathcal{K}$ for the following purpose: Looking ahead, the simulation-extractor $\mathcal{SE}$ that we are going to build will invoke $\mathcal{K}$ for several times, until the value $\mathsf{val}(\tilde{\tau})$ is extracted. However, $\mathcal{SE}$ cannot tell if the extracted value is indeed $\mathsf{val}(\tilde{\tau})$. Thus, the case $\mathsf{Val}_{\mathcal{K}} = \bot$ serves as an indicator, telling $\mathcal{SE}$ if the extraction by $\mathcal{K}$ succeeds (more accurately, fails). 

As a vigilant reader may have already realized, there is an alternative formalism: simply ask $\mathcal{K}$ to output both $\mathsf{val}(\tau)$ {\em and the decommitment information} so that $\mathcal{SE}$ can test by itself whether $\mathcal{K}$'s extraction is successful. We remark that this approach does work for the current proof {\em in classical setting}. However, it may not extend when we prove {\em post-quantum} non-malleability. In short, that is because to make this proof work in the quantum setting, our technique requires that the valid output of $\mathcal{K}$ should be {\em unique}; Only in this way can we ask $\mathcal{K}$ to ``forget'' other information, such that the extraction procedure can be ``un-computed'' to rewind $\mathcal{M}$ back without much disturbance to its initial state. (This point will become clearer in the proof of \Cref{lem:extract_and_simulate}.) However, if we include the decommitment information in the output of $\mathcal{K}$, then the valid output may not be unique, even if the commitment scheme is perfect-binding---There could exists different ways to decommit to the {\em unique} committed value.

To make the proof consistent in both classical and quantum settings, we choose the current formalism in \Cref{property:small-tag:proof:se:proof:K:syntax}.
\end{remark}

We will prove \Cref{lem:small-tag:proof:se:proof:K} in \Cref{sec:lem:small-tag:proof:se:proof:K:proof}.
In the rest of this subsection, we finish the proof of \Cref{lem:small-tag:proof:se} assuming \Cref{lem:small-tag:proof:se:proof:K} is true.

We present the description of $\mathcal{SE}$ (for \Cref{lem:small-tag:proof:se}) in \Cref{machine:se}.
\begin{AlgorithmBox}[label={machine:se}]{Simulation-Extractor \textnormal{$\mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R, \tau, \tilde{\tau})$}}
Let $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, $\mathcal{A}$, and $\mathcal{B}$ be as defined in \Cref{hybrid:H:reinterpretation}. Let $\epsilon(\lambda)$ be a noticeable function. For $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, machine $\mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}}, \mathsf{st}_R,\tau,\tilde{\tau})$ proceeds as follows:
\begin{enumerate}
\item\label[Stage]{stage:machine:se:main-thread-sim}
{\bf Main-Thread Simulation.} It first uses the machine $\mathcal{G}_1$ to simulate \Cref{stage:hybrid:H:remainder} of $H^{\mathcal{M}}(\lambda, m, z)$. That is, it computes $(\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_{R}, \tau,\tilde{\tau})$. It sets $\mathsf{OUT}_{\mathcal{SE}} \coloneqq \ensuremath{\mathsf{OUT}}\xspace$ and $b_{\mathcal{SE}} \coloneqq b$. Then, 
\begin{itemize}
\item
if $b_{\mathcal{SE}} = \bot$, it sets $\mathsf{Val}_{\mathcal{SE}} \coloneqq \bot$ and jumps directly to \Cref{machine:se:output}; 
\item
otherwise, it goes to the next step.
\end{itemize}

\item \label[Stage]{stage:machine:se:rewinding}
{\bf Rewinding:} $\mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R, \tau, \tilde{\tau})$ then loops the following procedure for $\frac{\tilde{t}}{\epsilon'(\lambda)} \cdot \lambda$ times, where $\epsilon'(\lambda) \coloneqq \frac{\epsilon(\lambda)}{10t^2}$:  
\begin{itemize}
\item
Execute $\msf{Val}_{\mathcal{K}} \gets \mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau,\tilde{\tau})$, where $\mathcal{K}$ is provided by  \Cref{lem:small-tag:proof:se:proof:K}.  If $\msf{Val}_{\mathcal{K}} \ne \bot$,\footnote{Note that by \Cref{property:small-tag:proof:se:proof:K:syntax} in \Cref{lem:small-tag:proof:se:proof:K}, this means $\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$.} set $\msf{Val}_{\mathcal{SE}} \coloneqq \msf{Val}_{\mathcal{K}}$ and jump to \Cref{machine:se:output}; Otherwise, go to the next loop.
\end{itemize}

\item
It sets $\mathsf{Val}_{\mathcal{SE}} = \bot$. (Note that if this stage is reached, it means that the number of the loop in the previous stage reached its upper bound $\frac{\tilde{t}}{\epsilon'(\lambda)} \cdot \lambda$, but $\mathcal{K}$ did not extract the message committed in $\tilde{\tau}$ yet.)



\item \label[Stage]{machine:se:output}
{\bf Output:} it outputs $(\mathsf{OUT}_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}})$.
\end{enumerate}
\end{AlgorithmBox}

We first prove that the simulated main-thread is computationally indistinguishable from the real one. 
\begin{MyClaim}\label{claim:proof:SE:simulated-main-thread}
Let $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$, $\mathcal{A}$, $\mathcal{B}$ be as defined in \Cref{hybrid:H:reinterpretation}. For any $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ and any noticeable $\epsilon(\lambda)$, it holds that
\begin{align*}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \big): (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}}, \mathsf{st}_R, \tau,\tilde{\tau})\big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, \mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}. \numberthis \label{claim:proof:SE:simulated-main-thread:eq}
\end{align*}
\end{MyClaim}
\begin{proof}
Since we consider each fixed prefix, we can efficiently compute $\mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau})$ and $\mathsf{val}_{b}(\tilde{\tau})$ from $b_{\mathcal{SE}}$ and $b$, respectively, by using $\mathsf{val}(\tilde{\tau})$ as a non-uniform advice\footnote{Note that this is possible because both the LHS and the RHS of \Cref{claim:proof:SE:simulated-main-thread:eq} use the same {\em fixed} $\tilde{\tau}$, which does not depend on the randomness of the ensembles.}. 
Then, it suffices to prove 
\begin{align*}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, b_{\mathcal{SE}}\big): (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}}, \mathsf{st}_R, \tau,\tilde{\tau})\big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}. 
\end{align*}
Since $\mathcal{SE}$ just runs $\mathcal{G}_1$ in the main thread, the above follows directly from \Cref{lem:main-thread:sim:real}. 

\if0
\begin{xiaoenv}{Proving \Cref{claim:proof:SE:simulated-main-thread}}
Todo: This is simple to prove: 
\begin{itemize}
\item
First, note that it follows from \Cref{lem:main-thread:sim:real} that $\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{SE}, ~b_{\mathcal{SE}}, ~\mathsf{val}(\tilde{\tau})\big) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, ~b, ~\mathsf{val}(\tilde{\tau})\big) \big\}$;
\item
Then, it follows straightforwardly that $\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{SE}, \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau})\big) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, \mathsf{val}_b(\tilde{\tau})\big) \big\}$.
\end{itemize}
\end{xiaoenv}
\fi
\end{proof}

Given \Cref{claim:proof:SE:simulated-main-thread}, to prove \Cref{lem:small-tag:proof:se}, it suffices to show the following inequality:
\begin{equation}\label[Inequality]{eq:one-sided:proof:se:itself}
\Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}): (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})] \le \epsilon(\lambda) + \mathsf{negl}(\lambda).
\end{equation}
To prove \Cref{eq:one-sided:proof:se:itself}, let us first define two events:
\begin{itemize}
\item
{\bf Event $E_{\le \epsilon}$:}\footnote{We remark that this event actually does not depend on the random procedure $\mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R, \tau, \tilde{\tau})$. It is only about the property of the prefix $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ given as input to machine $\mathcal{SE}$.} This is the event that the prefix $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ lead to an accepting execution of $\mathcal{SE}$ with probability at most $\epsilon$. Formally, it denotes the event that $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ satisfies the following inequality:
$$\Pr[b_{\mathcal{SE}} = \top : (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})] \le \epsilon(\lambda).$$

\begin{remark}\label{rmk:p-sim-pref:alternative}
We emphasize that the above probability (on the LHS) is exactly the $p^{\mathsf{Sim}}_{\mathsf{pref}}$ defined in \Cref{def:p-sim-pref}, because $\mathcal{SE}$ obtains $b_{\mathcal{SE}}$ by running $\mathcal{G}_1$ (see \Cref{stage:machine:se:main-thread-sim} of \Cref{machine:se}).
\end{remark}

\item
{\bf Event $E_{\mathsf{acc}}$:} This is the event that $b_{\mathcal{SE}} = \top$ at the end of the execution of $\mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})$. Namely, it means that the honest receiver $R$  accepts in the execution simulated by $\mathcal{SE}$. (The subscript ``$\mathsf{acc}$'' stands for ``accept'').
\end{itemize}
We first show that the the probability of $(E_{\mathsf{acc}} \wedge E_{\le \epsilon})$ is upper-bounded by $\epsilon(\lambda)$. 

\begin{MyClaim}\label{claim:bounding-E1E2}
It holds that
$$\Pr[E_{\mathsf{acc}} \wedge E_{\le \epsilon}:(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})]  \le \epsilon(\lambda).$$
\end{MyClaim}
\begin{proof}
This is an immediate result of the definitions of these two events. In more details,
\begin{equation}\label[Inequality]{eq:bounding-E1E2}
\Pr[E_{\mathsf{acc}} \wedge E_{\le \epsilon}] 
= \Pr[E_{\mathsf{acc}} ~|~ E_{\le \epsilon}] \cdot \Pr[E_{\le \epsilon}] 
 \le \Pr[E_{\mathsf{acc}} ~|~ E_{\le \epsilon}] \cdot 1 = \epsilon(\lambda) \cdot 1,	
\end{equation}
where all the probabilities are taken over $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})$.

\end{proof}

Next, we upper-bound the LHS of \Cref{eq:one-sided:proof:se:itself} by $\epsilon(\lambda)+\Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau})~|~E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}]$:

\begin{MyClaim}\label{bound:Val-ne-m}
It holds that	
$$\Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau})] \le \epsilon(\lambda) + \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau})~|~E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}],$$ where both  probabilities are taken over  $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})$.
\end{MyClaim}
\begin{proof}
All the probabilities below are taken over  $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})$: 
\begin{align*}
\Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau})] 
& = \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \wedge E_{\mathsf{acc}}] + \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \wedge \neg E_{\mathsf{acc}}]	\\
& = \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \wedge E_{\mathsf{acc}}] \numberthis \label{bound:Val-ne-m:step:1}	\\
& = \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \wedge E_{\mathsf{acc}} \wedge E_{\le \epsilon}] +\Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \wedge E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}]	\\
& \le \Pr[ E_{\mathsf{acc}} \wedge E_{\le \epsilon}] +  \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \wedge E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}]\\
& \le \epsilon(\lambda) +  \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) \wedge E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}] \numberthis \label[Inequality]{bound:Val-ne-m:step:2}\\
&\le \epsilon(\lambda) +  \Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) ~|
~ E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}],
\end{align*}
where \Cref{bound:Val-ne-m:step:1} follows from the fact that if $b_{\mathcal{SE}} = \bot$ then $\msf{Val}_{\mathcal{SE}} =\mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) = \bot$, and \Cref{bound:Val-ne-m:step:2} follows from \Cref{claim:bounding-E1E2}.

\end{proof}

Recall that our goal is to establish \Cref{eq:one-sided:proof:se:itself}. Due to \Cref{bound:Val-ne-m}, it  now suffices to show 
\begin{equation}\label{bad:conditioned:E1-nE2}
\Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) ~|
~ E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}] = \mathsf{negl}(\lambda),
\end{equation}
where the probability is taken over ${(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})}$.

\begin{proof}[Proof of \Cref{bad:conditioned:E1-nE2}]
Given $E_{\mathsf{acc}}$ (i.e., $b_{\mathcal{SE}} = \top$), we know that $\mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})$ must have entered \Cref{stage:machine:se:rewinding} to execute the machine $\mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})$ for at most $\frac{\tilde{t}}{\epsilon'(\lambda)} \cdot \lambda$ times, with early termination only if the event $\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ happens (recall that $\mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) = \mathsf{val}(\tilde{\tau})$ when $b_{\mathcal{SE}} = \top$).

Given $\neg E_{\le \epsilon}$ (thus, $p^{\mathsf{Sim}}_{\mathsf{pref}} > \epsilon(\lambda)$, see \Cref{rmk:p-sim-pref:alternative}), it follows from \Cref{property:small-tag:proof:se:proof:K} in \Cref{lem:small-tag:proof:se:proof:K} that each time $\mathcal{K}$ is invoked, it outputs $\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ with probability $\ge \epsilon'(\lambda)/\tilde{t}$.

Therefore, we have 
\begin{equation*}
\Pr[\msf{Val}_{\mathcal{SE}} \ne  \mathsf{val}_{b_{\mathcal{SE}}}(\tilde{\tau}) ~|
~ E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}] = \bigg(1 - \frac{\epsilon'(\lambda)}{\tilde{t}}\bigg)^{\frac{\tilde{t}}{\epsilon'(\lambda)}\cdot \lambda} = 2^{-O(\lambda)} = \mathsf{negl}(\lambda),
\end{equation*}
where the probability is taken over ${(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \msf{Val}_{\mathcal{SE}}, b_{\mathcal{SE}}) \gets \mathcal{SE}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda,1^{\epsilon^{-1}},\mathsf{st}_R,\tau,\tilde{\tau})}$.

This finishes the proof of \Cref{bad:conditioned:E1-nE2}.

\end{proof} 
This eventually finishes the proof of \Cref{lem:small-tag:proof:se} (modulo the proof of \Cref{lem:small-tag:proof:se:proof:K}, which we present in \Cref{sec:lem:small-tag:proof:se:proof:K:proof}
). 


\subsection{Extractor $\mathcal{K}$ (Proof of \Cref{lem:small-tag:proof:se:proof:K})}
\label{sec:lem:small-tag:proof:se:proof:K:proof}


\para{Machine $\mathcal{G}_{i}$ ($i \in [\tilde{t}]$):\label{machine:Gi:new}} (Illustrated in \Cref{figure:one-sided:Gi}.)
Recall that we have already defined the machine $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ on \Cpageref{pageref:one-sided:proof:G1}. Now, for $i \in [\tilde{t}] \setminus \Set{1}$, $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it uses $(i, \tilde{x}_i)$ as the witness in the right {\bf WIPoK-1}.


\begin{MyClaim}\label{claim:bound:Gi:new}  
$\forall i \in [\tilde{t}], ~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
We define hybrid machines $\mathcal{G}'_i$ and $\mathcal{G}''_i$ as follows.

\para{Machine $\mathcal{G}'_{i}$ ($i \in [\tilde{t}]$):\label{machine:G'i:new}} (Illustrated in \Cref{figure:one-sided:G'i}.)
Recall that we have already defined the machine $\mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ on \Cpageref{pageref:one-sided:proof:G'1}. Now, for $i \in [\tilde{t}] \setminus \Set{1}$, $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it uses $(i, \tilde{x}_i)$ as the witness in the right {\bf WIPoK-1}.

\para{Machine $\mathcal{G}''_i$ ($i \in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:G''i}\label{pageref:one-sided:proof:G''1}) For any prefix $\mathsf{pref}$, $\mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it honestly runs the left {\bf WIPoK-1}, instead of running the witness-extended emulator $\mathcal{WE}$. In other words, $\mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})$ except that it uses $(i,\tilde{x}_i)$ as the witness in the right {\bf WIPoK-1}. 
In particular, $\mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ is identical to $\langle \mathcal{A}(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})$. 

Then, \Cref{claim:bound:Gi:new} follows from the following sequence of inequalities. 
\begin{itemize}
\item
By the  WI property of the left {\bf WIPoK-2} and the definition of $p^{\mathsf{Sim}}_{\mathsf{pref}}$ (\Cref{def:p-sim-pref}), it holds that:
$$\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda).$$
\item
By the PoK property (per \Cref{def:WEE}) of the left {\bf WIPoK-1} and the above inequality, it holds that:
$$\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda).$$
\item
By the WI property of the right {\bf WIPoK-1} and the above inequality, it holds that:
$$\forall i \in [\tilde{t}],~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda).$$
\item
By the PoK property of the left {\bf WIPoK-1} and the above inequality, it holds that:
$$\forall i \in [\tilde{t}],~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda).$$
\item
By the  WI property of the left {\bf WIPoK-2} and the above inequality, it holds that:
$$\forall i \in [\tilde{t}],~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda).$$
\end{itemize}
This finishes the proof of \Cref{claim:bound:Gi:new}.

\end{proof}



\begin{figure}[!tb]
\centering
\fbox{
     \includegraphics[width=0.55\textwidth,page=4]{figures/figures-new.pdf}
     }
     \caption{Machine $\mathcal{G}_i$ {\scriptsize (Difference with $\mathcal{G}_1$ is highlighted in red color)}}
     \label{figure:one-sided:Gi}
\end{figure}

\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=5]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:G'i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=6]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:G''i}
     \end{subfigure}
     \caption{Machines $\mathcal{G}'_i$ and $\mathcal{G}''_i$ {\scriptsize (Difference is highlighted in red color)}}
     \label{figure:one-sided:hybrid:G'i:G''i}
\end{figure}


\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=7]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:Ki}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=8]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:K}
     \end{subfigure}
     \caption{Machines $\mathcal{K}_i$ and $\mathcal{K}$ {\scriptsize (Difference is highlighted in red color)}}
     \label{figure:one-sided:hybrid:Ki:K}
\end{figure}

\para{Machine $\mathcal{K}_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:Ki}.) For a prefix $\mathsf{pref}$, $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ 
behaves identically to the $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ depicted in \Cref{figure:one-sided:Gi}, except for the following difference. Machine $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ uses the witness-extended emulator $\mathcal{WE}$ (as per \Cref{def:WEE}) to finish the right {\bf WIPoK-2}, instead of playing the role of the honest receiver. 

\subpara{$\mathcal{K}_i$'s Output:\label{subpara:K-i:output}} Let $w'$ denote the third output of the witness-extended emulator $\mathcal{WE}$ (see \Cref{def:WEE}), which is supposed to be the witness used by $\mathcal{M}$ in the right {\bf WIPoK-2} (for the statement $(\tilde{\mathsf{com}}, \tilde{Y}$) w.r.t.\ the language $\ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}\vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$). Depending on the value of $w'$, we define a value $\mathsf{Val} \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \cup \Set{\bot_{\tilde{Y}}, \bot_{\mathsf{invalid}}}$ as follows:
\begin{enumerate}
\item \label[Case]{K-i:output:case:1}
If $w'$ is a valid witness for $(\tilde{\mathsf{com}}, \tilde{Y}) \in \ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}\vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$, then there are tow sub-cases:
\begin{enumerate}
\item \label[Case]{K-i:output:case:1a}
$w'$ is a valid witness for $\tilde{\mathsf{com}} \in \ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}$. In this case\footnote{Technically, we should argue that $\mathcal{K}_i$ is able to detect if this case is happening. This is easy to do as we explicitly give $\tilde{\tau}$ as an input to $\mathcal{K}_i$---Upon obtaining $w'$, it can just re-execute Naor's commitment by itself to see if $w'$ is consistent with $\tilde{\tau}$.}, $w'$ consists of the value $\mathsf{val}(\tilde{\tau})$, i.e., the value committed in $\tilde{\tau}=(\tilde{\beta}, \tilde{\mathsf{com}})$, {\em and} the randomness $\tilde{r}$. We set $\mathsf{Val} \coloneqq \mathsf{val}(\tilde{\tau})$. Importantly, notice that we do {\em not} include the randomness $\tilde{r}$ in $\mathsf{Val}$ (as explained in \Cref{rmk:small-tag:proof:se:proof:K:output}.). 
\item \label[Case]{K-i:output:case:1b}
$w'$ is a valid witness for $\tilde{Y} \in \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$: In this case, we set $\mathsf{Val} \coloneqq \bot_{\tilde{Y}}$.
\end{enumerate}

\item \label[Case]{K-i:output:case:2}
Otherwise, set $\mathsf{Val} \coloneqq \bot_{\mathsf{invalid}}$.
\end{enumerate}
The output of $\mathcal{K}_i$ is defined to be the above $\mathsf{Val}$. Notice that this is in contrast to all previous machines, for which the output is defined to be the man-in-the-middle $\mathcal{M}$'s output and the honest receiver's decision bit. We emphasize that such a $\mathsf{Val}$ satisfies the syntax requirement in \Cref{property:small-tag:proof:se:proof:K:syntax} of \Cref{lem:small-tag:proof:se:proof:K}. In particular, {\em $\mathsf{Val} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val} \ne \bot$}.\footnote{Note that here we defined two types of abortion: $\bot_{\tilde{Y}}$ and $\bot_{\mathsf{invalid}}$, while \Cref{property:small-tag:proof:se:proof:K:syntax} of \Cref{lem:small-tag:proof:se:proof:K} only allows a single abortion symbol $\bot$. We remark that this is only a cosmetic difference---It can be made consistent using the following rules: $\bot = \bot_{\tilde{Y}}$ {\em and} $\bot = \bot_{\mathsf{invalid}}$ (i.e., $\mathsf{Val} \ne \bot  \Leftrightarrow (\mathsf{Val} \ne \bot_{\tilde{Y}} \wedge \mathsf{Val} \ne \bot_{\mathsf{invalid}})$).}

\begin{MyClaim}\label{claim:bound:Ki}
$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows immediately from \Cref{claim:bound:Gi:new} and the PoK property (as per \Cref{def:WEE}) of the right {\bf WIPoK-2}. 

\end{proof}

Finally, we are ready to define the extractor $\mathcal{K}$ as required by \Cref{lem:small-tag:proof:se:proof:K}. Intuitively, $\mathcal{K}$ can be conceived as an average-case version of $\Set{\mathcal{K}_i}_{i\in[\tilde{t}]}$:

\para{Extractor $\mathcal{K}$:\label{extractorK:description}} (Illustrated in \Cref{figure:one-sided:K}.)  For a prefix $\mathsf{pref}$, $\mathcal{K}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ samples uniformly at random an index $i \ensuremath{\leftarrow}\xspace [\tilde{t}]$, executes $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$, and outputs whatever $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ outputs.

\begin{remark}[On the Notation of $\mathcal{K}$]\label{rmk:notation-K}
It is worth noting that in the above, we write machine $\mathcal{K}$ as $\mathcal{K}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$, while it was written in \Cref{lem:small-tag:proof:se:proof:K} as $\mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})$. This is only a cosmetic difference. 
\end{remark}

Next, we show that the extractor $\mathcal{K}$ satisfies the requirements in \Cref{lem:small-tag:proof:se:proof:K}.

\para{Running Time of $\mathcal{K}$.} Observe that for each $i \in [\tilde{t}]$, $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ differs from the real man-in-the-middle game only in the following places: 
\begin{itemize}
\item
$(i,\tilde{x}_i)$ is used in the right {\bf WIPoK-1};
\item
the witness-extended emulator $\mathcal{WE}$ is used in the right {\bf WIPoK-2} and the left {\bf WIPoK-1}; 
\item
the left {\bf WIPoK-2} is done using the  $(j, x_j)$ extracted by $\mathcal{WE}$ from the left {\bf WIPoK-1}.
\end{itemize}
Since the witness-extended emulator $\mathcal{WE}$ (as per \Cref{def:WEE}) runs in expected PPT, so does $\mathcal{K}_i$. Thus, $\mathcal{K}$ is expected PPT.

\para{Proving \Cref{property:small-tag:proof:se:proof:K:syntax} of \Cref{lem:small-tag:proof:se:proof:K}.} It is straightforward to see that the $\mathcal{K}$ defined above satisfies the syntax requirement in \Cref{lem:small-tag:proof:se:proof:K} (see also \Cref{rmk:notation-K}). In particular, we have $\mathsf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val}_{\mathcal{K}} \ne \bot$, because this is true for each $\mathcal{K}_i$ by definition (see the paragraph for ``\underline{$\mathcal{K}_i$'s Output}'' on \Cpageref{subpara:K-i:output}).


\para{Proving \Cref{property:small-tag:proof:se:proof:K} of \Cref{lem:small-tag:proof:se:proof:K}.} First, recall that \Cref{property:small-tag:proof:se:proof:K} requires us to show that 
for any $\mathsf{pref}$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ , if $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, then it holds that
\begin{equation}\label[Inequality]{eq:bound:averageK}
\Pr[\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau}) : \msf{Val}_{\mathcal{K}} \gets \mathcal{K}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \frac{\epsilon'(\lambda)}{\tilde{t}}.
\end{equation} 
Also recall that $\mathcal{K}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ is defined to execute the machine $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$  with  $i$ uniformly sampled from $[\tilde{t}]$. Therefore, \Cref{eq:bound:averageK} can be reduced to the following \Cref{lem:bound:Ki}. We will prove \Cref{lem:bound:Ki} in \Cref{sec:lem:bound:Ki:proof}, which will eventually finish the current proof of \Cref{lem:small-tag:proof:se:proof:K}.
\begin{lemma}\label{lem:bound:Ki}
Let $\epsilon(\lambda) = \frac{1}{\mathsf{poly}(\lambda)}$ and $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{t^2}$.
For any $\mathsf{pref} = (\mathsf{st}_{\mathcal{M}},\mathsf{st}_C, \mathsf{st}_R, \tau, \tilde{\tau})$, if $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, then there exists an $i \in [\tilde{t}]$ such that 
$$\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau}) :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \epsilon'(\lambda).$$
\end{lemma}


\subsection{Proof of \Cref{lem:bound:Ki}}
\label{sec:lem:bound:Ki:proof}

\para{Notation.} We highly recommend reviewing the ``\underline{$\mathcal{K}_i$'s Output}'' part on \Cpageref{subpara:K-i:output} (in particular, the meanings of $\mathsf{Val}$, $\bot_{\tilde{Y}}$, and $\bot_{\mathsf{invalid}}$) before starting to read this subsection.  Recall that $\mathcal{K}_i$'s output $\mathsf{Val}$ is determined by the $w'$ output by the witness-extended emulator of the right {\bf WIPoK-2}. 
In this subsection, we will need to refer to this $w'$, though it is not explicitly included as a part of $\mathcal{K}_i$'s output. Particularly, we will make use of the following notation: whenever we write an expression of the form 
 $$\Pr[\text{Some Event $E_{w'}$ about $w'$}: \mathsf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})],$$
it should be understood as the probability of $E_{w'}$, where $w'$ refers to the $w'$ generated during the random procedure $\mathsf{Val} \gets\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$, over which the probability is taken. 

Using these notations, we can partition the event $\mathsf{Val} = \bot_{\tilde{Y}}$ as the following {\em mutually exclusive} events: $w' = (1, \tilde{x}_1)$, $\ldots$, $w' =(\tilde{t}, \tilde{x}_{\tilde{t}})$, where $\tilde{y}_i = \tilde{f}(\tilde{x}_i)$ for each $i \in [\tilde{t}]$. Formally, we express this relation by 
\begin{equation}\label{eq:bot-tilde-Y:partition}
\Pr[\mathsf{Val} = \bot_{\tilde{Y}}: \mathsf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] = \sum_{i = 1}^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i): \mathsf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]
\end{equation}

With the above notations, we prove \Cref{lem:bound:Ki} in the following.

\para{Proof for \Cref{lem:bound:Ki}.} We assume for contradiction that for some $\mathsf{pref}$ satisfying $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, it holds that 
\begin{equation}\label[Inequality]{eq:proof:averageK:contra-assump}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau}) :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] < \epsilon'(\lambda).
\end{equation}
\begin{MyClaim}\label{cliam:bound:Ki-xi}
Under the assumption in \Cref{eq:proof:averageK:contra-assump}, it holds that 
$$\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i) :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof}
In this proof, all the probabilities are taken over the random procedure $\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$.

 First, notice that
\begin{align*}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot_{\mathsf{invlid}}] 
& = 
\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] +  \Pr[\msf{Val} = \bot_{\tilde{Y}}] \\
\text{(by \Cref{eq:bot-tilde-Y:partition})} ~& = 
\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] + \Pr[w' = (i, \tilde{x}_i)] + \sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j, \tilde{x}_j)]. \numberthis \label{eq:bound:Ki-xi:1}
\end{align*}
Then, the following holds:
{\begingroup\fontsize{10.5pt}{0pt}\selectfont
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i)] 
& = 
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}] - \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j, \tilde{x}_j)] \bigg)  \label{eq:bound:Ki-xi:derive:1} \\
& \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda) - \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j,\tilde{x}_j)] \bigg)  \label[Inequality]{eq:bound:Ki-xi:derive:2}\\
& \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda) - \epsilon'(\lambda) -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j,\tilde{x}_j)] \bigg),\label[Inequality]{eq:bound:Ki-xi:derive:3}
\end{align}\endgroup}where \Cref{eq:bound:Ki-xi:derive:1} follows from \Cref{eq:bound:Ki-xi:1}, \Cref{eq:bound:Ki-xi:derive:2} follows from \Cref{claim:bound:Ki}, and \Cref{eq:bound:Ki-xi:derive:3} follows from \Cref{eq:proof:averageK:contra-assump}.

Now, to prove \Cref{cliam:bound:Ki-xi}, it suffices to show that 


\begin{equation}
\forall i \in [\tilde{t}],~\forall j \in [\tilde{t}]\setminus \Set{i}, ~\Pr[w' = (j,\tilde{x}_j) : \msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] = \mathsf{negl}(\lambda).
\end{equation}
This can be reduced via standard techniques to the one-wayness of the OWF $\tilde{f}$ in \Cref{item:one-sided:step:OWFs} of the right execution. In more details, we assume for contradiction that there exist $i^*, j^* \in [\tilde{t}]$ such that $i^* \ne j^*$ and that the probability $\Pr[w' = (j^*, \tilde{x}_{j^*}) : \msf{Val} \gets \mathcal{K}_{i^*}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]$ is non-negligible, where, by definition, $\tilde{x}_{j^*}$ is the preimage of $\tilde{y}_{j^*}$ under the right OWF $\tilde{f}$. Then, we can build a PPT adversary $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ breaking one-wayness in the following way: $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ obtains the challenge $y^*$ from the external one-wayness challenger; it then runs the machine $\mathcal{K}_{i^*}(\mathsf{pref})$ internally, for which $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ uses $y^*$ in place of $\tilde{y}_{j^*}$ when executing \Cref{item:one-sided:step:OWFs} in the right. Note that the internal execution of $\mathcal{K}_{i^*}(\mathsf{pref})$ is identically to the real execution of $\mathcal{K}_{i^*}$, thus the extracted $w' =(j^*, \tilde{x}_{j^*})$ must satisfy $\tilde{f}(\tilde{x}_{j^*}) = \tilde{y}_j^*~(=y^*)$ with non-negligible probability, breaking one-wayness. 

This finishes the proof of \Cref{cliam:bound:Ki-xi}.

\end{proof}


\para{Machine $\mathcal{K}'_i$ ($i \in [\tilde{t}]$):\label{machineK':description}} (Illustrated in \Cref{figure:one-sided:K'i}.) For a prefix $\mathsf{pref}$, $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ proceeds as follows:
\begin{enumerate}
\item
It first finishes \Cref{item:one-sided:step:OWFs} of the man-in-the-middle execution in the same way as $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$. In particular, it will see in the left execution the values $Y = (y_1, \ldots, y_t)$ sent from $\mathcal{M}$; 
\item
It then recovers $(x_1, \ldots, x_t)$ by brute-force: Namely, for each $i \in [t]$, it inverts the OWF $f$ to find $x_i$ s.t.\ $f(x_i) = y_i$. It is possible that there exist some ``bad'' $y_i$'s that are not in the range of $f$. For such bad $i$'s, it sets $x_i = \bot$. If all the $x_i$'s are bad, $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ halts and outputs $\mathsf{Fail}$;
\item \label[Step]{item:machineK':3}
If this step is reached, we know that $(x_1, \ldots, x_t)$ cannot be all-$\bot$. $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ then picks an $(s, x_s)$ uniformly at random from the good (i.e.\ non-$\bot$) $x_i$'s.
\item
Then, $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ continues to finish the execution in the same way as $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$, except that it uses $(s, x_s)$ as the witness when executing the left {\bf WIPoK-2}. 
\end{enumerate}
It is worth noting that the $(j, x_j)$ extracted by the witness-extended emulator for the left {\bf WIPoK-1} (inherited from $\mathcal{K}_i(\mathsf{pref})$) is not used any more in $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$. 

Obviously, if the $(s, x_s)$ picked by $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ is equal to the $(j, x_j)$ extracted in $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ from its left {\bf WIPoK-1}, then $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ and $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ are identical. Notice that this step relies on the injectivity of $f$ (see \Cref{rmk:injectivity-of-OWF}). Since $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ samples $(s,x_s)$ uniformly from all the good $(i, x_i)$'s, it must hold with probability at least $1/t$ that $(s, x_s) = (j,x_j)$.
Therefore, the following must hold:
{\begingroup\fontsize{10.5pt}{0pt}\selectfont
\begin{equation}\label[Inequality]{eq:bound:K'i}
\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i) : \msf{Val} \gets \mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \frac{1}{t}\cdot \Pr[w' = (i, \tilde{x}_i) : \msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})].
\end{equation}
\endgroup}
\begin{remark}[On Injectivity of the OWF]\label{rmk:injectivity-of-OWF}
We emphasize that throughout the proof of non-malleability, this is {\em the only} place where we rely on the injectivity of the OWF. In particular, we rely on the injectivity of the $f$ in the left session to ensure that there is a unique preimage for each $\Set{{y}_i}_{i \in [t]}$. Thus, if both the $x_s$ with $s = j$ (sampled by $\mathcal{K}'_i$) and the extracted $x_j$ (in $\mathcal{K}_i$) are a valid preimage for the same $y_j$, then the injectivity of $f$ implies that $x_s=x_j$. We will show how to remove injectivity in \Cref{sec:removing-injectivity}.
\end{remark}
\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=9]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:K'i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=10]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:K''i}
     \end{subfigure}
     \caption{Machines $\mathcal{K}'_i$ and $\mathcal{K}''_i$ {\scriptsize (Difference is highlighted in red color)}}
     \label{figure:one-sided:K'i-K''i}
\end{figure}

\para{Machine $\mathcal{K}''_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:K''i}.\label{pageref:one-sided:K''i}) For a prefix $\mathsf{pref}$,  $\mathcal{K}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ behaves identically to $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ except that it plays as the honest committer in the left {\bf WIPoK-1}, instead of running the witness-extended emulator. Recall that starting from $\mathcal{K}'_i$, the witness $(j, x_j)$ extracted by the witness-extended emulator from the left {\bf WIPoK-1} is not used any more; Thus, machine $\mathcal{K}''_i$ does not need to perform this witness-extended emulation.

By the PoK property
of the left {\bf WIPoK-1}, it holds that
\begin{equation}\label[Inequality]{eq:relation:K'-K''}
\forall i \in [\tilde{t}], ~\big|\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]\big| \le \mathsf{negl}(\lambda).
\end{equation}
Next, by the (non-uniform, see \Cref{rmk:non-uniform_reduction}) WI property of the right {\bf WIPoK-1}, it holds that
\begin{equation}\label[Inequality]{eq:relation:K:WI}
\forall i \in [\tilde{t}], ~\big|\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]\big|  \le \mathsf{negl}(\lambda).
\end{equation}
\begin{remark}[Power of Non-Uniform Reductions]\label{rmk:non-uniform_reduction}
Note that we can rely on the PoK and WI properties, although $\mathcal{K}'_i$ and $\mathcal{K}''_i$ perform brute-force to recover $(x_1,...,x_t)$. This is because the brute-forcing step is done before {\bf WIPoK-1} or {\bf WIPoK-2} starts; Thus, $(x_1,...,x_t)$ can be treated as a non-uniform advice in the reductions. This non-uniform type of argument will be used again in this section later. 
\end{remark}

Then, we have the following claim:
\begin{MyClaim}\label{claim:bound:K''1}
$\forall i \in [\tilde{t}], ~\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \frac{1}{t} \cdot \big(p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof} 
This claim follows from \Cref{cliam:bound:Ki-xi} and \Cref{eq:bound:K'i,eq:relation:K'-K'',eq:relation:K:WI}. Formally, (in the following, we omit the input $(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ to $\mathcal{K}_i$, $\mathcal{K}'_i$, and $\mathcal{K}''_i$)
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1] 
 & \ge \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i]  - \mathsf{negl}(\lambda)
\label[Inequality]{claim:bound:K''1:proof:1}\\
 & \ge 
\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}'_i]  - \mathsf{negl}(\lambda) 
\label[Inequality]{claim:bound:K''1:proof:2}\\
 & \ge 
\frac{1}{t}\cdot\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}_i]  - \mathsf{negl}(\lambda) 
\label[Inequality]{claim:bound:K''1:proof:3}\\
& \ge 
\frac{1}{t} \cdot \big(p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda), \label[Inequality]{claim:bound:K''1:proof:4}
\end{align}
where \Cref{claim:bound:K''1:proof:1} follows from \Cref{eq:relation:K:WI}, \Cref{claim:bound:K''1:proof:2} follows from \Cref{eq:relation:K'-K''}, \Cref{claim:bound:K''1:proof:3} follows from \Cref{eq:bound:K'i}, and \Cref{claim:bound:K''1:proof:4} follows from \Cref{cliam:bound:Ki-xi}.

\end{proof}

Now, we make the last claim which, together with \Cref{claim:bound:K''1}, leads to the desired contradiction.
\begin{MyClaim}\label{claim:K'':non-abort}
$\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}:\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \le p^{\mathsf{Sim}}_{\mathsf{pref}} + \mathsf{negl}(\lambda)$.
\end{MyClaim}
\para{Deriving the Contradiction.} Before proving \Cref{claim:K'':non-abort}, we first show why \Cref{claim:bound:K''1,claim:K'':non-abort} are contradictory (all the probabilities below are taken over $\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$):
\begin{align*}
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}] 
& = \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})]  + \Pr[\msf{Val} = \bot_{\tilde{Y}}] \\
& = \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] + \sum_{i =1 }^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i)] \numberthis \label{eq:bound:Ki:final-contradiction:0}\\
& \ge  \sum_{i =1 }^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i)] \\
&\ge \tilde{t} \cdot \frac{1}{t} \cdot \big(p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:1}\\
& \ge (1+\frac{1}{t}) \cdot (p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda)) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:2}\\
& = p^{\mathsf{Sim}}_{\mathsf{pref}} + \bigg(\frac{p^{\mathsf{Sim}}_{\mathsf{pref}}}{t} - \epsilon'(\lambda) - \frac{\epsilon'(\lambda)}{t}\bigg) - \mathsf{negl}(\lambda)\\
& \ge p^{\mathsf{Sim}}_{\mathsf{pref}} + \frac{10t^2 - t -1}{10t^3}\cdot \epsilon(\lambda) - \mathsf{negl}(\lambda), \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:3}\\
\end{align*}
where \Cref{eq:bound:Ki:final-contradiction:0} follows from \Cref{eq:bot-tilde-Y:partition}, \Cref{eq:bound:Ki:final-contradiction:1} follows from \Cref{claim:bound:K''1}, \Cref{eq:bound:Ki:final-contradiction:2} follows from the assumption that $\tilde{t} \ge t+1$, and \Cref{eq:bound:Ki:final-contradiction:3} follows from the assumption that $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$ and our parameter setting $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{10t^2}$.

Recall that $t$ is the tag taking values from $[n]$ with $n$ being a polynomial of $\lambda$. Also recall that $\epsilon(\lambda)$ is an inverse polynomial on $\lambda$. Therefore, \Cref{eq:bound:Ki:final-contradiction:3} can be written as:
$$\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}:\msf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} + \frac{1}{\mathsf{poly}(\lambda)} - \mathsf{negl}(\lambda),$$
which contradicts \Cref{claim:K'':non-abort}.

This eventually finishes the proof of \Cref{lem:bound:Ki} (modulo the proof of \Cref{claim:K'':non-abort}, which we show in \Cref{sec:proof:claim:K'':non-abort}).



\subsection{Proof of \Cref{claim:K'':non-abort}}
\label{sec:proof:claim:K'':non-abort}
We first define two extra machines $\mathcal{K}^{**}_1$ and $\mathcal{K}^*_1$.

\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=11]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:K**i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=12]{figures/figures-new.pdf}
         }
         \caption{}
         \label{figure:one-sided:K*i}
     \end{subfigure}
     \caption{Machines $\mathcal{K}^{**}_1$ and $\mathcal{K}^{*}_1$ {\scriptsize (Difference is highlighted in red color)}}
     \label{figure:one-sided:K**i-K*i}
\end{figure}
\para{Machine $\mathcal{K}^{**}_1$:} (Illustrated in \Cref{figure:one-sided:K**i}.) For a prefix $\mathsf{pref}$, $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ behaves identically as $\mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ except that $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ finishes the right {\bf WIPoK-2} using the honest receiver's algorithm, instead of using the witness-extended emulator. 

\subpara{$\mathcal{K}^{**}_1$'s Output.} We define the output of $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ to be the honest receiver's decision $b \in \Set{\top, \bot}$. This is in contrast to previous hybrids $\mathcal{K}'_i$, $\mathcal{K}''_i$, and $\mathcal{K}_i$, whose output is defined to be the value $\mathsf{Val}$ that depends on the value $w'$ extracted by the $\mathcal{WE}$ for the right {\bf WIPoK-2}.

 By the (non-uniform) PoK property (as per \Cref{def:WEE})

 of the right {\bf WIPoK-2}, it holds that
\begin{equation}\label[Inequality]{eq:K''1-K**1}
\big|\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val}\gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[b = \top : b\gets \mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \big| \le \mathsf{negl}(\lambda).
\end{equation}

\para{Machine $\mathcal{K}^{*}_1$:} (Illustrated in \Cref{figure:one-sided:K*i}.) For a prefix $\mathsf{pref}$, $\mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ behaves identically as $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ except the following difference: $\mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ uses the witness-extended emulator to extract a witness $(j,x_j)$ from the left {\bf WIPoK-1}, and if $x_j$ is not a valid preimage for $y_j$,  $\mathcal{K}^{*}_1$ aborts.

 By the (non-uniform) PoK property 

 of the left {\bf WIPoK-1}, it holds that
\begin{equation}\label[Inequality]{eq:K**1-K*1}
\big|\Pr[b = \top : b \gets \mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[b = \top : b\gets \mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \big| \le \mathsf{negl}(\lambda).
\end{equation}

\para{Compare $\mathcal{K}^{*}_1$ with $\mathcal{G}_1$.} Now, let us compare $\mathcal{K}^{*}_1$ with the $\mathcal{G}_1$ depicted in \Cref{figure:one-sided:Gi}. They only differ in the witness used in the left {\bf WIPoK-2} (and that $\mathcal{G}_1$ does not need to perform brute-forcing for $Y$, as it does not use those preimages). Therefore, by the (non-uniform) WI property of the left {\bf WIPoK-2}, it holds that
$$
\big|\Pr[b = \top : b \gets \mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \big| \le \mathsf{negl}(\lambda).
$$
Also, recall (from \Cref{def:p-sim-pref}) that $\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]$ is exactly the definition of $p^{\mathsf{Sim}}_{\mathsf{pref}}$. Thus, the above implies:
\begin{equation}\label[Inequality]{eq:K*1-G1}
\big|\Pr[b = \top : b \gets \mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - p^{\mathsf{Sim}}_{\mathsf{pref}} \big| \le \mathsf{negl}(\lambda).
\end{equation}

Therefore, the following holds:
\begin{align}
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val}\gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] & \le \Pr[b = \top : b\gets \mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] +  \mathsf{negl}(\lambda) \label[Inequality]{eq:K'':non-abort:final:1} \\
& \le \Pr[b = \top : b \gets \mathcal{K}^{*}_1({\mathsf{pref}})] + \mathsf{negl}(\lambda) \label[Inequality]{eq:K'':non-abort:final:2} \\
& \le p^{\mathsf{Sim}}_{\mathsf{pref}} + \mathsf{negl}(\lambda), \label[Inequality]{eq:K'':non-abort:final:3}
\end{align}
where \Cref{eq:K'':non-abort:final:1} follows from \Cref{eq:K''1-K**1}, \Cref{eq:K'':non-abort:final:2} follows from \Cref{eq:K**1-K*1}, and \Cref{eq:K'':non-abort:final:3} follows from \Cref{eq:K*1-G1}. 

This finishes the proof of \Cref{claim:K'':non-abort}.









\subsection{Replacing the Injective OWF with Any OWF}
\label{sec:removing-injectivity}
In this part, we show how to replace the injective OWF with any OWF in \Cref{prot:one-sided:classical}.

As mentioned in \Cref{rmk:injectivity-of-OWF}, the injectivity is  used only when we switch from $\mathcal{K}_i$ to $\mathcal{K}'_i$ (on \Cpageref{machineK':description}). Let us first recall  why injectivity is important there: $\mathcal{K}'_i$ learns the preimages of each $\Set{y_i}_{i\in[t]}$ via brute-forcing, while $\mathcal{K}_i$ learns a preimage $x_j$ of $y_j$ {\em for some $j \in [t]$} by extraction (from the left {\bf WIPoK-1}). Our goal there is to show that if $\mathcal{K}'_i$ picks a random preimage, then it will hit the $(j, x_j)$ extracted by $\mathcal{K}_i$, except for a multiplicative $1/t$ loss on the probability (i.e., \Cref{eq:bound:K'i}). If the OWF $f$ is not injective, there is no guarantee that the $(j, x_j)$ extracted by $\mathcal{K}_i$ is really contained in the set of all preimages learned by $\mathcal{K}'_i$ via brute-forcing---Even if $\mathcal{K}'_i$ guessed the index $j$ correctly, it could have brute-forced a $x'_j \ne x_j$ (though it holds that $y_j = f(x_j) = f(x'_j)$). In this case, \Cref{eq:bound:K'i} may not hold anymore.

From the above discussion, it is clear that if we want to remove the requirement of injectivity, we only need to find an alternative approach to ensure that the preimage extracted by $\mathcal{K}_i$ will fall in the set of the preimages learned by $\mathcal{K}'_i$ via brute-forcing. It turns out that this can be achieved by the following simple modification to \Cref{item:one-sided:step:OWFs,item:one-sided:step:WIPoK:1} of \Cref{prot:one-sided:classical}:
\begin{itemize}
\item
In \Cref{item:one-sided:step:OWFs}, ask $R$ to {\em additionally} commit (using a statistically-binding scheme) to the preimages $\Set{x_i}_{i\in [t]}$ that it used to generate $\Set{y_i}_{i\in [t]}$. Formally, we ask $R$ to send the following messages in  \Cref{item:one-sided:step:OWFs}:
$$Y = \Set{y_i = f(x_i)}_{i \in [t]},~\text{and}~\Set{\mathsf{com}_i = \mathsf{Com}_{\beta'}(x_i;r_i)}_{i \in [t]},$$ 
where $\mathsf{Com}_{\beta'}$ is Naor's commitment with $\beta'$ being the first Naor's message from $C$ (which could be sent in parallel with other messages in \Cref{item:one-sided:step:committing}).
\item
In \Cref{item:one-sided:step:WIPoK:1}, ask $R$ to additionally prove that the $Y$ and $\Set{\mathsf{com}_i}_{i \in [t]}$ are ``consistent''. Formally, instead of proving $Y \in \ensuremath{\mathcal{L}}\xspace^t_f$ (defined in \Cref{eq:one-sided:Lang:OWF}), we ask $R$ to prove $(Y,  \Set{\mathsf{com}_i}_{i \in [t]}) \in \ensuremath{\mathcal{L}}\xspace^t_{f, \beta'}$ using the $\mathsf{WIPoK}$, where 
{\begingroup\fontsize{10pt}{0pt}\selectfont
\begin{equation}\label[Language]{eq:one-sided:Lang:OWF:new}
\ensuremath{\mathcal{L}}\xspace^t_{f, \beta'}\coloneqq \Set{(y_1, \ldots, y_t), (\mathsf{com}_1, \ldots, \mathsf{com}_t)~|~\exists (i, x_i, r_i) ~s.t.~ i \in [t] \wedge y_i = f(x_i) \wedge \mathsf{com}_i = \mathsf{Com}_{\beta'}(x_i;r_i)}.
\end{equation}
\endgroup}
\end{itemize} 
It is worth noting that we do {\em not} need to modify \Cref{item:one-sided:step:WIPoK:2}. In particular, $C$ does {\em not} need to prove that it knows one of the $(x_i, r_i)$'s used by $R$ to generate $\Set{\mathsf{com}_i}_{i\in [t]}$; $C$ still only needs to prove $(\mathsf{com}, Y) \in \ensuremath{\mathcal{L}}\xspace_\beta \vee \ensuremath{\mathcal{L}}\xspace^t_f$.

Now, instead of performing brute-force over $\Set{y_i}_{i \in [t]}$, $\mathcal{K}'_i$ does that over $\Set{\mathsf{com}_i}_{i \in [t]}$ to learn the committed values, and then picks a random $x_s$ satisfying $y_s = f(x_s)$ to use in the left {\bf WIPoK-2}.\footnote{Note that $\mathcal{K}'_i$ (resp.\ $\mathcal{K}_i$) will also learn the randomness used to generate the commitment via brute-forcing (resp.\ via extraction from {\bf WIPoK-1}). They simply ignore the randomness---indeed, both machines only need to know a preimage $(j,x_j)$ to finish {\bf WIPoK-2}; the corresponding randomness $r_i$ is irrelevant.} It is easy to see that the statistical-binding property of $\mathsf{Com}$
ensures that \Cref{eq:bound:K'i} still holds for an overwhelming fraction of $\beta'$.

\begin{remark}[On One-Wayness]
Technically, we also need to argue that the above modification does not enable the man-in-the-middle  $\mathcal{M}$ to invert the one-way function $\tilde{f}$ on $\tilde{Y} = \Set{\tilde{y}_i}_{i \in [\tilde{t}]}$. (Recall that the one-wayness of $\tilde{f}$ is used (only) in the proof of \Cref{cliam:bound:Ki-xi}.) This is straightforward---Any OWF remains one-way even if a commitment to its preimage is given.
\end{remark}

\subsection{Summarizing the Proof Strategy for \Cref{thm:one-sided:non-malleability}}
\label{sec:proof:summar:one-sided}


Since the proof of \Cref{thm:one-sided:non-malleability} is complicate, we summarize the logic flow in this subsection. We hope that it will help the reader obtain a better understanding of the whole picture, without being disturbed by details of secondary importance. But one could safely skip this subsection as it does not contain new information. In particular, it will not affect the understanding of succeeding sections.

At a high level, the proof of \Cref{thm:one-sided:non-malleability} can be divided into the following five steps:
\begin{enumerate}
\item \label[Step]{item:proof:summar:one-sided:1}
{\bf (Proof by Contradiction.)}
In the proof of \Cref{thm:one-sided:non-malleability}, we first denoted the MIM execution by $H^{\mathcal{M}}(\lambda, m, z)$ (on \Cpageref{gameH:description}). 
We then assumed for contradiction that a (potentially non-uniform) PPT adversary can distinguish the outputs of $H^{\mathcal{M}}(\lambda, m_0, z)$ and $H^{\mathcal{M}}(\lambda, m_1, z)$ with advantage $3 \cdot \delta(\lambda)$, with $\delta(\lambda)$ being some polynomial (i.e., \Cref{eq:one-sided:proof:contra-assump}). Next, we required the existence of a machine $G^{\mathcal{M}}$ (i.e., \Cref{lem:one-sided:proof:core}) such that 
\begin{enumerate}
\item \label[Property]{summary:G-M:property:1}
the outputs of $G^{\mathcal{M}}(\lambda, m_0, z)$ and $G^{\mathcal{M}}(\lambda, m_1, z)$ are computationally indistinguishable, and 
\item
$G^{\mathcal{M}}(\lambda, m_b, z)$ and $H^{\mathcal{M}}(\lambda, m_b, z)$ is (computationally) $\delta(\lambda)$-close for both $b = 0$ and $b =1$.
\end{enumerate}
The existence of such a $G^{\mathcal{M}}$ finished the proof of \Cref{thm:one-sided:non-malleability}, because it contradicts the assumption that there exists some PPT distinguisher that tells the difference between $H^{\mathcal{M}}(\lambda, m_0, z)$ and $H^{\mathcal{M}}(\lambda, m_1, z)$ with advantage $3 \cdot \delta(\lambda)$. Thus, the remaining steps for the proof of \Cref{thm:one-sided:non-malleability} were then devoted to constructing such a $G^{\mathcal{M}}$.

\item \label[Step]{item:proof:summar:one-sided:2}
{\bf (Constructing $G^{\mathcal{M}}$.)} To build the $G^{\mathcal{M}}$ required in \Cref{item:proof:summar:one-sided:1}, we first broke $H^{\mathcal{M}}$ into two stages---the prefix part $H^{\mathcal{M}}_{\mathsf{pre}}$ and the remainder $\langle \mathcal{A}, \mathcal{B}\rangle$ (i.e.,  \Cref{hybrid:H:reinterpretation}). Here, we defined an important variable called ``prefix'': 
\begin{itemize}
\item
An execution of $H^{\mathcal{M}}_{\mathsf{pre}}$ fixes the prefix $\mathsf{pref}$, which contains the internal state $\mathsf{st}_C, \mathsf{st}_{\mathcal{M}}, \mathsf{st}_R$ of the corresponding parties at the end of {\bf Step-2} in a MIM execution. Also, $\mathsf{pref}$ fixes the right Naor's commitment $\tilde{\tau}$.  Also note that the committed value in the right execution was defined to be $\mathsf{val}_b(\tilde{\tau})$ (i.e., \Cref{eq:def:val-b-tau}).
\end{itemize}
Then, we constructed a simulation-extractor $\mathcal{SE}^{\mathcal{M}}$ (in \Cref{lem:small-tag:proof:se}) such that, when continuing from any prefix $\mathsf{pref}$ (Importantly, $\mathcal{SE}$ cannot use the intermediate state $\mathsf{st}_C$ for the committer; Otherwise, we cannot show \Cref{summary:G-M:property:1} by reducing it to the hiding property of Naor's commitment), $\mathcal{SE}^{\mathcal{M}}$ will $\epsilon$-simulate the remainder execution $\langle \mathcal{A},\mathcal{B} \rangle$, while also extracting the committed value $\mathsf{val}_b(\tilde{\tau})$ in the right execution.

With this $\mathcal{SE}^{\mathcal{M}}$, it is easy to construct $G^{\mathcal{M}}$---$G^{\mathcal{M}}$ simply runs $H^{\mathcal{M}}_{\mathsf{pre}}$ to obtain the prefix, and then runs $\mathcal{SE}$ to simulate the remainder execution and also extract $\mathsf{val}_b(\tilde{\tau})$. Thus, the remaining steps for the proof of \Cref{thm:one-sided:non-malleability} were then devoted to constructing such a $\mathcal{SE}^{\mathcal{M}}$.

\item \label[Step]{item:proof:summar:one-sided:3}
{\bf (Constructing $\mathcal{SE}^{\mathcal{M}}$.)} To construct $\mathcal{SE}^{\mathcal{M}}$, we first built two machines: 
\begin{enumerate}
\item
 a simulator $\mathcal{G}_1$ (in \Cref{lem:main-thread:sim:real}) that can simulate the execution $\langle \mathcal{A}, \mathcal{B}\rangle$ without knowing $C$'s internal states $\mathsf{st}_C$. This is to address the point that $\mathcal{SE}^{\mathcal{M}}$  is not allowed to use $\mathsf{st}_C$. Here, we defined an important variable $p^{\mathsf{Sim}}_{\mathsf{pref}}$, which denotes the probability that the honest $R$ is convinced in the execution simulated by $\mathcal{G}_1$.
 \item
an extractor $\mathcal{K}$ (in \Cref{lem:small-tag:proof:se:proof:K}) such that 
for any prefix $\mathsf{pref}$ and noticeable $\epsilon(\lambda)$, if $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, then $\mathcal{K}$ can extract the value committed in $\tilde{\tau}$ (contained in $\mathsf{pref}$) with probability polynomially related to $\epsilon(\lambda)$ (more accurately, the probability is $\frac{\epsilon'(\lambda)}{\tilde{t}}$ where $\epsilon'(\lambda) \coloneqq \frac{\epsilon(\lambda)}{10t^2}$).
\end{enumerate}
With $\mathcal{G}_1$ and $\mathcal{K}$, $\mathcal{SE}^{\mathcal{M}}$ can be constructed as follows: on input a $\mathsf{pref}$, it first runs $\mathcal{G}_1$ to simulate the main-tread execution of $\langle \mathcal{A}, \mathcal{B}\rangle$; If the honest receiver is not convinced in the main-thread, $\mathcal{SE}^{\mathcal{M}}$ simply sets the committed value in the right execution as $\bot$; Otherwise, $\mathcal{SE}^{\mathcal{M}}$ will extract the value committed in $\tilde{\tau}$ (denoted as $\mathsf{val}(\tilde{\tau})$) by repeating $\mathcal{K}$ for polynomially many times (more accurately, $\frac{\tilde{t}}{\epsilon'(\lambda)}\cdot \lambda$ times). As shown toward the end of \Cref{lem:small-tag:proof:se:proof}, such a $\mathcal{SE}^{\mathcal{M}}$ satisfied the requirements described in \Cref{item:proof:summar:one-sided:2}.
Thus, the remaining steps for the proof of \Cref{thm:one-sided:non-malleability} were then devoted to constructing the extractor $\mathcal{K}$. (The construction and security of $\mathcal{G}_1$ is relatively straightforward, so we do not repeat it in this summary.)

\item
{\bf (Constructing $\mathcal{K}$.)} To construct $\mathcal{K}$, we first defined a sequence of machines $\Set{\mathcal{K}_i}_{i \in [\tilde{t}]}$ as shown in \Cref{figure:one-sided:Ki}. We then argued that there must exist an $i \in [\tilde{t}]$ (called ``the good $i$'') such that the $\mathsf{Val}$ output by $\mathcal{K}_i$ must be $\mathsf{val}(\tau)$ with probability $\ge \epsilon'(\lambda)$. Then, machine $\mathcal{K}$ was defined to pick a random $i \pick [\tilde{t}]$ and run machine $\mathcal{K}_i$. Since  such a $\mathcal{K}$ will hit the good $i$ with probability $1/\tilde{t}$, it will successfully extract $\mathsf{val}(\tilde{\tau})$ with probability $\frac{\epsilon'(\lambda)}{\tilde{t}}$, satisfying the requirement in \Cref{item:proof:summar:one-sided:3}. Now, to finish the proof of \Cref{thm:one-sided:non-malleability}, the only thing left is to prove that $\Set{\mathcal{K}_i}_{i \in [\tilde{t}]}$ satisfies the above requirement.

\item
{\bf (Existence of Good $\mathcal{K}_i$.)}
Informally, our current goal is to show the following (see \Cref{lem:bound:Ki} for the precise statement):
$$\exists i \in [\tilde{t}]~s.t.~\Pr[\mathsf{Val} = \mathsf{val}(\tilde{\tau}):\mathsf{Val} \gets \mathcal{K}_i] \ge \epsilon'(\lambda).$$

We first assumed for contradiction that (i.e., \Cref{eq:proof:averageK:contra-assump}):
\begin{equation}\label[Inequality]{one-sided:proof:summary:assump-contra}
\forall  i \in  [\tilde{t}],~\Pr[\mathsf{Val} = \mathsf{val}(\tilde{\tau}) :\mathsf{Val} \gets \mathcal{K}_i] \le \epsilon'(\lambda).
\end{equation}
We then derived the contradiction in the following way:
\begin{enumerate}
\item
We first showed that the $\mathsf{Val}$ output by $\mathcal{K}_i$ must be a valid witness with probability $\ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda)$ (i.e., \Cref{claim:bound:Ki}). Next, observe that in $\mathcal{K}_i$, $\mathsf{Val}$ cannot be $(j, \tilde{x}_j)$ for some $j \ne i$; Otherwise, it breaks the one-wayness of the right OWF $\tilde{f}$. Thus, when $\mathsf{Val}$ is a valid witness in $\mathcal{K}_i$, it can only take the values $\mathsf{val}(\tilde{\tau})$ or $(i, \tilde{x}_i)$. This together with our assumption in \Cref{one-sided:proof:summary:assump-contra} implies that 
\begin{equation}\label[Inequality]{one-sided:proof:summary:Ki}
\forall i \in [\tilde{t}],~\Pr[\mathsf{Val} = (i, \tilde{x}_i): \mathsf{Val} \gets\mathcal{K}_i] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda) - \mathsf{negl}(\lambda).\end{equation}
(This is exactly \Cref{cliam:bound:Ki-xi}.)
\item
Next, we defined machine $\mathcal{K}''_i$ (see \Cref{figure:one-sided:K''i}), which differs from $\mathcal{K}_i$ in the following way: $\mathcal{K}''_i$ does not rewind the left {\bf WIPoK-1}. Instead, it extracts the preimages of the right $\Set{y_i}_{i \in [t]}$ by brute force, and then picks a random preimage $(s, x_s)$ to use in the left {\bf WIPoK-2}. Since the $(s, x_s)$ guessed by $\mathcal{K}''_i$ will hit the one used by $\mathcal{K}_i$, the following holds:
\begin{equation}\label[Inequality]{one-sided:proof:summary:Ki-K''i}
\forall i \in [\tilde{t}], ~\Pr[\mathsf{Val} = (i, \tilde{x}_i) : \mathsf{Val} \gets\mathcal{K}''_i] \ge \frac{1}{t}\cdot \Pr[\mathsf{Val} = (i, \tilde{x}_i) : \mathsf{Val} \gets\mathcal{K}_i].
\end{equation}
(This is essentially \Cref{eq:bound:K'i}---Note that in \Cref{sec:lem:bound:Ki:proof}, we also defined a machine $\mathcal{K}'_i$. But it is only a tool that helps us eventually connect $\mathcal{K}''_i$ and $\mathcal{K}_i$. So we ignore $\mathcal{K}'_i$ in this relatively high-level summary.)
\item
Since in $\mathcal{K}''_i$ we do not rewind the left {\bf WIPoK-1} anymore, we can now rely on the WI property of the right {\bf WIPoK-1} to connect all the $\Set{\mathcal{K}''_i}_{i \in [\tilde{t}]}$ to $\mathcal{K}''_1$. Namely, we have
\begin{equation}\label[Inequality]{one-sided:proof:summary:K''i-K''1}
\forall i \in [\tilde{t}], ~\big|\Pr[\mathsf{Val} = (i,\tilde{x}_i): \mathsf{Val} \gets\mathcal{K}''_i] - \Pr[\mathsf{Val} = (i,\tilde{x}_i): \mathsf{Val} \gets\mathcal{K}''_1]\big|  \le \mathsf{negl}(\lambda).
\end{equation}
(This is exactly \Cref{eq:relation:K:WI}.) We want to remark that in this step, we took advantage of the synchronous schedule: in the synchronous setting, it is guaranteed that the brute-forcing for $\Set{y_i}_{i\in [n]}$ happens {\em before} the right {\bf WIPoK-1}; Otherwise, we will not be able to reduce \Cref{one-sided:proof:summary:K''i-K''1} to the WI property of the right {\bf WIPoK-1}. 
\end{enumerate}

Now, by \Cref{one-sided:proof:summary:Ki,one-sided:proof:summary:Ki-K''i,one-sided:proof:summary:K''i-K''1}, the following holds (this is exactly \Cref{claim:bound:K''1})
\begin{equation}\label[Inequality]{one-sided:proof:summary:bound:K''1}
\forall i \in [\tilde{t}], ~\Pr[\mathsf{Val} = (i,\tilde{x}_i)~\text{in}~ \mathcal{K}''_1] \ge \frac{1}{t} \cdot \big(p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda).
\end{equation}
This implies 
\begin{align*}
\Pr[\msf{Val} = (1, \tilde{x}_1)\vee \ldots \vee \msf{Val} = (\tilde{t}, \tilde{x}_{\tilde{t}}) : \mathsf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] 
& \ge \tilde{t} \cdot \frac{1}{t} \cdot \big(p^{\mathsf{Sim}}_{\mathsf{pref}} - \epsilon'(\lambda) \big) + \mathsf{negl}(\lambda)\\
\text{(By our parameter setting. See \Cref{eq:bound:Ki:final-contradiction:3})} & \ge p^{\mathsf{Sim}}_{\mathsf{pref}} + \frac{10t^2 - t -1}{10t^3}\cdot \epsilon(\lambda) - \mathsf{negl}(\lambda)
\end{align*}
On the other hand, \Cref{claim:K'':non-abort} implies that (we do not repeat the proof of \Cref{claim:K'':non-abort} here as it is relatively straightforward)
$$
\Pr[\msf{Val} = (1, \tilde{x}_1)\vee \ldots \vee \msf{Val} = (\tilde{t}, \tilde{x}_{\tilde{t}}) : \mathsf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] \le p_{\mathsf{pref}} + \mathsf{negl}(\lambda)
$$
This gives us the desired contradiction because $\frac{10t^2 - t -1}{10t^3}\cdot \epsilon(\lambda)$ is an (inverse) polynomial on $\lambda$. 
\end{enumerate}
\section{Application: Post-Quantum MPC in Constant Rounds from QLWE}
\label{sec:app-to-MPC}
Agarwal et al.~\cite{EC:ABGKM21} constructed a constant-round post-quantum MPC protocol in the plain model assuming the super-polynomial hardness of QLWE and a QLWE-based circular security assumption. The only reason why they rely on the super-polynomial hardness of QLWE is for their construction of a constant-round post-quantum non-malleable commitment scheme.\footnote{Actually, what they need is the so-called \emph{many-to-one} non-malleable commitments. But it is known that (one-to-one) non-malleability as defined in \Cref{def:NMCom:pq} is equivalent to many-to-one non-malleability (even in the post-quantum setting, as noted in \cite[Lemma 7.3]{EC:ABGKM21}).} Since we have constructed constant-round post-quantum non-malleable commitments from post-quantum OWFs (\Cref{thm:nmcom_largetag_pq}), we can weaken the assumption to the polynomial hardness of QLWE. Thus, we obtain the following theorem.

\begin{theorem}
Assuming the polynomial hardness of QLWE and a QLWE-based circular security assumption (as in~\cite{EC:ABGKM21}), there exist constant-round constructions of post-quantum MPC in the plain model.
\end{theorem}

This is the first construction of constant-round post-quantum MPC from polynomial hardness assumptions in the plain model. 

\begin{remark}[Synchronous Security Suffices.]
For the construction of post-quantum MPC, we only need post-quantum non-malleable commitments secure against 
\emph{synchronous} adversaries. It is simpler to obtain such non-malleable commitments than those against asynchronous adversaries. For example, this can be done by applying the tag amplification of~\cite[Sec. 7.3]{EC:ABGKM21} to our small-tag, synchronous construction (i.e., \Cref{prot:small-tag:sync:classical} instantiated with post-quantum building blocks).
\end{remark}
\section{Preliminaries}
\label{sec:prelim}
\subsection{Basic Notations} 
Let $\lambda \in \ensuremath{\mathbb{N}}\xspace$ denote security parameter. 
For a positive integer $n$, let $[n]$ denote the set $\{1,2,...,n\}$.
For a finite set $\mathcal{X}$, $x \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathcal{X}$ means that $x$ is uniformly chosen from $\mathcal{X}$.

A function $f:\mathbb{N}\rightarrow [0,1]$ is said to be \emph{negligible} if for all polynomial $p$ and sufficiently large $\lambda \in \mathbb{N}$, we have $f(\lambda)< 1/p(\lambda)$; it is said to be \emph{overwhelming} if $1-f$ is negligible, and said to be \emph{noticeable} if there is a polynomial $p$ such that $f(\lambda)\geq  1/p(\lambda)$ for sufficiently large $\lambda\in \mathbb{N}$.
We denote by $\mathsf{poly}$ an unspecified polynomial and by $\mathsf{negl}$ an unspecified negligible function.

Honest (classical) parties are modeled as interactive Turing machines (ITMs). We use PPT and QPT to denote (classical) probabilistic polynomial time and quantum polynomial time, respectively.
For a classical probabilistic or quantum algorithm $\mathcal{A}$, $y \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathcal{A}(x)$ means that $\mathcal{A}$ is run on input $x$ and outputs $y$.
An adversary (or malicious party) is modeled as a non-uniform PPT (or QPT in the case of post-quantum security) algorithm.
When we consider a non-uniform QPT adversary, we often specify it by a sequence of polynomial-size quantum circuits with quantum advice $\{\mathcal{A}_\lambda, \rho_\lambda\}_{\lambda\in\mathbb{N}}$. 
In an execution with the security parameter $\lambda$, $\mathcal{A}$ runs $\mathcal{A}_{\lambda}$ taking $\rho_\lambda$ as the advice.  
For simplicity, we often omit the index  $\lambda$ and just write $\mathcal{A}(\rho)$ to mean a non-uniform QPT algorithm specified by  $\{\mathcal{A}_\lambda, \rho_\lambda\}_{\lambda\in \mathbb{N}}$. 


For an $\mathbf{NP}$ language $\ensuremath{\mathcal{L}}\xspace$ and a true statement in this language $ x \in \ensuremath{\mathcal{L}}\xspace$, we use $\ensuremath{\mathcal{R}}\xspace_\ensuremath{\mathcal{L}}\xspace(x)$ ($\ensuremath{\mathcal{R}}\xspace$ stands for ``relation'') to denote the set of all witnesses for $x$.
We will refer to the OR-composition of $\mathbf{NP}$ languages, which are defined in \Cref{def:OR-Comp}.
\begin{definition}[OR-Composition of $\mathbf{NP}$ Languages]\label{def:OR-Comp}
Let $\ensuremath{\mathcal{L}}\xspace_1$ and $\ensuremath{\mathcal{L}}\xspace_2$ be two $\mathbf{NP}$ languages. The {\em OR-composition} of them (dubbed $\ensuremath{\mathcal{L}}\xspace_1 \vee \ensuremath{\mathcal{L}}\xspace_2$) is the new $\mathbf{NP}$ language defined as follows:
$$\ensuremath{\mathcal{L}}\xspace_1 \vee \ensuremath{\mathcal{L}}\xspace_2 \coloneqq \Set{(x_1, x_2) ~|~ x_1 \in \ensuremath{\mathcal{L}}\xspace_1 \vee x_2 \in \ensuremath{\mathcal{L}}\xspace_2}.$$
\end{definition}


\para{Notations for Indistinguishability.}
We may consider random variables over bit strings or over quantum states. 
This will be clear from the context.
We use the same notations for classical and quantum computational indistinguishability, but there should be no fear of confusion; It means computational indistinguishability against PPT (resp.\ QPT) distinguishers whenever we consider classical (resp.\ post-quantum) security.
For ensembles of random variables $\mathcal{X}=\{X_i\}_{\lambda\in \mathbb{N},i\in I_\lambda}$ and $\mathcal{Y}=\{Y_i\}_{\lambda\in \mathbb{N},i\in I_\lambda}$ over the same set of indices $I=\bigcup_{\lambda\in\mathbb{N}}I_\lambda$ and a function $\delta$,       
we use $\mathcal{X}\cind_{\delta}\mathcal{Y}$ to mean that for any non-uniform PPT (resp.\ QPT) algorithm $\mathcal{A}$, there exists a negligible function $\mathsf{negl}(\cdot)$ such that for all $\lambda\in\mathbb{N}$, $i\in I_\lambda$, we have
\[
|\Pr[\mathcal{A}(X_i)]-\Pr[\mathcal{A}(Y_i)]|\leq \delta(\lambda) + \mathsf{negl}(\lambda).
\]
We say that $\mathcal{X}$ and $\mathcal{Y}$ are $\delta$-computationally indistinguishable if the above holds. 
In particular, when the above holds for $\delta=0$, we say that $\mathcal{X}$ and $\mathcal{Y}$ are computationally indistinguishable, and simply write $\mathcal{X}\cind \mathcal{Y}$.

Similarly, we use $\mathcal{X}\sind_{\delta}\mathcal{Y}$ to mean that for any unbounded time  algorithm $\mathcal{A}$, there exists a negligible function $\mathsf{negl}(\cdot)$ such that for all $\lambda\in\mathbb{N}$, $i\in I_\lambda$, we have 
\[
|\Pr[\mathcal{A}(X_i)]-\Pr[\mathcal{A}(Y_i)]|\leq \delta(\lambda) + \mathsf{negl}(\lambda).
\]
In particular, when the above hold for $\delta=0$, we say that $\mathcal{X}$ and $\mathcal{Y}$ are statistically indistinguishable, and simply write $\mathcal{X}\sind \mathcal{Y}$.
Moreover,  
we write $\mathcal{X} \equiv \mathcal{Y}$ to mean
that $X_i$ and $Y_i$ are distributed identically for all $i\in I$. 

When we consider an ensemble $\mathcal{X}$ that is only indexed by $\lambda$ (i.e., $I_\lambda=\{\lambda\}$), we write $\mathcal{X}=\{X_\lambda\}_\lambda$ for simplicity.




\if0
\paragraph{Interactive Quantum Machines and Oracle-Aided Quantum Machines.} 
The following explanation is almost taken verbatim from \cite{cryptoeprint:2021:1516}. 
We rely on the definition of interactive quantum machines and oracle-aided quantum machines that are given oracle access to an interactive quantum machine, following \cite{EC:Unruh12}.
Roughly, an interactive quantum machine $\mathcal{A}$ is formalized by a unitary over registers $\mathbf{M}$ for receiving and sending messages,  and $\mathbf{A}$ for maintaining $\mathcal{A}$'s internal state.
For two interactive quantum machines $\mathcal{A}$ and $\mathcal{B}$ that share the same message register $\mathbf{M}$, an interaction between $\mathcal{A}$ and $\mathcal{B}$ proceeds by alternating invocations of $\mathcal{A}$ and $\mathcal{B}$ while exchanging messages over  $\mathbf{M}$.

An oracle-aided quantum machine $\mathcal{S}$ given oracle access to an interactive quantum machine $\mathcal{A}$ with an initial internal state $\rho$ (denoted by $\mathcal{S}^{\mathcal{A}(\rho)}$) is allowed to apply the unitary part of $\mathcal{A}$ (the unitary obtained by deferring all measurements by $\mathcal{A}$ and omitting these measurements)  and its inverse in a black-box manner. $\mathcal{S}$ is only allowed to act on $\mathcal{A}$'s internal register $\mathbf{A}$ through oracle access.
We refer to \cite{EC:Unruh12} for formal definitions of interactive quantum machines and black-box access to them.
\fi



\subsection{Commitment Schemes}
We define (classically-secure and post-quantum) commitments. The following definitions are based on those in \cite{cryptoeprint:2021:1516}. 
\begin{definition}[Commitment]\label{def:commitment}
A {\em commitment scheme} is a pair of PPT ITMs $\langle C, R \rangle$ that satisfies the following. Let $m\in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$ (where $\ell(\cdot)$ is some polynomial) is a message that $C$ wants to commit to. The protocol consists of the following stages:
\begin{itemize}
\item
{\bf Commit Stage:} $C(m)$ and $R$ interact with each other to generate a transcript $\tau$, a decommitment $\ensuremath{\mathsf{decom}}\xspace$ as $C$'s private output, and a decision value $b_{\mathrm{com}}\in\{\top,\bot\}$ as $R$'s private output.  
 We denote this execution by $(\tau,\ensuremath{\mathsf{decom}}\xspace,b_{\mathrm{com}}) \gets \langle C(m), R \rangle(1^\lambda)$.

\item
{\bf Decommit Stage:}
$C$ sends the committed message $m$ and the decommitment $\ensuremath{\mathsf{decom}}\xspace$ to $R$, 
and $R$ outputs decision 
$b_{\mathrm{dec}}\in\{\top,\bot\}$. 
We denote this execution by $b_{\mathrm{dec}}\gets \ensuremath{\mathsf{Verify}}\xspace(\tau,m,\ensuremath{\mathsf{decom}}\xspace)$.\footnote{We assume that there is no state information for $R$ kept from the commit stage.}
W.l.o.g., we assume that whenever $R$ rejects at the end of the commit stage (i.e., $b_\mathrm{com} = \bot$), $R$ will reject at the end of decommit stage (i.e., $b_\mathrm{dec} = \bot$). (Note that w.l.o.g., one can think that $b_\mathrm{com}$ is included in $\tau$, because we can always modify the protocol to ask $R$ to send $b_\mathrm{com}$ as the last-round message of the commit stage.)
\end{itemize}
The scheme satisfies the following completeness requirement:
\begin{enumerate}
\item
{\bf Completeness.} For any polynomial $\ell:\mathbb{N} \rightarrow \mathbb{N}$ and any $m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, it holds that
\begin{equation*}
\Pr[b_{\mathrm{com}}=b_{\mathrm{dec}}=\top : 
\begin{array}{l}
(\tau, \ensuremath{\mathsf{decom}}\xspace, b_{\mathrm{com}}) \gets \langle C(m),R \rangle(1^\lambda) \\
b_{\mathrm{dec}}\gets \ensuremath{\mathsf{Verify}}\xspace(\mathsf{com},m,\ensuremath{\mathsf{decom}}\xspace)
\end{array}
] = 1.
\end{equation*}
\end{enumerate}
\end{definition}


\begin{definition}[Computationally Hiding]\label{def:comp_hiding}
A commitment scheme $\langle C, R \rangle$ is {\em computationally hiding} if for any 
non-uniform PPT receiver $R^*$ and any polynomial $\ell : \mathbb{N} \rightarrow \mathbb{N}$, the following holds:
$$\big\{ \ensuremath{\mathsf{OUT}}\xspace_{R^*}\langle C(m_0),R^* \rangle(1^\lambda)\big\}_{\lambda \in \mathbb{N}, ~m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}} ~\ensuremath{\stackrel{\text{c}}{\approx}}\xspace~ \big\{ \ensuremath{\mathsf{OUT}}\xspace_{R^*}\langle C(m_1),R^* \rangle(1^\lambda)\big\}_{\lambda \in \mathbb{N}, ~m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}},$$
where $\ensuremath{\mathsf{OUT}}\xspace_{R^*}\langle C(m_b),R^* \rangle(1^\lambda)$ $(b \in \ensuremath{\{0,1\}}\xspace)$ denotes the output of $R^*$ at the end of the commit stage. 

We say that $\langle C, R \rangle$ is \emph{post-quantum} computationally hiding if the above holds for all non-uniform \emph{QPT} $R^*$. 
\end{definition}

\begin{definition}[Statistically Binding]\label{def:stat-binding} 
A commitment scheme $\langle C, R \rangle$ is {\em statistically binding} if for any unbounded-time committer $C^*$, the following holds: 
\begin{align*}
    \Pr[
    \begin{array}{l}
    \exists~m_0,m_1,\ensuremath{\mathsf{decom}}\xspace_0,\ensuremath{\mathsf{decom}}\xspace_1,~s.t.~m_0\neq m_1 ~\land\\
     \ensuremath{\mathsf{Verify}}\xspace(\tau,m_0,\ensuremath{\mathsf{decom}}\xspace_0)=\ensuremath{\mathsf{Verify}}\xspace(\tau,m_1,\ensuremath{\mathsf{decom}}\xspace_1)=\top
    \end{array}
    :(\tau,\ensuremath{\mathsf{decom}}\xspace,b_{\mathrm{com}}) \gets \langle C^*, R \rangle(1^\lambda)]=\mathsf{negl}(\lambda).
\end{align*}
\end{definition}


\begin{definition}[Committed Values]\label{def:val}
For a commitment scheme $\langle C, R \rangle$, 
we define the value function as follows:
\begin{equation*}
    \mathsf{val}(\tau):= 
    \begin{cases}
    m&\text{~if~}\exists\text{~unique~}m\text{~s.t.~}\exists~\ensuremath{\mathsf{decom}}\xspace, \ensuremath{\mathsf{Verify}}\xspace(\tau,m,\ensuremath{\mathsf{decom}}\xspace)=1\\
    \bot &\text{otherwise}
    \end{cases},
\end{equation*}
where $\tau$ and $\ensuremath{\mathsf{decom}}\xspace$ are defined in the commit stage in \Cref{def:commitment}.
\end{definition}

\subsection{Non-Malleable Commitments}\label{sec:nmcom}
\para{Classically Non-Malleable Commitments.} We first define non-malleable commitments in the classical setting. This definition follows the formalization in \cite{TCC:LinPasVen08,STOC:GoyPanRic16}. We consider a man-in-the-middle adversary $\mathcal{M}$ interacting with a committer $C$ in the {\em left}, and a receiver $R$ in the {\em right}. We denote the relevant entities used in the right interaction as the ``tilde'd'' version of the corresponding entities on the left. In particular, suppose that $C$ commits to $m$ in the left interaction, and $\mathcal{M}$ commits to $\tilde{m}$ on the right, i.e., we set $\tilde{m}=\mathsf{val}(\tilde{\tau})$ where $\tilde{\tau}$ is the transcript of the right session. Let $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)$ denote the random variable that is the pair $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}},\tilde{m})$, consisting of $\mathcal{M}$'s output as well as the value committed to by $\mathcal{M}$ on the right (assuming $C$ commits to $m$ on the left), where $z$ is $\mathcal{M}$'s non-uniform advice. We use a {\em tag-based} (or ``identity-based'') specification, and ensure that $\mathcal{M}$ uses a distinct tag $\tilde{t}$ on the right from the tag $t$ it uses on the left. This is done by stipulating that $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)$ outputs a special value $\bot_{tag}$ when $\mathcal{M}$ uses the same tag in both the left and right executions. The reasoning is that this corresponds to the uninteresting case when $\mathcal{M}$ is simply acting as a channel, forwarding messages from $C$ on the left to $R$ on the right and vice versa. 
\begin{definition}[Classical Non-Malleable Commitments]\label{def:NMCom:classical}
A commitment scheme $\langle C, R \rangle$ is said to be {\em (classically) non-malleable} if for every (non-uniform) PPT man-in-the-middle adversary $\mathcal{M}$ and every polynomial $\ell:\ensuremath{\mathbb{N}}\xspace \rightarrow \ensuremath{\mathbb{N}}\xspace$, it holds that
$$\big\{\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_0, z)\big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z\in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m_1, z)\big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z\in \ensuremath{\{0,1\}}\xspace^*}.$$
\end{definition}

\para{Post-Quantum Non-Malleable Commitments.} In the post-quantum setting, non-malleability can be defined similarly, except that the man-in-the-middle adversary can be QPT, instead of being PPT. To avoid using confusing notations, we put an over-line on top of the variable $\mathsf{mim}$ in the post-quantum setting.

\begin{definition}[Post-Quantum Non-Malleable Commitments]\label{def:NMCom:pq}
A commitment scheme $\langle C, R \rangle$ is said to be {\em post-quantumly non-malleable} if for every (non-uniform) QPT man-in-the-middle adversary $\mathcal{M} = \Set{\mathcal{M}_\lambda, \rho_\lambda}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}$ and every polynomial $\ell:\ensuremath{\mathbb{N}}\xspace \rightarrow \ensuremath{\mathbb{N}}\xspace$, it holds that
$$\big\{\bar{\mathsf{mim}}^{\mathcal{M}_\lambda}_{\langle C, R \rangle}(\lambda,m_0, \rho_\lambda)\big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{\bar{\mathsf{mim}}^{\mathcal{M}_\lambda}_{\langle C, R \rangle}(\lambda,m_1, \rho_\lambda)\big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}}.$$
where ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace$'' refers to computational indistinguishability against QPT distinguishers.
\end{definition}


\begin{remark}[On Entangled Auxiliary Information.]
The above definition does not consider entanglement between $\mathcal{M}$'s auxiliary input and distinguisher's auxiliary input. 
However, \cite[Claim 3.1]{BLS21} shows that the above definition implies the version that considers such entanglement. 
\end{remark}


\para{Synchronous Adversaries:} This notion refers to man-in-the-middle adversaries who upon receiving a message in the left (reps.\ right) session, immediately respond with the corresponding message in the right (resp.\ left) session. An adversary is said to be {\em asynchronous} if it is not synchronous.

\subsection{Extractable Commitments}
\para{Classically Extractable Commitments.} A commitment scheme is extractable if there exists an efficient extractor such that, the committed value can be extracted. We present the definition in \Cref{definition:ext-com}, which is taken from \cite{TCC:PasWee09}.  Constant-round constructions of (classically) extractable commitments are known from OWFs \cite{TCC:PasWee09}.
\begin{definition}[Classically Extractable Commitments]\label{definition:ext-com} A commitment $\ensuremath{\mathsf{ExtCom}}\xspace = \langle C,R\rangle$ is {\em extractable} if there exists an expected polynomial-time probabilistic oracle machine (the extractor) $\mathcal{E}$ that given oracle access to any PPT cheating committer $C^*$ outputs a pair $(\tau, \sigma^*)$ such that:
\begin{itemize}
\item
{\bf Simulation:} $\tau$ is identically distributed to the view of $C^*$ at the end of interacting with an honest receiver $R$ in commitment phase.

\item
{\bf Extraction:} the probability that $\tau$ is accepting and $\sigma^* =\bot$ is negligible.
\item
{\bf Binding:} if $\sigma^* \ne \bot$, then it is statistically impossible to open $\tau$ to any value other than $\sigma^*$.
\end{itemize}
\end{definition} 



\para{Post-Quantum (Robust) Extractable Commitments.}
We define the post-quantum analog of extractable commitments. In the post-quantum setting, we often need an extractor that (almost) does not disturb the (potentially malicious) committer's state during the extraction. 
However, it is not known that such a post-quantum extractable commitments exist from (polynomially hard) post-quantum OWFs.\footnote{A recent work of \cite{cryptoeprint:2021:1543} gave a constant-round construction of such extractable commitments from super-polynomial hardness of post-quantum OWFs.} 
Fortunately, a recent work \cite{cryptoeprint:2021:1516} showed that a constant-round construction from post-quantum OWFs is possible if we relax the extractability to allow an (arbitrarily small) noticeable simulation error.  
The following definitions are taken from \cite{BLS21} with some notational adaptations.

Let $\langle C,R \rangle$ be a (possibly tag-based) commitment scheme. A sequential committed-value oracle $O^\infty[\langle C,R \rangle]$ acts as follows in interaction with a committer $C^*$: 
it interacts with $C^*$ in
many sequential sessions; in each session,
\begin{itemize}
    \item it participates with $C^*$
in the commit phase of $\langle C,R \rangle$ as the honest receiver $R$ (using a tag
chosen adaptively by $C^*$), obtaining a transcript $\tau$, {\bf and}
\item if $C^*$ is non-aborting in the commit phase and sends request $\mathsf{break}$, it returns $\mathsf{val}(\tau)$.
\end{itemize}
The single-session oracle $O^1[\langle C,R \rangle]$ is similar to $O^\infty[\langle C,R \rangle]$, except that it interacts with the adversary in a single session. When the commitment scheme is clear from the context, we write $O^\infty$ (or $O^1$)
for simplicity. 


Then, the definition of post-quantum $\epsilon$-simulatable commitment is given below. 

\begin{definition}[Post-Quantum $\epsilon$-Simulatable Extractable Commitment]\label{def:epsilon-sim-ext-com:pq}
A commitment scheme $\langle C, R \rangle$ is said to be a {\em post-quantum $\epsilon$-simulatable extractable commitment} if it satisfies the following in addition to post-quantum computational hiding and statistical binding. 
There exists a QPT algorithm $\ensuremath{\mathcal{SE}}\xspace$ such that for any noticeable $\epsilon(\lambda)$ and any non-uniform QPT committer $\{C^*_\lambda,\rho_\lambda\}_{\lambda\in \mathbb{N}}$,
\begin{equation*}
\big\{ \ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},C^*_\lambda,\rho_\lambda) \big\}_{\lambda \in \mathbb{N}}
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_\epsilon
\big\{{C^*_\lambda}^{O^{\infty}}(\rho_\lambda)\big\}_{\lambda \in \mathbb{N}},
\end{equation*}
where ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_\epsilon$'' refers to $\epsilon$-close computational indistinguishability against QPT distinguishers.
\end{definition}



\if0
\begin{definition}[Post-Quantum $\epsilon$-Simulatable Extractable Commitment]\label{def:epsilon-sim-ext-com:pq}
A commitment scheme $\langle C, R \rangle$ is said to be a {\em post-quantum $\epsilon$-simulatable extractable commitment} if it satisfies the following in addition to post-quantum computational hiding and statistical binding. 
There exists a QPT algorithm $\ensuremath{\mathcal{SE}}\xspace$ such that for any noticeable $\epsilon(\lambda)$, any non-uniform QPT $\mathcal{A}(\rho)$, and $r$-round interactive machine $\mathcal{B}$,  
\begin{equation*}
\big\{ \ensuremath{\mathsf{OUT}}\xspace_{\ensuremath{\mathcal{SE}}\xspace}\langle \mathcal{B},\ensuremath{\mathcal{SE}}\xspace^{\mathcal{A}(\rho)}(1^\lambda,1^{\epsilon^{-1}}) \big\}_\lambda
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_\epsilon
\big\{\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{A}}\langle \mathcal{B},\mathcal{A}^{O^{\infty}}(\rho)\rangle \big\}_\lambda
\end{equation*}
where ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_\epsilon$'' refers to $\epsilon$-close computational indistinguishability against QPT distinguishers.
\end{definition}
\fi

\begin{lemma}[{\cite[Lemma 10]{cryptoeprint:2021:1516}}]
Assuming the existence of post-quantum OWFs, there exist constant-round post-quantum $\epsilon$-simulatable extractable commitments.   
\end{lemma}
\begin{remark}
The $\epsilon$-simulatable extractability as defined in \Cref{def:epsilon-sim-ext-com:pq} is called post-quantum \emph{strong} $\epsilon$-simulatable extractability in \cite{cryptoeprint:2021:1516}. Though their definition looks different from \Cref{def:epsilon-sim-ext-com:pq}, they are actually equivalent---First, it is easy to see that \Cref{def:epsilon-sim-ext-com:pq} is equivalent to a modified version of \Cref{def:epsilon-sim-ext-com:pq} where we give $O^1$ instead of $O^{\infty}$. 
Second, \cite[Lemma 3.2]{BLS21} shows that the $O^1$ and $O^{\infty}$ versions of \Cref{def:epsilon-sim-ext-com:pq} are equivalent.
\end{remark}

We also define the \emph{robust} version of the above definition following \cite{BLS21}. 
Roughly speaking, $r$-robust $\epsilon$-simulatable extractability means that the $\epsilon$-simulatable extractability holds even if the adversary interacts with an external $r$-round interactive machine that cannot be rewound by the extractor. 
The formal definition is given below. 

\begin{definition}[Post-Quantum $r$-Robust $\epsilon$-Simulatable Extractable Commitment]\label{def:robust-epsilon-sim-ext-com:pq}
A commitment scheme $\langle C, R \rangle$ is said to be a {\em post-quantum $r$-robust $\epsilon$-simulatable extractable commitment} if it satisfies the following in addition to post-quantum computational hiding and statistical binding. 
There exists a QPT algorithm $\ensuremath{\mathcal{SE}}\xspace$ such that for any noticeable $\epsilon(\lambda)$, non-uniform QPT committer $\{C^*_\lambda,\rho_\lambda\}_{\lambda\in \mathbb{N}}$, and $r$-round interactive machine $B$, 
\begin{equation*}
\big\{ \ensuremath{\mathsf{OUT}}\xspace_{\ensuremath{\mathcal{SE}}\xspace}\langle B(1^\lambda,z), \ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},C^*_\lambda,\rho_\lambda)\rangle \big\}_{\lambda\in \mathbb{N}, z\in \{0,1\}^*}
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_\epsilon
\big\{ \ensuremath{\mathsf{OUT}}\xspace_{C^*_\lambda}\langle B(1^\lambda,z),{C^*_\lambda}^{O^{\infty}}(\rho_\lambda)\rangle\big\}_{\lambda\in \mathbb{N}, z\in \{0,1\}^*}
\end{equation*}
where ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_\epsilon$'' refers to $\epsilon$-close computational indistinguishability against QPT distinguishers.
\end{definition}


\subsection{Witness-Indistinguishable Proofs of Knowledge}
\label{sec:prelim:WIPoK}
\para{Classically Witness-Indistinguishable Proofs of Knowledge.} First, we provide a definition from \cite{Goldreich01,JC:Lindell03}.
\begin{definition}[Proofs of Knowledge \cite{Goldreich01,JC:Lindell03}]\label{def:PoK}
Let $\ensuremath{\mathcal{L}}\xspace$ be an $\mathbf{NP}$ language and $\kappa: \ensuremath{\mathbb{N}}\xspace \rightarrow [0,1]$. We say that a pair of PPT ITMs $\langle P, V \rangle$ is an interactive proof of knowledge for $\ensuremath{\mathcal{L}}\xspace$ with knowledge error $\kappa$ if the following two conditions hold:
\begin{enumerate}
\item {\bf Completeness.} For every true statement $x\in\ensuremath{\mathcal{L}}\xspace$ and every witness $w \in \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace}(x)$, it holds that
$$\Pr[\ensuremath{\mathsf{OUT}}\xspace_V\langle P(w), V \rangle(x)= \top] = 1.$$
\item {\bf Validity (with error $\kappa$).} There exists a polynomial $q(\cdot)$ and a probabilistic oracle machine $K$ such that for every $P^*$, and every $x,z, r \in \ensuremath{\{0,1\}}\xspace^*$, machine $K$ satisfies the following condition: 
\begin{quote}
Denote by $p(x,z,r)$ the probability that $V(x)$ accepts when interacting with the prover specified by $P^*(x,z;r)$. If $p(x,z,r)>\kappa(|x|)$, then, on input $x$ and with oracle access to oracle $P^*(x,z;r)$, $K$ outputs a solution $w \in \ensuremath{\mathcal{R}}\xspace_\ensuremath{\mathcal{L}}\xspace(x)$ within an expected number of steps bounded by $\frac{q(|x|)}{p(x, z, r) - \kappa(|x|)}$.
\end{quote}
\end{enumerate}
\end{definition}


We present an alternative formalism of knowledge soundness called {\em witness-extended emulation} due to Lindell \cite{JC:Lindell03}. This formalism turns out to be more suitable for our application. 

\begin{definition}[PoK via Witness-Extended Emulation {\cite{JC:Lindell03}}]\label{def:WEE}
Let $\ensuremath{\mathcal{L}}\xspace$ be an $\mathbf{NP}$ language and $\kappa: \ensuremath{\mathbb{N}}\xspace \rightarrow [0,1]$. We say that a pair of ITMs $\langle P, V \rangle$ is an interactive proof of knowledge for $\ensuremath{\mathcal{L}}\xspace$ with {\em witness-extended emulation} if it satisfies the same completeness requirement as in \Cref{def:PoK}, and the following requirement: There exists an expected PPT oracle machine $\mathsf{WE}$, called the {\em emulation-extractor},  such that for any machine $P^*$ the following conditions hold 
\begin{enumerate}
\item\label[Condition]{item:WEE:1}
$\Set{(\ensuremath{\mathsf{ST}}\xspace'_{P^*},b'): (\ensuremath{\mathsf{ST}}\xspace'_{P^*},b', w') \gets \mathcal{WE}^{P^*(x, z;r)}(x)}_{\lambda,x, z, r} \equiv \Set{(\ensuremath{\mathsf{ST}}\xspace_{P^*},b):(\ensuremath{\mathsf{ST}}\xspace_{P^*},b) \gets \langle P^*(x, z;r), V(x)\rangle }_{\lambda,x, z, r}$,
where in the RHS above, $\ensuremath{\mathsf{ST}}\xspace_{P^*}$ and $b$ denote the state of $P^*$ and output of $V$ respectively, at the end of the execution $\langle P^*(x, z;r), V(x)\rangle$.
\item\label[Condition]{item:WEE:2}
$\Pr[b'=1~\wedge~w'\notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace}(x) : (\ensuremath{\mathsf{ST}}\xspace'_{P^*},b', w') \gets \mathcal{WE}^{P^*(x, z;r)}(x)] = \mathsf{negl}(|x|)$.
\end{enumerate}
\if0
\begin{enumerate}
\item\label[Condition]{item:WEE:1}
$\Set{\mathcal{T}': (\mathcal{T}', w') \gets \mathcal{WE}^{P^*(x, z;r)}(x)}_{x, z, r} \equiv \Set{\mathcal{T}:\mathcal{T} \gets \langle P^*(x, z;r), V(x)\rangle }_{x, z, r}$;
\item\label[Condition]{item:WEE:2}
$\Pr[\mathcal{T}'~\text{is accepting}~\wedge~w'\notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace}(x) : (\mathcal{T}', w') \gets \mathcal{WE}^{P^*(x, z;r)}(x)] = \mathsf{negl}(|x|)$.
\end{enumerate}
\fi
\end{definition}
The following lemma connects \Cref{def:WEE} with \Cref{def:PoK}.
\begin{lemma}[{\cite[Lemma 3.1]{JC:Lindell03}}]
Let $\langle P, V\rangle$ be a proof of knowledge for $\ensuremath{\mathcal{L}}\xspace \in \mathbf{NP}$ with negligible knowledge error. Then, $\langle P, V\rangle$ is also a proof of knowledge for $\ensuremath{\mathcal{L}}\xspace$ with witness-extended emulation.
\end{lemma}

Next, we define witness indistinguishable proof
of knowledge:
\begin{definition}[WIPoKs]\label{def:WIPoK}
A witness-indistinguishable proof
of knowledge for an $\mathbf{NP}$ language $\ensuremath{\mathcal{L}}\xspace$ is a proof of knowledge for $\ensuremath{\mathcal{L}}\xspace$ with witness extended emulation (as per \Cref{def:WEE}) which additionally satisfies the following property
\begin{itemize}
\item
{\bf Witness-Indistinguishability.} For any non-uniform PPT machine $V^*$, we have
$$\Set{\ensuremath{\mathsf{OUT}}\xspace_{V^*}\langle P(w_0), V^*\rangle(x)}_{\lambda, x, w_0, w_1} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \Set{\ensuremath{\mathsf{OUT}}\xspace_{V^*}\langle P(w_1), V^*\rangle(x)}_{\lambda, x, w_0, w_1},$$
where $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $x \in \ensuremath{\mathcal{L}}\xspace \cap \ensuremath{\{0,1\}}\xspace^\lambda$, and $w_0, w_1 \in \ensuremath{\mathcal{R}}\xspace_\ensuremath{\mathcal{L}}\xspace(x)$.
\end{itemize}
\end{definition}

It is well-known that constant-round witness-indistinguishable proofs of knowledge (as per \Cref{def:WIPoK}) can be built from one-way functions.








\para{Post-Quantum Witness-Indistinguishable Arguments of Knowledge}
We define a post-quantum analog of the WIPoKs described in \Cref{def:WIPoK}. A natural way to do so is to just replace all adversaries with any QPT algorithms.
More precisely, we require that the witness indistinguishability holds against QPT distinguishers and that the knowledge extractor extracts a witness without disturbing the prover's state.  
However, a constant-round construction for such WIPoKs is not known based on (polynomially hard) post-quantum OWFs.\footnote{A recent work of \cite{cryptoeprint:2021:1543} gave such WIPoKs from super-polynomial hardness of post-quantum OWFs.} 
Fortunately, a recent work \cite{cryptoeprint:2021:1516} showed that a constant-round construction from post-quantum OWFs is possible if we relax the proof of knowledge via witness-extended emulation to \emph{argument} of knowledge via witness-extended \emph{$\epsilon$-close} emulation, where a cheating prover is limited to QPT and a (arbitrarily small) noticeable simulation error is allowed. 
A formal definition of such post-quantum WIAoKs is given below.
\begin{definition}[Post-Quantum WIAoK with $\epsilon$-Close Emulation]\label{def:PQWIAoK}
Let $\ensuremath{\mathcal{L}}\xspace$ be an $\mathbf{NP}$ language. We say that a pair of PPT ITMs $\langle P, V \rangle$ is a post-quantum witness-distinguishable arguments of knowledge with $\epsilon$-close emulation
for $\ensuremath{\mathcal{L}}\xspace$ if the following three conditions hold:
\begin{enumerate}
\item {\bf Completeness.} For every $(x,w)\in\ensuremath{\mathcal{L}}\xspace$, it holds that
$$\Pr[\ensuremath{\mathsf{OUT}}\xspace_V\langle P(w), V \rangle(x)= \top] = 1.$$
\item {\bf AoK via Witness-Extended $\epsilon$-Close Emulation.}\label[Property]{item:PQWEE} 
There exists a QPT oracle machine $\mathcal{WE}$, called the {\em witness-extended emulator},  such that for any non-uniform QPT machine $\{P^*_{\lambda},\rho_\lambda\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}$ the following conditions hold: for any noticeable function $\epsilon(\cdot)$ (referred to as the error parameter),  \takashi{modified the interface of $\mathcal{WE}$ so that it takes $P^*_\lambda$ and $\rho_\lambda$ as an input instead of an oracle. Please fix it if the oracle version is left.}
\begin{enumerate}
\item\label[Condition]{item:PQWEE:1}
$\Set{(\ensuremath{\mathsf{ST}}\xspace'_{\P^*},b'): (\ensuremath{\mathsf{ST}}\xspace'_{\P^*},b', w') \gets \mathcal{WE}(1^{\epsilon^{-1}},P^*_{\lambda},\rho_{\lambda},x)}_{\lambda,x} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon} \Set{(\ensuremath{\mathsf{ST}}\xspace_{\P^*},b):(\ensuremath{\mathsf{ST}}\xspace_{P^*},b) \gets \langle P^*_{\lambda}(\rho_{\lambda}), V(x)\rangle }_{\lambda,x}$
where $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $x\in \{0,1\}^\lambda$, and ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon}$'' refers to $\epsilon$-computational indistinguishability against QPT distinguishers;
\item\label[Condition]{item:PQWEE:2}
$\Pr[b'=1~\wedge~w'\notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace}(x) : (\ensuremath{\mathsf{ST}}\xspace'_{\P^*},b', w') \gets \mathcal{WE}(1^{\epsilon^{-1}},P^*_{\lambda},\rho_{\lambda},x)] =0$,\footnote{We can assume the probability is $0$ instead of $\mathsf{negl}(|x|)$ without loss of generality. If the probability is $\mathsf{negl}(|x|)$, we can modify $\mathcal{WE}$ to output $b'=0$ whenever $w'\notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace}(x)$. This only negligibly affects the distribution in the LHS of \Cref{item:PQWEE:1}, which can be absorbed into $\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon}$.}
\end{enumerate}
where $(\ensuremath{\mathsf{ST}}\xspace_{P^*},b) \gets \langle P^*_{\lambda}(\rho^*_{\lambda}), V(x)\rangle$ means that $\ensuremath{\mathsf{ST}}\xspace_{P^*}$ is the final state of $P^*_{\lambda}$ and $b$ is the decision output by $V$.  
 \item
{\bf Witness-Indistinguishability.} For any non-uniform QPT machine $\Set{V^*_\lambda,\rho_\lambda}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}$, we have
$$\Set{\ensuremath{\mathsf{OUT}}\xspace_{V^*_\lambda}\langle P(w_0), V^*_\lambda(\rho_\lambda)\rangle(x)}_{\lambda, x, w_0, w_1} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \Set{\ensuremath{\mathsf{OUT}}\xspace_{V^*_\lambda}\langle P(w_1), V^*_\lambda(\rho_\lambda)\rangle(x)}_{\lambda, x, w_0, w_1},$$
where $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $x \in \ensuremath{\mathcal{L}}\xspace \cap \ensuremath{\{0,1\}}\xspace^\lambda$, $w_0, w_1 \in \ensuremath{\mathcal{R}}\xspace_\ensuremath{\mathcal{L}}\xspace(x)$, and ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace$'' refers to computational indistinguishability against QPT distinguishers.
\end{enumerate}
\end{definition}

The work of \cite{cryptoeprint:2021:1516} gives a constant-round construction of post-quantum \emph{$\epsilon$-zero-knowledge} arguments of knowledge from post-quantum OWFs. Since $\epsilon$-zero-knowledge implies witness indistinguishability, we have the following lemma.
\begin{lemma}[{\cite[Corollary 2]{cryptoeprint:2021:1516}}]
Assuming the existence of post-quantum OWFs, there exist constant-round post-quantum witness-indistinguishable arguments of knowledge as per \Cref{def:PQWIAoK}.
\end{lemma}
\section{Proof of Extract-and-Simulate Lemma (\Cref{lem:extract_and_simulate})}\label{sec:proof_extract_and_simulate}

We prove \Cref{lem:extract_and_simulate}. 
The proof follows similar techniques as in the proof of \cite[Lemma 4]{cryptoeprint:2021:1516}

\subsection{Preparation}
We prepare several lemmas that will be used in the proof of \Cref{lem:extract_and_simulate}.


\para{Watrous' Rewinding Lemma.} The following is Watrous' rewinding lemma \cite{SIAM:Watrous09} in the form of  \cite[Lemma 2.1]{STOC:BitShm20}. \takashi{Replaced $\gamma$ with $\alpha$ for avoiding collision.}
\begin{lemma}[Watrous' Rewinding Lemma \cite{SIAM:Watrous09}]\label{lem:quantum_rewinding}
There is a quantum algorithm $\mathsf{R}$ that gets as input the following:
\begin{itemize}
\item A quantum circuit $\mathsf{Q}$ that takes $n$-input qubits in register $\mathsf{Inp}$ and outputs a classical bit $b$ (in a register outside $\mathsf{Inp}$)  and an $m$-qubit output.  
\item An $n$-qubit state $\rho$ in register $\mathsf{Inp}$.
\item A number $T\in \mathbb{N}$ in unary.
\end{itemize}

$\mathsf{R}(1^T,\mathsf{Q},\rho)$ executes in time $T\cdot|\mathsf{Q}|$  and outputs a distribution over $m$-qubit states  $D_{\rho}:= \mathsf{R}(1^T,\mathsf{Q},\rho)$  with the following guarantees.

For an $n$-qubit state $\rho$, denote by $\mathsf{Q}_{\rho}$ the conditional distribution of the output distribution $\mathsf{Q}(\rho)$,
conditioned on $b = 0$, and denote by $p(\rho)$ the probability that $b = 0$. If there exist $p_0, q \in (0,1)$, $\alpha \in (0,\frac{1}{2})$
such that:
\begin{itemize}
    \item  Amplification executes for enough time: $T\geq \frac{\log (1/\alpha)}{4p_0(1-p_0)}$,
    \item  There is some minimal probability that $b = 0$: For every $n$-qubit state $\rho$, $p_0\leq p(\rho)$,
    \item  $p(\rho)$ is input-independent, up to $\alpha$ distance: For every $n$-qubit state $\rho$, $|p(\rho)-q|<\alpha$, and
    \item  $q$ is closer to $\frac{1}{2}$: $p_0(1-p_0)\leq q(1-q)$,
\end{itemize}
then for every $n$-qubit state $\rho$,
\begin{align*}
    \mathsf{TD}(\mathsf{Q}_{\rho},D_{\rho})\leq 4\sqrt{\alpha}\frac{\log(1/\alpha)}{p_0(1-p_0)}.
\end{align*}
\end{lemma}

\if0
\begin{lemma}[Watrous' Rewinding Lemma \cite{SIAM:Watrous09}]\label{lem:quantum_rewinding}
There is an oracle-aided quantum algorithm $\mathsf{R}$ that gets as input $1^T$ for $T\in \mathbb{N}$ and an oracle $\mathsf{Q}(\rho)$ where
\begin{itemize}
\item $\mathsf{Q}$ takes an $n$-qubit input and outputs a classical bit $b$ and an $m$-qubit output,  
\item $\rho$ is an $n$-qubit state. 
\end{itemize}

$\mathsf{R}^{\mathsf{Q}(\rho)}(1^T)$ executes in time $T$ (counting an oracle access as a unit time) and outputs a distribution over $m$-qubit states  $D_{\rho}:= \mathsf{R}^{\mathsf{Q}(\rho)}(1^T)$  with the following guarantees.

For an $n$-qubit state $\rho$, denote by $\mathsf{Q}_{\rho}$ the conditional distribution of the output distribution $\mathsf{Q}(\rho)$,
conditioned on $b = 0$, and denote by $p(\rho)$ the probability that $b = 0$. If there exist $p_0, q \in (0,1)$, $\gamma \in (0,\frac{1}{2})$
such that:
\begin{itemize}
    \item  Amplification executes for enough time: $T\geq \frac{\log (1/\gamma)}{4p_0(1-p_0)}$,
    \item  There is some minimal probability that $b = 0$: For every $n$-qubit state $\rho$, $p_0\leq p(\rho)$,
    \item  $p(\rho)$ is input-independent, up to $\gamma$ distance: For every $n$-qubit state $\rho$, $|p(\rho)-q|<\gamma$, and
    \item  $q$ is closer to $\frac{1}{2}$: $p_0(1-p_0)\leq q(1-q)$,
\end{itemize}
then for every $n$-qubit state $\rho$,
\begin{align*}
    \mathsf{TD}(\mathsf{Q}_{\rho},D_{\rho})\leq 4\sqrt{\gamma}\frac{\log(1/\gamma)}{p_0(1-p_0)}.
\end{align*} 
\end{lemma}
\fi

\begin{lemma}[{\cite[Lemma 7]{cryptoeprint:2021:1516}
]\label{lem:extraction-variant} 
Let $\mathcal{A}_\mathsf{CCY}$ be a QPT algorithm (possibly with classical advice) \takashi{I think we should consider classical advice. This is understood as $z_\lambda$ of \Cref{lem:extract_and_simulate} and the partial transcript in the proof of non-malleability.} 
that takes  a quantum input $\ket{\psi}\in \mathcal{H}$ and outputs a  classical string $s$ or $\bot$.
Suppose that there exists $s^*$ such that for any $\ket{\psi}\in \mathcal{H}$, $\mathcal{A}_\mathsf{CCY}(\ket{\psi})$ outputs $s^*$
whenever $\mathcal{A}_\mathsf{CCY}$ does not output $\bot$. 
For any noticeable $\delta$, 
there exists an orthogonal decomposition of  $\mathcal{H}$ into $S_{<\delta}$ and $S_{\geq \delta}$ that satisfies the following.
\begin{enumerate}
    \item \label{item:extraction-variant:prob}
    For any normalized state $\ket{\psi_{<\delta}}\in S_{<\delta}$, it holds that $\Pr[\mathcal{A}_\mathsf{CCY}(\ket{\psi_{<\delta}})=s^*]< \delta$. Similarly,  for any normalized state $\ket{\psi_{\geq \delta}}\in S_{\geq \delta}$, it holds that $\Pr[\mathcal{A}_\mathsf{CCY}(\ket{\psi_{\geq \delta}})=s^*]\geq \delta$. 
    \item \label{item:extraction-variant:extractor}
    There exists a QPT algorithm $\mathsf{Ext}_{\mathsf{CCY}}$ (whose description does not depend on that of $\mathcal{A}_{\mathsf{CCY}}$)  \takashi{This is important since otherwise we could hard-wire $s^*$ (that is determined by the description of $\mathcal{A}_{\mathsf{CCY}}$) into $\mathsf{Ext}_{\mathsf{CCY}}$.}
   
    that satisfies the following.  
    \begin{enumerate}
        \item \label{item:extraction-variant:extraction}
        For any normalized state $\ket{\psi_{\geq \delta}}\in S_{\geq \delta}$, it holds that 
        \begin{align*}
        &\Pr[
        \begin{array}{l}
        b_\mathsf{CCY}=\top ~\land~
        s=s^*~
        \land 
        \\
        \|\ket{\psi_{\geq \delta}}\bra{\psi_{\geq \delta}}-
        \ket{\psi'_{\geq \delta}}\bra{\psi'_{\geq \delta}}\|_{tr}=\mathsf{negl}(\lambda)
        \end{array}
        :(b_\mathsf{CCY},s,\ket{\psi'_{\geq \delta}}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathsf{Ext}_{\mathsf{CCY}}(1^{\delta^{-1}},\mathcal{A}_{\mathsf{CCY}},\ket{\psi_{\geq \delta}})]\\
        &=1-\mathsf{negl}(\lambda)
        \end{align*}
        where the probability is over intermediate measurement results by $\mathsf{Ext}_\mathsf{CCY}$.\footnote{We sometimes consider an output of a quantum algorithm as a mixed state taking all the randomness into account. On the other hand, here we consider the output of $\mathsf{Ext}_\mathsf{CCY}$ as a probabilistic variable that takes pure states. This implicitly assumes that the third output of $\mathsf{Ext}_\mathsf{CCY}$ is a pure state whenever the third input is a pure state.} 
        \item \label{item:extraction-variant:invariant}
        For any normalized state $\ket{\psi_{< \delta}}\in S_{< \delta}$, 
        \begin{align*}
        \Pr[b_\mathsf{CCY}=\bot~\lor~\ket{\psi'_{< \delta}}\in S_{<\delta }:(b_\mathsf{CCY},s,\ket{\psi'_{< \delta}}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathsf{Ext}_{\mathsf{CCY}}(1^{\delta^{-1}},\mathcal{A}_{\mathsf{CCY}},\ket{\psi_{< \delta}})]=1
        \end{align*}
    where the probability is over intermediate measurement results by $\mathsf{Ext}_\mathsf{CCY}$. 
    \end{enumerate} 
\end{enumerate}
\end{lemma}

\begin{lemma}[{\cite[Lemma 8]{cryptoeprint:2021:1516}}]\label{lem:state-close}
Let $\ket{\phi_b}=\ket{\phi_{b,0}}+\ket{\phi_{b,1}}$ be a quantum state in a Hilbert space $\mathcal{H}$ such that $\bra{\phi_{b,0}}\ket{\phi_{b,1}}=0$
for $b\in \{0,1\}$. 
Let $F$ be a quantum algorithm  that takes a state in $\mathcal{H}$ as input and outputs a quantum state (not necessarily in $\mathcal{H}$) or a classical failure symbol $\mathsf{Fail}$. 
Suppose that we have  
$$\Pr[F\left(\frac{\ket{\phi_{b,0}}\bra{\phi_{b,0}}}{\|\ket{\phi_{b,0}}\|^2}\right)=\mathsf{Fail}]\geq 1-\gamma$$ 
for $b\in \{0,1\}$ where $\gamma< 1/36$.  
Then for any distinguisher $D$, it holds that 
\begin{align*}
    |\Pr[D(F(\ket{\phi_0}\bra{\phi_0}))=1]
    -\Pr[D(F(\ket{\phi_1}\bra{\phi_1}))=1]|\leq 4\gamma^{1/4} + 
    \|\ket{\phi_{1,1}}\bra{\phi_{1,1}}-\ket{\phi_{0,1}}\bra{\phi_{0,1}}\|_{tr}.
\end{align*}
\end{lemma}


\subsection{Proving \Cref{lem:extract_and_simulate}} 
Since any mixed state can be seen as a distribution over pure states, we assume $\mathcal{G}$'s input $\rho_\lambda$ is a pure state  and denote it by $\ket{\psi}$, omitting the dependence on $\lambda$. 
Similarly, we simply write $z$ to mean $z_\lambda$ and $s^*$ to mean $s^*_{z_\lambda}$ for simplicity. 

\takashi{In the following, I added $z$ as the rightmost input of $\mathsf{Exp}$, $\mathcal{G}$, $\ensuremath{\mathcal{SE}}\xspace$, etc. Please fix it if it is missing somewhere.}
For a noticeable function $\gamma(\lambda)$ and a quantum state $\ket{\psi}$, 
we define an experiment $\mathsf{Exp}(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$ as follows

\smallskip
\noindent
$\mathsf{Exp}(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$:
Run $(b,\rho_\mathsf{out}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathcal{G}(1^\lambda,1^{\gamma^{-1}},\ket{\psi},z)$. 
    \begin{itemize}
        \item If $b=\top$, the experiment outputs $(\rho_\mathsf{out},s^*)$.  We remark that this step may not be done efficiently since we do not assume that $s^*$ can be computed from $z$ efficiently.
        \xiao{we may need to explain how $\mathsf{Exp}$ obtains $s^*$. More accurately, why $\mathsf{Exp}$ cannot get $s^*$ efficiently.}\takashi{Added an explanation. 
        As a very minor issue, I noticed that $\mathsf{Exp}$ even may not be an ``algorithm" if $s^*$ is an uncomputable function of $z$. Should we care about this? Mathematically, I believe this is fine because I don't think we use the fact that $\mathsf{Exp}$ is computable.} \xiao{I think this is fine. As you said, in this lemma itself, we don't require Exp to be an algorithm. Moreover, when we use this lemma, Exp is indeed an algorithm as $s^*$ can be brute-forced from $z$ in our application.}
        \item If $b=\bot$, the experiment outputs $(\rho_\mathsf{out},\bot)$. 
    \end{itemize}
What we have to do is to construct a QPT $\ensuremath{\mathcal{SE}}\xspace$ such that for any polynomial-size $\ket{\psi}$ and noticeable $\epsilon=\epsilon(\lambda)$, 
$$
\{\ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\sind_{\epsilon} 
\{(\mathsf{Exp}(\lambda,1^{\gamma^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
$$
for some $\gamma=\mathsf{poly}(\epsilon)$. 


Let $\mathsf{Exp}_\bot(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$ and $\mathsf{Exp}_\top(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$ be the same as $\mathsf{Exp}(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$ except that they output a failure symbol $\mathsf{Fail}$ in the cases of $b=\top$ and $b=\bot$, respectively. 
That is, they work as follows.

\smallskip
\noindent
$\mathsf{Exp}_\bot(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$:
Run $(b,\rho_\mathsf{out}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathcal{G}(1^\lambda,1^{\gamma^{-1}},\ket{\psi},z)$. 
    \begin{itemize}
        \item If $b=\top$, the experiment outputs $\mathsf{Fail}$. 
        \item If $b=\bot$, the experiment outputs $(\rho_\mathsf{out},\bot)$. 
    \end{itemize}
    
    \smallskip
\noindent
$\mathsf{Exp}_\top(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$:
Run $(b,\rho_\mathsf{out}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathcal{G}(1^\lambda,1^{\gamma^{-1}},\ket{\psi},z)$. 
    \begin{itemize}
        \item If $b=\top$, the experiment outputs $(\rho_\mathsf{out},s^*)$. 
        \item If $b=\bot$, the experiment outputs $\mathsf{Fail}$. 
    \end{itemize}

First, we give simulation extractors for each of these experiments.
\begin{lemma}[Extract-and-Simulate for the Case of $b=\bot$]\label{lem:aborting_case}
For any efficiently computable $\gamma=\mathsf{poly}(\epsilon)$, 
there is a QPT algorithm $\ensuremath{\mathcal{SE}}\xspace_\bot$ such that  for any polynomial-size quantum state $\ket{\psi}$ and
noticeable $\epsilon$, 
$$
\{\ensuremath{\mathcal{SE}}\xspace_\bot(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\equiv 
\{\mathsf{Exp}_\bot(\lambda,1^{\gamma^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}.
$$ 
\end{lemma}
\begin{proof}[Proof of \Cref{lem:aborting_case}]
Since $\mathsf{Exp}_\bot$ is efficient (because it never outputs $s^*$), $\ensuremath{\mathcal{SE}}\xspace_{\bot}$ just needs to run $\mathsf{Exp}_\bot$.

\end{proof}

\begin{lemma}[Extract-and-Simulate for the Case of $b=\top$]\label{lem:non-aborting_case}
There is a QPT algorithm $\ensuremath{\mathcal{SE}}\xspace_\top$ such that  for any polynomial-size quantum state $\ket{\psi}$ and
noticeable $\epsilon$, 
$$
\{\ensuremath{\mathcal{SE}}\xspace_\top(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\ensuremath{\stackrel{\text{s}}{\approx}}\xspace_{\epsilon} 
\{\mathsf{Exp}_\top(\lambda,1^{\gamma^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace},
$$ 
where $\gamma := \left(\frac{\epsilon}{4}\right)^4$.
\end{lemma}
\begin{proof}[Proof of \Cref{lem:non-aborting_case}] 
Let  $\delta$ be a noticeable function that satisfies \Cref{item:gamma_delta} of \Cref{lem:extract_and_simulate} for $\gamma = \left(\frac{\epsilon}{4}\right)^4$. 
We apply \Cref{lem:extraction-variant} where 
we define $\mathcal{A}_{\mathsf{CCY}}(\cdot)$ to be {$\mathcal{K}(1^\lambda,1^{\gamma^{-1}},\cdot,z)$ (where $z$ is can be considered as a classical advice for $\mathcal{A}_{\mathsf{CCY}}(\cdot)$).}   
Note that the assumption of \Cref{lem:extraction-variant} is satisfied by \Cref{item:s_star_or_bot} of \Cref{lem:extract_and_simulate}. 
Let $\mathsf{Ext}_{\mathsf{CCY}}$ be the corresponding extractor and $S_{<\delta}$ and $S_{\geq \delta}$ be the decomposition of the Hilbert space of $\ket{\psi}$ as in \Cref{lem:extraction-variant}.  
Then, we construct the extractor $\ensuremath{\mathcal{SE}}\xspace_\bot$ for \Cref{lem:non-aborting_case} as follows:

\smallskip
\noindent
$\ensuremath{\mathcal{SE}}\xspace_\top(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)$:
\begin{enumerate}
\item
Run $(b_\mathsf{CCY},s_\mathsf{Ext},\ket{\psi_\mathsf{CCY}}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathsf{Ext}_{\mathsf{CCY}}(1^{\delta^{-1}}\mathcal{A}_{\mathsf{CCY}},\ket{\psi})$.   \takashi{Remark that this is not a typo; $\mathsf{Ext}_{\mathsf{CCY}}$ does not take $z$ as input. ($z$ is hardwired into the description of $\mathcal{A}_{\mathsf{CCY}}$.)}
\item If $b_\mathsf{CCY}=\bot$, output $\mathsf{Fail}$ and immediately halt.
\item Run $(b,\rho_\mathsf{out}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathcal{G}(1^\lambda,1^{\gamma^{-1}},\ket{\psi_\mathsf{CCY}},z)$. 
    \begin{itemize}
        \item If $b=\top$, output $(\rho_\mathsf{out},s_\mathsf{Ext})$. 
        \item If $b=\bot$, output  $\mathsf{Fail}$.  
    \end{itemize}
\end{enumerate}

We decompose $\ket{\psi}$  as $\ket{\psi}=\ket{\psi_{<\delta}}+\ket{\psi_{\geq \delta}}$ 
where $\ket{\psi_{<\delta}}\in S_{<\delta}$ and $\ket{\psi_{\geq \delta}}\in S_{\geq \delta}$. 
By \Cref{item:extraction-variant:extraction} of \Cref{lem:extraction-variant}, for any $\ket{\psi_{\geq \delta}}\in S_{ \geq \delta}$, it holds that 
\begin{align*}
&\Pr[
\begin{array}{l}
b_\mathsf{CCY}=\top~\land~s_\mathsf{Ext}=s^* ~\land \\
\|\ket{\psi_{\geq \delta}}\bra{\psi_{\geq \delta}}-\ket{\psi_{\mathsf{CCY},\geq \delta}}\bra{\psi_{\mathsf{CCY},\geq \delta}}\|_{tr}\leq \mathsf{negl}(\lambda)
\end{array}
:(b_\mathsf{CCY},s_\mathsf{Ext},\ket{\psi_{\mathsf{CCY},\geq \delta}}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathsf{Ext}_\mathsf{CCY}(1^{\delta^{-1}},\mathcal{A}_\mathsf{CCY},\ket{\psi_{\geq \delta}})]\\
&=1-\mathsf{negl}(\lambda)
\end{align*}
where the probability is taken over the randomness of internal measurements by $\mathsf{Ext}_\mathsf{CCY}$.  
On the other hand, 
by \Cref{item:extraction-variant:invariant} of \Cref{lem:extraction-variant}, for any 
$\ket{\psi_{< \delta}}\in S_{ < \delta}$, it holds that 
$$\Pr[b_\mathsf{CCY}=\bot~\lor~\ket{\psi_{\mathsf{CCY},<\delta}}\in S_{<\delta}:(b_\mathsf{CCY},s_\mathsf{Ext},\ket{\psi_{\mathsf{CCY},<\delta}}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow} \mathsf{Ext}_\mathsf{CCY}(1^{\delta^{-1}},\mathcal{A}_\mathsf{CCY},\ket{\psi_{< \delta}})]=1.$$ 
Combining them, if we run $\mathsf{Ext}_{\mathsf{CCY}}(1^{\delta^{-1}},\mathcal{A}_{\mathsf{CCY}},\ket{\psi})$ except for the measurements of $b_\mathsf{CCY}$ and $s_{\mathsf{Ext}}$ registers, with overwhelming probability over internal measurement results by $\mathsf{Ext}_\mathsf{CCY}$,  the output has a negligible trace distance from a state of the form
$$
\sum_{b'_\mathsf{CCY},s'}\ket{b'_\mathsf{CCY}}\ket{s'}\ket{\psi_{\mathsf{CCY},<\delta,b'_\mathsf{CCY},s'}}+ \ket{\top}\ket{s^*}\ket{\psi_{\geq \delta}}$$
where 
$\ket{\psi_{\mathsf{CCY},<\delta,\top,s'}}\in S_{<\delta}$ 
for all $s'$.  
We apply \Cref{lem:state-close} where we set  
$\ket{\phi_{0,0}}:= \ket{\top}\ket{s^*}\ket{\psi_{<\delta}}$, 
$\ket{\phi_{0,1}}:= \ket{\top}\ket{s^*}\ket{\psi_{\geq \delta}}$,
$
\ket{\phi_{1,0}}:=
\sum_{b'_\mathsf{CCY},s'}\ket{b'_\mathsf{CCY}}\ket{s'}\ket{\psi_{\mathsf{CCY},<\delta,b'_\mathsf{CCY},s'}}, 
$
and 
$\ket{\phi_{1,1}}:= \ket{\phi_{0,1}}= \ket{\top}\ket{s^*}\ket{\psi_{\geq \delta}}$, and 
$F$ is a quantum algorithm that works as follows:

\smallskip
\noindent $F\left(\sum_{b_\mathsf{CCY},s}\ket{b_\mathsf{CCY}}\ket{s}\ket{\psi_{b_\mathsf{CCY},s}}\right)$:
It measures the first and second registers to get $b_\mathsf{CCY}$ and $s$ after which the third register collapses to $\ket{\psi_{b_\mathsf{CCY},s}}$. 
It outputs $\mathsf{Fail}$ if $b_\mathsf{CCY}=\bot$ and otherwise runs $(b,\rho_\mathsf{out}) \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \mathcal{G}(1^\lambda,1^{\gamma^{-1}},\ket{\psi_{b_\mathsf{CCY},s}},z)$.  If $b=\top$, it outputs $s$ and $\rho_\mathsf{out}$. 
Otherwise, it outputs  $\mathsf{Fail}$.  
\smallskip

Then, for $\ket{\phi_0}:= \ket{\phi_{0,0}}+\ket{\phi_{0,1}}$ and $\ket{\phi_1}:= \ket{\phi_{1,0}}+\ket{\phi_{1,1}}$, 
for any distinguisher $D$, \Cref{lem:state-close} gives the following:
\begin{align*}
    |\Pr[D(F(\ket{\phi_0}\bra{\phi_0}))=1]
    -\Pr[D(F(\ket{\phi_1}\bra{\phi_1}))=1]|
    \leq 4\gamma'^{1/4} 
\end{align*}
where  $\gamma':=   \max\left\{\Pr[F\left(\frac{\ket{\phi_{0,0}}}{\|\ket{\phi_{0,0}}\|}\right)\neq \mathsf{Fail}],\Pr[F\left(\frac{\ket{\phi_{1,0}}}{\|\ket{\phi_{1,0}}\|}\right)\neq \mathsf{Fail}]\right\}$ if $\gamma'<1/36$. 
By the definition of $F$, it is easy to see that $F(\ket{\phi_0}\bra{\phi_0})$ is distributed according to
$\mathsf{Exp}_\top(\lambda,1^{\gamma^{-1}},\ket{\psi},z)$ and the distribution of $F(\ket{\phi_1}\bra{\phi_1})$ is negligibly close to 
$\ensuremath{\mathcal{SE}}\xspace_\top(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)$ conditioned on the fixed internal measurement outcomes by $\mathsf{Ext}_\mathsf{CCY}$.  
Since this holds for overwhelming fraction of internal measurement outcomes by $\mathsf{Ext}_\mathsf{CCY}$, we have
\begin{align} \label{eq:real-ext-difference-two}
\{\ensuremath{\mathcal{SE}}\xspace_\top(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\sind_{4\gamma'^{1/4}} 
\{\mathsf{Exp}_\top(\lambda,1^{\gamma^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}.
\end{align}

By the definition of $F$, for any state of the form $\ket{\bot}\ket{s}\ket{\psi}$, we clearly have
\begin{align}\label{eq:b_CCY_is_bot}
     \Pr[F(\ket{\bot}\ket{s}\ket{\psi})\neq \mathsf{Fail}]=0.
\end{align}

Since $\ket{\psi_{<\delta}}\in S_{<\delta}$ and $\ket{\psi_{\mathsf{CCY},<\delta,\top,s'}}\in S_{<\delta}$ 
for all $s'$, 
by \Cref{item:extraction-variant:prob} of \Cref{lem:extraction-variant},  
we have 
\begin{align*}
   \Pr\left[\mathcal{A}_{\mathsf{CCY}}\left(\frac{\ket{\psi_{<\delta}}}{\|\ket{\psi_{<\delta}}\|}\right)= s^*\right]<\delta
\end{align*}
and 
\begin{align*}
   \Pr[\mathcal{A}_{\mathsf{CCY}}\left(\frac{\ket{\psi_{\mathsf{CCY},<\delta,\top,s'}}}{\|\ket{\psi_{\mathsf{CCY},<\delta,\top,s'}}\|}\right)= s^*]<\delta
\end{align*}
for any $s'$. 

Recalling that $\mathcal{A}_{\mathsf{CCY}}(\cdot)=\mathcal{K}(1^\lambda,1^{\gamma^{-1}},\cdot)$, 
by the contraposition of \Cref{item:gamma_delta} of \Cref{lem:extract_and_simulate}, the above inequalities imply
\begin{align} \label{eq:real_case}
\Pr[b=\top : (b,\rho_\mathsf{out}) \leftarrow \mathcal{G}\left(1^\lambda,1^{\gamma^{-1}},\frac{\ket{\psi_{<\delta}}}{\|\ket{\psi_{<\delta}}\|},z\right)]<  \gamma 
\end{align}
and 
\begin{align} \label{eq:simulated_case}
\Pr[b=\top : (b,\rho_\mathsf{out}) \leftarrow \mathcal{G}\left(1^\lambda,1^{\gamma^{-1}},\frac{\ket{\psi_{\mathsf{CCY},<\delta,\top,s'}}}{\|\ket{\psi_{\mathsf{CCY},<\delta,\top,s'}}\|},z\right)]<  \gamma 
\end{align}
for any $s'$.


By \Cref{eq:b_CCY_is_bot,eq:real_case,eq:simulated_case} and the definitions of $F$, $\ket{\phi_{0,0}}$, $\ket{\phi_{1,0}}$, and $\gamma'$, we can see that $\gamma'< \gamma=\left(\frac{\epsilon}{4}\right)^4$
and thus $\gamma<1/36$ holds for a sufficiently large security parameter $\lambda$.  
By plugging $4\gamma'^{1/4}< \epsilon$ into \Cref{eq:real-ext-difference-two}, we complete the proof of \Cref{lem:non-aborting_case}.  

\end{proof}

Given \Cref{lem:aborting_case} and \Cref{lem:non-aborting_case}, the rest of the proof of \Cref{lem:extract_and_simulate} is very similar to the corresponding part of the $\epsilon$-zero-knowledge property of the protocols in \cite{C:ChiChuYam21}.
We give the full proof for completeness. 


Let $\ensuremath{\mathcal{SE}}\xspace_{\mathsf{comb}}$ be an algorithm that works as follows:

\smallskip
\noindent
$\ensuremath{\mathcal{SE}}\xspace_{\mathsf{comb}}(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)$:
\begin{enumerate}
    \item Set $\epsilon':=\frac{\epsilon^2}{4\log^4(\lambda)}$.
    \item Choose $\mathsf{mode} \overset{\hspace{0.1em}\mathsf{\scriptscriptstyle\$}}{\leftarrow}  \{\top,\bot\}$.
    \item Run and output $\ensuremath{\mathcal{SE}}\xspace_{\mathsf{mode}}(1^\lambda,1^{\epsilon'^{-1}},\ket{\psi})$.
\end{enumerate}


\begin{lemma}[$\ensuremath{\mathcal{SE}}\xspace_{\mathsf{comb}}$ Simulates $\mathsf{Exp}$ with Probability almost $1/2$]\label{lem:comb}
Let $p_{\mathsf{comb}}^{\mathsf{suc}}(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)$ be the probability that $\ensuremath{\mathcal{SE}}\xspace_{\mathsf{comb}}(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)$ does not return $\mathsf{Fail}$, and let 
$$D_{\mathsf{ext},\mathsf{comb}}(1^\lambda, 1^{\epsilon^{-1}}, \ket{\psi},z)$$
 be a conditional  distribution of $\ensuremath{\mathcal{SE}}\xspace_{\mathsf{comb}}(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)$, conditioned on that it does not return $\mathsf{Fail}$.
Then we have 
\begin{align}
    \left|p_{\mathsf{comb}}^{\mathsf{suc}}(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)-1/2\right|\leq \epsilon'/2+\mathsf{negl}(\lambda). \label[Inequality]{eq:pcombsuc}
\end{align}
Moreover, we have 
\begin{align}
\{D_{\mathsf{ext},\mathsf{comb}}(1^\lambda, 1^{\epsilon^{-1}}, \ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\sind_{4\epsilon'} 
\{\mathsf{Exp}(\lambda,1^{\gamma^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}, \label{eq:simlcomb}
\end{align} 
where $\gamma := \left(\frac{\epsilon'}{4}\right)^4$.
\end{lemma} 
\begin{proof}(sketch.)
The intuition behind this proof is as follows. 
By \Cref{lem:aborting_case,lem:non-aborting_case}, $\ensuremath{\mathcal{SE}}\xspace_{\bot}$ and $\ensuremath{\mathcal{SE}}\xspace_\top$ almost simulate $\mathsf{Exp}$ conditioned on that $b=\bot$ and $b=\top$, respectively.
Therefore, if we randomly guess  $b$ and runs either of $\ensuremath{\mathcal{SE}}\xspace_{\bot}$ or $\ensuremath{\mathcal{SE}}\xspace_\top$ that successfully works for the guessed case, the output distribution is close to  the real output distribution of $\mathsf{Exp}$ conditioned on that the guess is correct, which happens with probability almost $1/2$.

A formal proof can be obtained based on the above intuition and is exactly the same as the proof of \cite[Lemma 5.5]{C:ChiChuYam21}
except for  notational adaptations.  

\end{proof}


Then, we convert $\ensuremath{\mathcal{SE}}\xspace_{\mathsf{comb}}$ into a full-fledged simulator that does not return $\mathsf{Fail}$ by using Watrous' rewinding lemma (\Cref{lem:quantum_rewinding}).
Namely, we let $\mathsf{Q}$ be a quantum algorithm that takes $\ket{\psi}$ as input and outputs $\ensuremath{\mathcal{SE}}\xspace_{\mathsf{comb}}(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)$ where $b:= 0$ if and only if  it does not return $\mathsf{Fail}$, $p_0:= \frac{1}{4}$, $q:= \frac{1}{2}$, $\alpha:= \epsilon'$,
and $T:= 2\log (1/\epsilon')$.
Then it is easy to check that the conditions for \Cref{lem:quantum_rewinding} is satisfied by \Cref{eq:pcombsuc} in \Cref{lem:comb} (for sufficiently large $\lambda$).
Then, by using \Cref{lem:quantum_rewinding}, we can see that $\mathsf{R}(1^T,\mathsf{Q},\ket{\psi})$ runs in time $T=\mathsf{poly}(\lambda)$ and its output (seen as a mixed state) has a trace distance bounded by $4\sqrt{\alpha}\frac{\log(1/\alpha)}{p_0(1-p_0)}$ from  $D_{\mathsf{ext},\mathsf{comb}}(1^\lambda, 1^{\epsilon^{-1}}, \ket{\psi},z)$.
Since we have $\alpha=\epsilon'=\frac{\epsilon^2}{4\log^4(\lambda)}=1/\mathsf{poly}(\lambda)$, we have $4\sqrt{\alpha}\frac{\log(1/\alpha)}{p_0(1-p_0)}< \sqrt{\alpha} \log^2 (\lambda)=\frac{\epsilon}{2}$ for sufficiently large $\lambda$
 where we used $\log(1/\alpha)=\log(\mathsf{poly}(\lambda))=o(\log^2(\lambda))$ and $\frac{4}{p_0(1-p_0)}=O(1)$.
Thus, by combining the above and \Cref{eq:simlcomb} in \Cref{lem:comb}, if we define $\ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z):= \mathsf{R}(1^T,\mathsf{Q},\ket{\psi})$,
then we have 
\begin{align*}
\{\ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\sind_{\frac{\epsilon}{2}+4\epsilon'} 
  \{\mathsf{Exp}(\lambda,1^{\gamma^{-1}},\ket{\psi},z)\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\end{align*}
where $\gamma = \left(\frac{\epsilon'}{4}\right)^4=\mathsf{poly}(\epsilon)$. 
We can conclude the proof of \Cref{lem:extract_and_simulate} by noting that  we have
    $\frac{\epsilon}{2}+4\epsilon'< \epsilon$
since we have $\epsilon'= \frac{\epsilon^2}{4\log^4(\lambda)} < \frac{\epsilon}{8}$ for sufficiently large $\lambda$.

\section{Small-Tag, Asynchronous, Classical Setting}
\label{sec:small-tag:async:classical}
In this section, we show how to make $\langle C, R \rangle^{\mathsf{sync}}_{\mathsf{tg}}$ (i.e., \Cref{prot:small-tag:sync:classical}) secure against asynchronous adversaries, to obtain the protocol $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$. We emphasize that this section still focuses on the small-tag setting against classical (i.e., non-uniform PPT) adversaries.




\subsection{High-Level Idea} 
\label{sec:small-tag:classical:async:high-level}
By a careful inspection, the proof of non-malleability of \Cref{prot:small-tag:sync:classical} (which is based on the proof of non-malleability of \Cref{prot:one-sided:classical}) relies on the following assumptions about the schedule. 
\begin{itemize}
    \item 
    The prefix of both the left and right sessions should be generated before moving forward. That is, 
    the left (resp. right) message of \Cref{item:small-tag:sync:step:committing} is sent before the right (resp. left) message of \Cref{item:small-tag:sync:step:OWFs} is sent. 
    This is necessary because we need to analyze the protocol for each fixed prefix $\mathsf{pref}$ in the security proof for \Cref{prot:small-tag:sync:classical}.
    \item 
    The left message of \Cref{item:small-tag:sync:step:OWFs} is sent before the right {\bf WIPoK-1-A} starts. This is needed because we rely on brute-force search to break hiding of $\mathsf{com}_i^A$ or $\mathsf{com}_i^B$ in an intermediate hybrid, where we rely on (non-uniform) WI of the right {\bf WIPoK-1-A}. This is possible only if we can do brute-force before the right {\bf WIPoK-1-A} starts so that the result of the brute-force can be treated as a non-uniform advice in the reduction to WI. (See \Cref{rmk:non-uniform_reduction}.)
    \item 
    The left (resp. right) {\bf WIPoK-1-A}  and the right (resp. left) {\bf WIPoK-1-B} do not interleave with each other. This is needed because we need to ensure that when rewinding the left {\bf WIPoK-1-A} (resp. {\bf WIPoK-1-B}), we do not rewind the right {\bf WIPoK-1-B} (resp. {\bf WIPoK-1-A}) as explained in \Cref{sec:proof:nm:small-tag:sync:classical:case2}.
    \item The left {\bf WIPoK-1-B} finishes before the right {\bf WIPoK-2} starts. This is needed because we rewind both of them simultaneously in the construction of the extractor $\mathcal{K}$.\footnote{In fact, it is also fine that the left {\bf WIPoK-1-A} \emph{starts} after the right {\bf WIPoK-2} \emph{finishes}, since they do not interleave with each other in this case either.} 
\end{itemize}
To deal with a schedule that does not satisfy some of the above conditions, we need to modify the protocol. Our modification is based on a combination of the following tricks.
\begin{enumerate}
    \item \label[Trick]{item:trick_extcom}
    Insert an extractable commitment to $m$ by $C$ between Steps $X$ and $X+1$. 
    We also modify the language for {\bf WIPoK-2} 
    to ensure that the committed message in the extractable commitment is the correct one.
    This 
    gives us an opportunity to extract the right message $\tilde{m}$ without extracting the left message $m$ in the man-in-the-middle game if the right Step $X+1$ starts before the left Step $X$ finishes. 
    \item \label[Trick]{item:trick_trapdoor}
    Insert a WIPoK proving some ``trapdoor statement" where $R$ plays the role of the prover between Steps $X$ and $X+1$. Here, the trapdoor is a witness for an NP language chosen by $R$. 
    We also modify the language for {\bf WIPoK-2} 
    to allow $C$ to use the trapdoor as a witness. Now, if the left Step $X+1$ starts before the right Step $X$ finishes, then we can  extract the left trapdoor without extracting the right trapdoor in the man-in-the-middle game. Then, we can use the extracted trapdoor as a witness for the left  {\bf WIPoK-2}. As a result, we can simulate the honest committer in the left session without using the message $m$. This enables us to extract the right message $\tilde{m}$ from the right {\bf WIPoK-2} without using the left message $m$, and eventually to prove non-malleability.  
    \item \label[Trick]{item:trick_repeat}
    Repeat Step $X$ as many times as the total round complexity of all steps before Step $X$ plus one. 
   
    By the pigeonhole principle, 
    this ensures that there is at least one execution of the left (resp. right) Step $X$ that does not interleave with all steps before Step $X$ in the right (resp. left). In particular, when we rewind that execution, it does not affect the security of any primitive on the other side. 
\end{enumerate}

\subsection{Construction of $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$}
We present our construction in \Cref{prot:small-tag:classical} where constants $n_5,...,n_9$ are specified later.
This protocol makes use of the same building blocks as for \Cref{prot:small-tag:sync:classical} plus an extractable commitment, namely:
 \begin{itemize}
 \item
An OWF $f$,  
\item
Naor's commitment $\mathsf{Com}$;
\item
A witness-indistinguishable proof of knowledge $\ensuremath{\mathsf{WIPoK}}\xspace$ 
(as per \Cref{def:WIPoK});
\item An extractable commitment $\ensuremath{\mathsf{ExtCom}}\xspace$ (as per \Cref{definition:ext-com}).
We denote by $\ensuremath{\mathsf{Verify}}\xspace_{\ensuremath{\mathsf{ExtCom}}\xspace}$ the verification algorithm of $\ensuremath{\mathsf{ExtCom}}\xspace$ in the decommit stage.  
\end{itemize} 

\begin{ProtocolBox}[label={prot:small-tag:classical}]{Small-Tag Asynchronous NMCom \textnormal{$\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$}}
The tag space is defined to be $[n]$ where $n$ is a polynomial on $\lambda$. Let $t \in [n]$ be the tag for the following interaction. Let $m$ be the message to be committed to. 

\para{Commit Stage:}
\begin{enumerate}
\item\label[Step]{item:small-tag:async:step:Naor-rho}
Receiver $R$ samples and sends the first message $\beta$ for Naor's commitment.
\item\label[Step]{item:small-tag:async:step:committing}
Committer $C$ commits to $m$ using the second message of Naor's commitment. $C$ also sends a $\beta'$ that will be used as the first Naor's message for $R$ to generate a commitment in next step. Formally, $C$ samples $r$ and $\beta'$ and sends the tuple $\big(\mathsf{com} = \mathsf{Com}_\beta(m;r),~\beta'\big)$. 

\item\label[Step]{item:small-tag:async:step:W-td}  $R$ and $C$ do the following:
\begin{enumerate}
\item {\bf (TrapGen.)}\label[Step]{item:small-tag:async:step:W-td:Z}
$R$ computes $V_0=f(v_0)$ and $V_1=f(v_1)$ with $v_0,v_1\ensuremath{\leftarrow}\xspace \{0,1\}^\lambda$ and sends $(V_0,V_1)$ to $C$ 
\item \label[Step]{item:small-tag:async:step:W-td:WIPoK} {\bf (WIPoK-Trap.)}
$R$ and $C$ execute an instance of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of $V_0$ or $V_1$.
Formally, $R$ proves that $(V_0,V_1) \in \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$, where
\begin{equation}\label[Language]{eq:small-tag:async:Lang:TD}
\ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}} \coloneqq \big\{(V_0,V_1)~\big|~\exists v ~s.t.~~f(v)=V_0~\vee~f(v)=V_1
\big\}.
\end{equation}
Note that $R$ uses $v_0$ as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.
\end{enumerate}
\subpara{Comment:}
This step is inserted for \Cref{item:trick_trapdoor} in \Cref{sec:small-tag:classical:async:high-level} where a witness for $(V_0,V_1) \in \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ plays the role of a ``trapdoor". 

\item\label[Step]{item:small-tag:async:step:OWFs}
$R$ performs the following computation:
\begin{enumerate}
\item \label[Step]{item:small-tag:async:step:OWFs:A}
$R$ computes $\Set{y^A_i = f(x^A_i)}_{i \in [t]}$ with $x^A_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [t]$, and sets $Y^A \coloneqq (y^A_1, \ldots, y^A_t)$. $R$ also computes $\Set{\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i;r^A_i)}_{i\in [t]}$, where $r^A_i$ is a random string for each $i\in [t]$.  
\item \label[Step]{item:small-tag:async:step:OWFs:B}
$R$ computes $\Set{y^B_i = f(x^B_i)}_{i \in [n-t]}$ with $x^B_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [n-t]$, and sets $Y^B \coloneqq (y^B_1, \ldots, y^B_{n-t})$. $R$ also computes $\Set{\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i;r^B_i)}_{i\in [n-t]}$, where $r^B_i$ is a random string for each $i\in [n-t]$.  
\end{enumerate}
$R$ sends the tuple $\big(Y^A,~\Set{\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i;r^A_i)}_{i\in [t]},~Y^B,~\Set{\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i;r^B_i)}_{i\in [n-t]}\big)$.

\item\label[Step]{item:small-tag:async:step:ExtCom:1}
{\bf (ExtCom-1 $\times~n_5$.)}
$C$ and $R$ sequentially execute $n_5$ instances of $\ensuremath{\mathsf{ExtCom}}\xspace$ where $C$ commits to $m$. For $i\in [n_5]$, let $\tau^1_i$ and $\ensuremath{\mathsf{decom}}\xspace^1_i$ be the transcript and decommitment information (privately obtained by $C$) of the $i$-th execution. 

\subpara{Comment:}
This step is inserted for \Cref{item:trick_extcom} 
and repeated for \Cref{item:trick_repeat}  
in \Cref{sec:small-tag:classical:async:high-level}.

\item\label[Step]{item:small-tag:async:step:WIPoK:1A}
{\bf (WIPoK-1-A $\times~n_6$.)} $R$ and $C$ sequentially execute $n_6$ instances of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y^A_i$ contained in $Y^A$, and $y^A_i$ are consistent with $\mathsf{com}^A_i$ (as defined in \Cref{item:small-tag:async:step:OWFs:A}). Formally, $R$ proves that $(Y^A, \Set{\mathsf{com}^A_i}_{i\in[t]}) \in \ensuremath{\mathcal{L}}\xspace^t_{f,\beta'}$, where
\begin{equation}\label[Language]{eq:small-tag:async:Lang:OWF:A}
\ensuremath{\mathcal{L}}\xspace^t_{f,\beta'} \coloneqq \Bigg\{(y^A_1, \ldots, y^A_t), (\mathsf{com}^A_1, \ldots, \mathsf{com}^A_t)~\Bigg|~\exists (i, x^A_i, r^A_i) ~s.t.~~
\begin{array}{l}
i \in [t] ~\wedge \\
y^A_i = f(x^A_i) ~\wedge \\
\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i; r^A_i)
\end{array}\Bigg\}.
\end{equation}
Note that $R$ uses $(1, x^A_1, r^A_1)$ as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.

\subpara{Comment:}
This step is repeated for \Cref{item:trick_repeat}  
in \Cref{sec:small-tag:classical:async:high-level}.

\item\label[Step]{item:small-tag:async:step:ExtCom:2}
{\bf (ExtCom-2 $\times~n_7$.)}
$C$ and $R$ sequentially execute $n_7$ instances of $\ensuremath{\mathsf{ExtCom}}\xspace$ where $C$ commits to $m$. Let $\tau^2_i$ and $\ensuremath{\mathsf{decom}}\xspace^2_i$ be the transcript and decommitment (privately obtained by $C$) of the $i$-th execution. 

\subpara{Comment:}
This step is inserted for \Cref{item:trick_extcom} 
and repeated for \Cref{item:trick_repeat}  
in \Cref{sec:small-tag:classical:async:high-level}.


\item\label[Step]{item:small-tag:async:step:WIPoK:1B}
{\bf (WIPoK-1-B $\times~n_8$.)} $R$ and $C$ sequentially execute $n_8$ instances of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y^B_i$ contained in $Y^B$, and $y^B_i$ are consistent with $\mathsf{com}^B_i$ (as defined in \Cref{item:small-tag:async:step:OWFs:B}). Formally, $R$ proves that $(Y^B, \Set{\mathsf{com}^B_i}_{i\in[n-t]}) \in \ensuremath{\mathcal{L}}\xspace^{n-t}_{f,\beta'}$, where
\begin{equation}\label[Language]{eq:small-tag:async:Lang:OWF:B}
\ensuremath{\mathcal{L}}\xspace^{n-t}_{f,\beta'} \coloneqq \Bigg\{(y^B_1, \ldots, y^B_{n-t}), (\mathsf{com}^B_1, \ldots, \mathsf{com}^B_{n-t})~\Bigg|~\exists (i, x^B_i, r^B_i) ~s.t.~~ 
\begin{array}{l}
i \in [n-t] ~\wedge \\
y^B_i = f(x^B_i) ~\wedge \\
\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i; r^B_i)
\end{array}\Bigg\}.
\end{equation}
Note that $R$ uses $(1, x^B_1, r^B_1)$ as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.

\subpara{Comment:}
This step is repeated for \Cref{item:trick_repeat}  
in \Cref{sec:small-tag:classical:async:high-level}.

\item\label[Step]{item:small-tag:async:step:ExtCom:3}
{\bf (ExtCom-3 $\times~n_9$.)}
$C$ and $R$ sequentially execute $n_9$ instances of $\ensuremath{\mathsf{ExtCom}}\xspace$ where $C$ commits to $m$. Let $\tau^2_i$ and $\ensuremath{\mathsf{decom}}\xspace^2_i$ be the transcript and decommitment (privately obtained by $C$) of the $i$-th execution.

\subpara{Comment:}
This step is inserted for \Cref{item:trick_extcom} 
and repeated for \Cref{item:trick_repeat}  
in \Cref{sec:small-tag:classical:async:high-level}.


\item\label[Step]{item:small-tag:async:step:WIPoK:2}
{\bf (WIPoK-2.)} $C$ and $R$ execute an instance of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $C$ proves to $R$ that he ``knows'' the (same) message committed in $\mathsf{com}$ (defined in \Cref{item:small-tag:async:step:committing}) and all commitments $\tau^c_i$ of $\ensuremath{\mathsf{ExtCom}}\xspace$ (in \Cref{item:small-tag:async:step:ExtCom:1,item:small-tag:async:step:ExtCom:2,item:small-tag:async:step:ExtCom:3}), {\em or} a pre-image of some $y^A_i$ contained in $Y^A$ (defined in \Cref{item:small-tag:async:step:OWFs:A}), {\em or} a pre-image of some $y^B_i$ contained in $Y^B$ (defined in \Cref{item:small-tag:async:step:OWFs:B})
{\em or} a preimage of either of $V_0$ or $V_1$ (defined in \Cref{item:small-tag:async:step:W-td:Z}). Formally, $C$ proves that $(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace}, Y^A, Y^B, V_0,V_1) \in \ensuremath{\mathcal{L}}\xspace_{\beta} \vee \ensuremath{\mathcal{L}}\xspace^t_f \vee \ensuremath{\mathcal{L}}\xspace^{n-t}_f \vee \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$,
where $\ensuremath{J}\xspace=(\{1\}\times [n_5])\cup (\{2\}\times [n_7])\cup (\{3\}\times [n_9])$, 
\begin{align}
& \ensuremath{\mathcal{L}}\xspace_{\beta} \coloneqq \Bigg\{(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace}) ~\Bigg|
\begin{array}{l}
~ \exists (m, r,\{\ensuremath{\mathsf{decom}}\xspace^c_i\}_{(c,i)\in \ensuremath{J}\xspace})~s.t.~\\ 
\begin{array}{l}
\mathsf{com} = \mathsf{Com}_\beta(m;r)~\wedge\\
\forall~(c,i)\in \ensuremath{J}\xspace,~ \ensuremath{\mathsf{Verify}}\xspace_{\ensuremath{\mathsf{ExtCom}}\xspace}(m,\tau^c_i,\ensuremath{\mathsf{decom}}\xspace^c_i)=\top\\
\end{array}
\end{array}
\Bigg\}
\label[Language]{eq:small-tag:async:Lang:Com}\\
& \ensuremath{\mathcal{L}}\xspace^t_f \coloneqq \Set{(y^A_1, \ldots, y^A_t) ~|~ \exists (i, x^A_i)~s.t.~ i \in [t] \wedge y^A_i = f(x^A_i)}, \\
& \ensuremath{\mathcal{L}}\xspace^{n-t}_f \coloneqq \Set{(y^B_1, \ldots, y^B_{n-t}) ~|~ \exists (i, x^B_i)~s.t.~ i \in [n-t] \wedge y^B_i = f(x^B_i)},
\end{align}
and $\ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ is defined in \Cref{eq:small-tag:async:Lang:TD}. 
Note that $C$ uses the $(m, r, \{\ensuremath{\mathsf{decom}}\xspace^c_i\}_{(c,i)\in\ensuremath{J}\xspace})$ defined in \Cref{item:small-tag:async:step:committing,item:small-tag:async:step:ExtCom:1,item:small-tag:async:step:ExtCom:2,item:small-tag:async:step:ExtCom:3} as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.

\subpara{Comment:} Compared with \Cref{item:small-tag:sync:step:WIPoK:2} of \Cref{prot:small-tag:sync:classical}, we add $\ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ as an additional OR part to the language to be proven for \Cref{item:trick_trapdoor} in \Cref{sec:small-tag:classical:async:high-level}. 
We also modify $\ensuremath{\mathcal{L}}\xspace_{\beta}$ to prove that all commitments $\tau^c_i$ of $\ensuremath{\mathsf{ExtCom}}\xspace$ commit to the same message as $\mathsf{com}$ for \Cref{item:trick_extcom} in \Cref{sec:small-tag:classical:async:high-level}. 
\end{enumerate}
\para{Decommit Stage:} 
$C$ sends $(m, r)$. $R$ accepts if $\mathsf{com} = \mathsf{Com}_\beta(m;r)$, and rejects otherwise.
\end{ProtocolBox}
\para{Choice of $n_i$.}
We recursively define $n_5,...,n_9$ so that 
$n_i$ is larger than the total round complexity of Steps $1$ to $i-1$. We also require that $n_5$ is larger than the round complexities of $\ensuremath{\mathsf{WIPoK}}\xspace$ and $\ensuremath{\mathsf{ExtCom}}\xspace$. It is easy to see that we can set $n_i$ to be constant if both $\ensuremath{\mathsf{WIPoK}}\xspace$ and $\ensuremath{\mathsf{ExtCom}}\xspace$ have constant rounds. In particular, \Cref{prot:small-tag:classical} runs in constant rounds.  
We remark that the above choice of $n_i$ is for simplifying the security analysis and we could significantly optimize the exact round complexity with  more careful analysis. But we choose not to press the issue further.

\para{Notation.}
For $c=1,2,3$, 
we refer to the $i$-th execution of $\ensuremath{\mathsf{ExtCom}}\xspace$ in {\bf ExtCom-$c$} as {\bf ExtCom-$c$-$i$}.
We also define {\bf WIPoK-1-A-$i$} and  {\bf WIPoK-1-B-$i$} similarly. 

\para{Security.}
The completeness is easy to see. Statistical binding follows from that of Naor's commitment. We prove computational hiding below.\footnote{Though computational hiding follows from non-malleability, we prove it here because we rely on the computational hiding in the proof of non-malleability.}
\begin{theorem}\label{thm:small-tag:async:classical:hiding}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is computationally hiding.
\end{theorem}
\begin{proof}
Let $R^*$ be a non-uniform PPT adversary against the computational hiding property of \Cref{prot:small-tag:classical}. 
We consider the following sequence of hybrids. 

\begin{itemize}
\item {Hybrid $H_1^{R^*}(\lambda,m)$:} This is the real experiment that simulates the interaction between $C(m)$ and $R^*$. That is, it runs $\langle C(m), R^*\rangle_{\mathsf{tg}}(1^\lambda)$ and outputs the final output of $R^*$. We have to prove 
\begin{align}\label{eq:break_hiding}
    \left|\Pr[H_1^{R^*}(\lambda,m_0)=1]-\Pr[H_1^{R^*}(\lambda,m_1)=1]\right|=\mathsf{negl}(\lambda).
\end{align}
for all $m_0,m_1$. 
\item {Hybrid $H_2^{R^*}(\lambda,m)$:} 
This is identical to $H_1^{R^*}(\lambda,m)$ except that it runs the emulation extractor for {\bf WIPoK-1-A-1} to extract a witness $(i,x^A_i,r^A_i)$ for  $(Y^A, \Set{\mathsf{com}^A_i}_{i\in[t]}) \in \ensuremath{\mathcal{L}}\xspace^t_{f,\beta'}$ where $Y^A$ and $\Set{\mathsf{com}^A_i}_{i\in[t]})$ are generated in \Cref{item:small-tag:async:step:OWFs:A}. We note that this experiment extracts $(i,x^A_i,r^A_i)$ but does not use it. 
By the PoK property (as per \Cref{def:WEE}) of {\bf WIPoK-1-A-1}, we have 
\begin{align}\label{eq:hiding_hybrid_one}
    \left|\Pr[H_1^{R^*}(\lambda,m)=1]-\Pr[H_2^{R^*}(\lambda,m)=1]\right|=\mathsf{negl}(\lambda)
\end{align}
for all $m$.

\item {Hybrid $H_3^{R^*}(\lambda,m)$:} 
This is identical to $H_2^{R^*}(\lambda,m)$ except that it uses $(i,x^A_i,r^A_i)$ extracted from {\bf WIPoK-1-A-1} in {\bf WIPoK-2}.
By the WI property of {\bf WIPoK-2}, we have 
\begin{align}\label{eq:hiding_hybrid_two}
    \left|\Pr[H_2^{R^*}(\lambda,m)=1]-\Pr[H_3^{R^*}(\lambda,m)=1]\right|=\mathsf{negl}(\lambda)
\end{align}
for all $m$.

We observe that $H_3^{R^*}(\lambda,m_b)$ uses $m$ only in the generation of $\mathsf{com}$ (in \Cref{item:small-tag:async:step:committing}) and $\tau^c_i$ for $(c,i)\in\ensuremath{J}\xspace$  (in \Cref{item:small-tag:async:step:ExtCom:1,item:small-tag:async:step:ExtCom:2,item:small-tag:async:step:ExtCom:3}). Therefore, by the computational hiding property of Naor's commitment and $\ensuremath{\mathsf{ExtCom}}\xspace$, we have 
\begin{align}\label{eq:break_hiding_two}
    \left|\Pr[H_3^{R^*}(\lambda,m_0)=1]-\Pr[H_3^{R^*}(\lambda,m_1)=1]\right|=\mathsf{negl}(\lambda)
\end{align}
for all $m_0,m_1$.
Combining \Cref{eq:hiding_hybrid_one,eq:hiding_hybrid_two,eq:break_hiding_two}, we obtain \Cref{eq:break_hiding}.
\end{itemize}
This completes the proof of \Cref{thm:small-tag:async:classical:hiding}.

\end{proof}

We establish non-malleability by \Cref{thm:nm:small-tag:classical}, whose proof will be presented in \Cref{sec:proof_NM_async}.
\begin{theorem}\label{thm:nm:small-tag:classical}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is non-malleable against asynchronous PPT adversaries with tag space $[n]$, with $n$ being any polynomial on $\lambda$.
\end{theorem}


\subsection{Adaptive Schedule vs. Predetermined Schedule}
\label{sec:adaptive-predetermined:two-slot:async}
Before proving the non-malleability of \Cref{prot:small-tag:classical}, we prove a useful lemma that enable us to use {\em predetermined} schedules when proving non-malleability.  
The following \Cref{lem:adaptive-predetermined:async}  should be attributed to \cite[Lemma 5.1]{BLS21}: Although they only show this lemma for their specific construction, their proof technique is general enough. Our proof of \Cref{lem:adaptive-predetermined:async} is identical to theirs except for some notational changes customized to our application.
\begin{lemma}[{\cite[Lemma 5.1]{BLS21}}]\label{lem:adaptive-predetermined:async}
Let $\ensuremath{\mathcal{S}}\xspace$ be the set of all possible schedules of a MIM adversary against a commitment scheme $\langle C,R \rangle$. 
Let $S_1,...,S_N$ be efficiently recognizable subsets of $\ensuremath{\mathcal{S}}\xspace$ such that $\bigcup_{i\in [N]}S_i=\ensuremath{\mathcal{S}}\xspace$ for $N=\mathsf{poly}(\lambda)$.
If {\em for every $i\in [N]$}, 
$\langle C,R \rangle$ is non-malleable against non-uniform PPT MIM adversaries whose schedule belongs to $S_i$, then it is also non-malleable against arbitrary non-uniform PPT MIM adversaries.
\end{lemma}
\begin{proof}
We can assume that $S_1,...,S_N$ are disjoint w.l.o.g. (If they are not disjoint, we can define $S'_1:= S_1$, $S'_{i}:= S_{i}\setminus \left(\bigcup_{j\in [i-1]}S_j\right)$ for $i>1$ and consider disjoint sets $S'_1,...,S'_N$.)

Given an arbitrary non-uniform PPT MIM $\mathcal{M}$ and non-uniform PPT distinguisher $\mathcal{D}$ that break non-malleability for some
values $m_0, m_1$ with advantage $\delta$, we construct a new non-uniform PPT adversary with a schedule that belongs to $S_i$ for a predetermined $i\in [n]$, which
breaks the scheme with probability $\delta/N$.

Consider an adversary $\mathcal{M}'$ that first samples uniformly at random $i\ensuremath{\leftarrow}\xspace [N]$. $\mathcal{M}'$ then runs  $\mathcal{M}$ to complete the MIM attack. If the transcript generated in the execution belongs to $S_i$, 
$\mathcal{M}'$ outputs whatever $\mathcal{M}$ outputs, and otherwise outputs $\bot$. 

Since every execution must belong to exactly one of $S_1,...,S_N$, $\mathcal{M}'$ breaks non-malleability
with probability exactly $\delta/N$  (with respect to the same distinguisher $\mathcal{D}$ and $m_0, m_1$). Finally, by an
averaging argument, we fix the choice of $\mathcal{M}'$ for a schedule to be of some type $S_i$ that maximizes
$\mathcal{D}$'s distinguishing advantage. We obtain a corresponding MIM with a schedule that belongs to $S_i$ for a predetermined $i\in [n]$ with at least
the same advantage $\delta/N$.

\end{proof}


\subsection{Proving Non-Malleability (Proof of \Cref{thm:nm:small-tag:classical})}\label{sec:proof_NM_async}


For proving \Cref{thm:nm:small-tag:classical}, we consider the following ``bad'' schedules:
\begin{itemize}
    \item{$\mathsf{Bad}~1$:} \label{item:bad_case:1}
    The right message of \Cref{item:small-tag:async:step:OWFs} is sent before the left message of \Cref{item:small-tag:async:step:committing} is sent. \item{$\mathsf{Bad}~2$:} \label{item:bad_case:2}
    The left message of \Cref{item:small-tag:async:step:OWFs} is sent before the right message of \Cref{item:small-tag:async:step:committing} is sent.
    \item{$\mathsf{Bad}~3$:} \label{item:bad_case:3}
    The right {\bf WIPoK-1-A} starts before the left    message of \Cref{item:small-tag:async:step:OWFs} is sent.
 \item{$\mathsf{Bad}~4$:} \label{item:bad_case:4}
    The right {\bf WIPoK-1-B} starts before the left {\bf WIPoK-1-A} finishes.  
 \item{$\mathsf{Bad}~5$:} \label{item:bad_case:5}
    The right {\bf WIPoK-2} starts before the left {\bf WIPoK-1-B} finishes.   
\end{itemize}
In the above, when we say ``{\bf WIPoK-XX} starts", this means that the first message of the first execution of $\ensuremath{\mathsf{WIPoK}}\xspace$ in {\bf WIPoK-XX} is sent. Similarly, when we say ``{\bf WIPoK-XX} finishes", this means that the final message of the final execution of $\ensuremath{\mathsf{WIPoK}}\xspace$ in {\bf WIPoK-XX} is sent. 
We remark that the above bad cases are not disjoint.  

We first prove non-malleability in the case where the schedule does not suffer from any of them (which we call a \emph{good} schedule) in \Cref{sec:NM:good}. Then, we prove it for the remaining schedules (which we call \emph{bad} schedules) in \Cref{sec:NM:bad}. 
We remark that we can analyze them separately due to \Cref{lem:adaptive-predetermined:async}. 

\subsection{Non-Malleability for Good Schedules}\label{sec:NM:good}
Based on the observations made in \Cref{sec:small-tag:classical:async:high-level}, we can show the non-malleability analogously to the synchronous case if none of $\mathsf{Bad}~1$-$5$ occurs. 
\begin{lemma}\label{lem:good_case}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is non-malleable against asynchronous PPT adversaries whose schedule does not suffer from any of $\mathsf{Bad}~1$-$5$.
\end{lemma}
\begin{proof}
Similarly to the proof of non-malleability of \Cref{prot:small-tag:sync:classical} in \Cref{sec:small-tag:classical:sync}, we consider the three cases of $t=\tilde{t}$, $t<\tilde{t}$, and $\tilde{t}<t$ separately where $t$ and $\tilde{t}$ are the tags of the left and right sessions, respectively. 
We remark that we can assume that the reduction algorithm knows which of them happens from the beginning because of \Cref{lem:adaptive-predetermined:async}, even if the adversary adaptively determines the schedule.  

Again, the case of $t=\tilde{t}$ is already ruled out by the definition of non-malleability. Next, we analyze the remaining two cases in \Cref{lem:good_case:proof:le,lem:good_case:proof:ge}, which will eventually complete the proof of \Cref{lem:good_case}. 

\end{proof}


\subsubsection{The Case of $t<\tilde{t}$.}\label{lem:good_case:proof:le}
For a PPT man-in-the-middle adversary $\mathcal{M}$ with non-uniform advice $z$ and a message $m$, we define the prefix generation algorithm $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ as follows similarly to that in \Cref{hybrid:H:reinterpretation}: 
$H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ runs the man-in-the-middle experiment  $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg}}}(\lambda, m, z)$  
until $\mathcal{M}$ receives the left message of \Cref{item:small-tag:async:step:committing} \emph{and} sends the right message of \Cref{item:small-tag:async:step:committing}. 
Then, it outputs the prefix $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau, \tilde{\tau})$ where $\mathsf{st}_{\mathcal{M}}$,  $\mathsf{st}_C$, $\mathsf{st}_R$ are the states of $\mathcal{M}$, $C$, and $R$ at this point, respectively; And $\tau$ (reps.\ $\tilde{\tau}$) is Naor's commitment in the right (resp.\ left) session generated in \Cref{item:small-tag:async:step:Naor-rho,item:small-tag:async:step:committing}. 
We denote by $\mathcal{A}(\mathsf{st}_{\mathcal{M}})$ to mean the algorithm that works similarly to $\mathcal{M}$ from the point where the prefix is generated. 
We remark that $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ does not reach to \Cref{item:small-tag:async:step:OWFs} in either of the left or right session since we assume that neither of $\mathsf{Bad}~1$ or $\mathsf{Bad}~2$ occurs. 

We define a machine $\mathcal{G}_i$ similarly to that used in the proof of \Cref{lem:small-tag:proof:se:proof:K} (recall it from  \Cref{figure:one-sided:Gi}) except that $C$ commits to $0$ instead of $m$ in the left session. Formally, it works as follows: 

\para{Machine $\mathcal{G}_i$:}  For a prefix $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau, \tilde{\tau})$, $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ runs the rest of $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg}}}(\lambda, m, z)$ except for the following three differences:
\begin{enumerate}
    \item $C$ commits to $0$ instead of $m$ in the left {\bf ExtCom-\{1,2,3\}}. 
    \item $R$ uses $(i,\tilde{x}^A_i)$ instead of $(1,\tilde{x}^A_1)$ in the right {\bf WIPoK-1-A}.
\item It chooses $i^*$ such that the left {\bf WIPoK-1-A-$i^*$} does not interleave with the right Step \ref{item:small-tag:async:step:Naor-rho} to \ref{item:small-tag:async:step:ExtCom:1}, i.e., no message of the right Step \ref{item:small-tag:async:step:Naor-rho} to \ref{item:small-tag:async:step:ExtCom:1} is sent during the execution of the left {\bf WIPoK-1-A-$i^*$}. 
Note that such $i^*$ exists by the pigeonhole principle, and we call the smallest such $i^*$ the \emph{good} index. 
Then, instead of executing the left {\bf WIPoK-1-A-$i^*$} honestly, it uses the witness-extended emulator $\mathcal{WE}$ to extract a witness:
\begin{itemize}
\item
 If the left committer accepts the left {\bf WIPoK-1-A-$i^*$} and the extracted witness $(j,x^A_j,r^A_j)$ is valid, $\mathcal{G}_i$ uses $(j,x^A_j)$ to finish the left {\bf WIPoK-2} and outputs $\mathcal{M}$'s final state and the right receiver's decision bit $b$; 
 \item
 If the left committer accepts the left {\bf WIPoK-1-A-$i^*$}  but the extracted witness is invalid, it aborts immediately and outputs $(\bot, \bot)$;
 \item 
 If the left committer rejects the left {\bf WIPoK-1-A-$i^*$}, it runs the rest of man-in-the-middle experiment to output $\mathcal{M}$'s final state and the right receiver's decision bit $b$.  Note that it does not need to run the left {\bf WIPoK-2} in this case since the left committer aborts after the left {\bf WIPoK-1-A-$i^*$}.

\end{itemize}
\end{enumerate}
We let $p^{\mathsf{Sim}}_{\mathsf{pref}}$ be the probability that $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ returns $b=\top$. 

\begin{remark}\label{rem:adaptive_good_slot}
Strictly speaking, the above description of $\mathcal{G}_i$ is not well-defined since the good index depends on the schedule, which is adaptively determined. However, since there are constant number of possibilities for the good index, we only have to prove non-malleability assuming that the good index is fixed at first by \Cref{lem:adaptive-predetermined:async}.
A similar remark applies to later parts of the current proof. We will not repeat it as it should be clear from context. 
\end{remark}

By repeating similar arguments as in \Cref{one-sided:non-malleability:proof:classical,sec:one-sided:core-lemma:proof,lem:small-tag:proof:se:proof},  we can see that it suffices to prove the following lemma, which is an analog of \Cref{lem:small-tag:proof:se:proof:K}. 
\begin{lemma}\label{lem:small-tag:proof:se:proof:K:asyn}
There exists an expected PPT machine $\mathcal{K}$ such that for any $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau, \tilde{\tau})$ in the support of $H^{\mathcal{M}}_{\mathsf{pre}}(\lambda, m, z)$ and any noticeable $\epsilon(\lambda)$, the following holds:
\begin{enumerate}
\item \label[Property]{property:small-tag:proof:se:proof:K:syntax:asyn}
{\bf (Syntax.)} $\mathcal{K}$ takes as input $(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})$ and makes oracle access to $\ensuremath{\mathcal{A}}\xspace(\mathsf{st}_{\mathcal{M}})$. It output a value $\mathsf{Val}_{\mathcal{K}} \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \cup \Set{\bot}$ such that $\mathsf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val}_{\mathcal{K}} \ne \bot$.


\item \label[Property]{property:small-tag:proof:se:proof:K:asyn}
If $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, then it holds that
$$\Pr[\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau}) : \msf{Val}_{\mathcal{K}} \gets \mathcal{K}^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \frac{\epsilon'(\lambda)}{\tilde{t}},$$
where  $\epsilon'(\lambda) \coloneqq \frac{\epsilon(\lambda)}{10t^2}$.
\end{enumerate}
\end{lemma}
\begin{proof}[Proof of \Cref{lem:small-tag:proof:se:proof:K:asyn}]
We construct $\mathcal{K}_i$ and $\mathcal{K}$ similarly as in \Cref{sec:proof:nm:small-tag:sync:classical:case2}, which is in turn based on the technique in \Cref{sec:lem:small-tag:proof:se:proof:K:proof}.  

\para{Machine $\mathcal{K}_i$ ($i \in [\tilde{t}]$):} 
On input $(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})$, it behaves identically to $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$  except for the following difference. Machine $\mathcal{K}_i^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau}))$ uses the witness-extended emulator $\mathcal{WE}$ to finish the right {\bf WIPoK-2}, instead of playing the role of the honest receiver.  If it extracts a witness for $(\tilde{\mathsf{com}},\{\tilde{\tau}^c_i\}_{(c,i)\in \ensuremath{J}\xspace})\in \ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}$, then it sets $\msf{Val}$ to be the first component $\tilde{m}$ of the witness (which is suppose to be the committed message in $\tilde{\tau}$) and outputs $\msf{Val}=\tilde{m}$; Otherwise, it outputs $\bot$. 


\para{Extractor $\mathcal{K}$:}  On input $(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})$, it samples uniformly at random an index $i \ensuremath{\leftarrow}\xspace [\tilde{t}]$, executes $\mathcal{K}_i^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})$, and outputs whatever $\mathcal{K}_i^{\mathcal{A}(\mathsf{st}_{\mathcal{M}})}(1^\lambda, \mathsf{st}_R, \tau, \tilde{\tau})$ outputs.

We can show that $\mathcal{K}$ as described above satisfies \Cref{lem:small-tag:proof:se:proof:K:asyn} by similar analyses to those in \Cref{sec:lem:small-tag:proof:se:proof:K:proof,sec:lem:bound:Ki:proof,sec:proof:claim:K'':non-abort} additionally relying on the computational hiding property of $\ensuremath{\mathsf{ExtCom}}\xspace$ along with the following observations:
\begin{enumerate}
    \item By our choice of the good index $i^*$, the witness-extended emulator for the left {\bf WIPoK-1-A-$i^*$} does not rewind the right {\bf WIPoK-Trap}. Thus, $\mathcal{K}_i$ does not extract a ``trapdoor witness" (i.e., a witness for $(\tilde{V}_0,\tilde{V}_1)\in \ensuremath{\mathcal{L}}\xspace_f^{\mathrm{OR}}$) except for a negligible probability by the one-wayness of $f$ and the WI property of the right {\bf WIPoK-Trap}.
    \item \label{item:WIPoK-1-A_does_not_rewind_WIPoK-1-B}
    Since we assume that $\mathsf{Bad}~4$ does not occur, the witness-extended emulator for the left {\bf WIPoK-1-A-$i^*$} does not rewind the right {\bf WIPoK-1-B}. Thus, $\mathcal{K}_i$ does not extract a witness for {\bf Slot-B}, (i.e., a witness for $\tilde{Y}^B\in \ensuremath{\mathcal{L}}\xspace_f^{n-t}$) except for a negligible probability by the one-wayness of $f$ and the WI property of the right {\bf WIPoK-1-B}. This can be proven by a similar analysis to that in \Cref{sec:proof:nm:small-tag:sync:classical:case2}. 
    \item 
    Since we assume that $\mathsf{Bad}~3$ does not occur, we can rely on the WI property of the right {\bf WIPoK-1-A} in a hybrid where we find the committed messages in $\{\mathsf{com}_i^A\}_{i\in [t]}$ by brute-force. This is needed in a step corresponding to the proof of \Cref{eq:relation:K:WI} in \Cref{sec:lem:bound:Ki:proof}.
    \item Since  we assume that $\mathsf{Bad}~5$ does not occur,
    the left {\bf WIPoK-1-A} and the right {\bf WIPoK-2} do not run simultaneously. Thus, there is no nesting of extractors in hybrids where we invoke extractors for both of them (e.g., $\mathcal{K}$ and $\mathcal{K}_i$).
\end{enumerate}
\begin{remark}
One might wonder how we rely on the computational hiding property of the left {\bf ExtCom-\{1,2,3\}} even though the witness-extended emulator of the right {\bf WIPoK-2} may rewind them. However, one can see by a close inspection of the proof that we only need to use computational hiding of the left {\bf ExtCom-\{1,2,3\}} in hybrids that do not run the witness-extended emulator of the right {\bf WIPoK-2}. This is similar to how we replace the witness used in the left  {\bf WIPoK-2} using the WI property in the proof for the one-sided synchronous case in \Cref{sec:small-tag-one-sided-sync-classical}.
\end{remark}

This completes the proof of \Cref{lem:small-tag:proof:se:proof:K:asyn}, which finishes the proof for the case of $t<\tilde{t}$. 

\end{proof}

\subsubsection{The Case of $t>\tilde{t}$}\label{lem:good_case:proof:ge}
Similarly to the synchronous case (i.e., the proof of \Cref{thm:nm:small-tag:sync:classical}), the proof of this case can be done similarly to that of the case of $t<\tilde{t}$ except that we extract a witness from (the good index of) the left {\bf WIPoK-1-B} instead of from {\bf WIPoK-1-A}. In doing so, one has to be careful that $\mathsf{Bad}~4$ is not symmetric for {\bf Slot-A} and {\bf Slot-B}. In particular, even if we assume that $\mathsf{Bad}~4$ does not occur, it may be still possible that 
the \emph{left} {\bf WIPoK-1-B} and the \emph{right} {\bf WIPoK-1-A} run concurrently. However, this is not an issue since we rewind the left {\bf WIPoK-1-B} of the good index that does not interleave with \emph{any} message of the right session before {\bf WIPoK-1-B}. In particular, its rewinding does not rewind \emph{any} slot of the right {\bf WIPoK-1-A}. 
Except for the above remark, the proof of this case is almost identical to the proof for the case of $t<\tilde{t}$ with the roles of {\bf Slot-A} and {\bf Slot-B} being swapped. 



\subsection{Non-Malleability for Bad Schedules}\label{sec:NM:bad}
Before analyzing bad cases, we show a lemma that is used many times in the analysis of bad cases.
\begin{lemma}\label{lem:ExtCom_soundness}
Let $C^*$ be a PPT cheating prover of the protocol in \Cref{prot:small-tag:classical} with advice $z$.  
For $(c,i)\in \ensuremath{J}\xspace$ (where $\ensuremath{J}\xspace=(\{1\}\times [n_5])\cup (\{2\}\times [n_7])\cup (\{3\}\times [n_9])$ as defined in \Cref{item:small-tag:async:step:WIPoK:2} of \Cref{prot:small-tag:classical}) we define experiments $\mathsf{Exp}$ and $\mathsf{Exp}_{c,i}$ as follows.

\begin{itemize}
    \item{\emph{Experiment} $\mathsf{Exp}(\lambda,z)$:}
It simulates the interaction between $C^*$ and $R$ in the commit stage and outputs $(\ensuremath{\mathsf{OUT}}\xspace_{C^*} ,\mathsf{val}_b(\tau))$ where $\ensuremath{\mathsf{OUT}}\xspace_{C^*}$ is the final output of $C^*$, $b$ is $R$'s decision bit, $\tau$ is Naor's commitment generated in  \Cref{item:small-tag:async:step:Naor-rho,item:small-tag:async:step:committing}, and 
$$
\mathsf{val}_b(\tau) \coloneqq 
\begin{cases}
\mathsf{val}(\tau) & b = \top\\
\bot & b = \bot
\end{cases}.
$$
 \item{\emph{Experiment} $\mathsf{Exp}_{c,i}(\lambda,z)$:}
 This experiment works similarly to $\mathsf{Exp}(\lambda,z)$ except that it runs the extractor of {\bf ExtCom-$c$-$i$} to obtain the extracted message $m^*$ and outputs $(\ensuremath{\mathsf{OUT}}\xspace_{C^*},\Gamma_b(m^*))$ where 
 $$
\Gamma_b(m^*) \coloneqq 
\begin{cases}
m^* & b = \top\\
\bot & b = \bot
\end{cases}.
$$
\end{itemize}
Then, for all $(c,i)\in \ensuremath{J}\xspace$, it holds that 
$$
\{\mathsf{Exp}(\lambda,z)\}_{\lambda\in \mathbb{N},z\in \{0,1\}^*}\ensuremath{\stackrel{\text{s}}{\approx}}\xspace \{\mathsf{Exp}_{c,i}(\lambda,z)\}_{\lambda\in \mathbb{N},z\in \{0,1\}^*}.
$$


\end{lemma}
\begin{proof}
First, we prove the following claim.
\begin{MyClaim}\label{claim:consistency_commitments}
\begin{align}\label{eq:consistency_commitments}
\Pr[b=\top \land (\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace})\notin \ensuremath{\mathcal{L}}\xspace_{\beta}]=\mathsf{negl}(\lambda)
\end{align}
where the probability is taken over the execution of $\mathsf{Exp}(\lambda,z)$. 
\end{MyClaim}
\begin{proof}[Proof of \Cref{claim:consistency_commitments}]
 We consider a modified experiment $\mathsf{Exp}'(\lambda,z)$ that works similarly to  $\mathsf{Exp}(\lambda,z)$ except that it runs the witness-extended emulator for {\bf WIPoK-2} instead of running it honestly. By the PoK property (as per \Cref{def:WEE}), it suffices to prove \Cref{eq:consistency_commitments} holds in $\mathsf{Exp}'(\lambda,z)$. 

Let $\tilde{w}$ be the extracted witness from {\bf WIPoK-2}. By the PoK property (as per \Cref{def:WEE}), $\tilde{w}$ is a valid witness for $(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace}, Y^A, Y^B, V_0,V_1) \in \ensuremath{\mathcal{L}}\xspace_{\beta} \vee \ensuremath{\mathcal{L}}\xspace^t_f \vee \ensuremath{\mathcal{L}}\xspace^{n-t}_f \vee \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ 
 except for a negligible probability when $b=\top$. 

We can show that $\tilde{w}$ cannot be a witness of $Y^A\in \ensuremath{\mathcal{L}}\xspace^t_f$ except for a negligible probability by using the one-wayness of $f$ and WI of {\bf WIPoK-1-A}. Indeed, this can be seen as follows. 
\begin{itemize}
    \item In $\mathsf{Exp}'(\lambda,z)$, the receiver uses $(1,x^A_1,r^A_1)$ as a witness for {\bf WIPoK-1-A}. Therefore, if the probability that $\tilde{w}=(j,x^A_j)$ such that $y^A_j=f(x^A_j)$ for some $j\neq 1$ is non-negligible, it clearly breaks the one-wayness of $f$ or the computational hiding property of $\mathsf{Com}$. 
    \item If the probability that $\tilde{w}=(1,x^A_1)$ such that $y^A_1=f(x^A_1)$ is non-negligible, by the WI property of {\bf WIPoK-1-A}, a similar statement holds even if the receiver uses $(2,x^A_2,r^A_2)$ instead of $(1,x^A_1,r^A_1)$  as a witness for {\bf WIPoK-1-A}. Then, by a similar argument to the above case, it also breaks the one-wayness of $f$ or the computational hiding property of $\mathsf{Com}$.  
\end{itemize}

By similar arguments, $\tilde{w}$ cannot be a witness of $Y^B\in \ensuremath{\mathcal{L}}\xspace^{n-t}_f$ or $(V_0,V_1)\in \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ except for a negligible probability. 
Thus, $\tilde{w}$ is a witness for $(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace})\in \ensuremath{\mathcal{L}}\xspace_{\beta}$ except for a negligible probability when $b=\top$.  
This completes the proof of \Cref{claim:consistency_commitments}.

\end{proof}

\Cref{claim:consistency_commitments} in particular means that we have $\mathsf{val}(\tau)=\mathsf{val}(\tau^i_c)\neq \bot$ whenever $b=\top$ except for a negligible probability. 
Then, the extractability of $\ensuremath{\mathsf{ExtCom}}\xspace$ immediately implies \Cref{lem:ExtCom_soundness}.

\if0
We consider the following hybrid:
\begin{itemize}
    \item {Hybrid $\mathsf{Exp}'_{c,i}(\lambda,z)$:}
    It works similarly to $\mathsf{Exp}(\lambda,z)$ except that it outputs $(\ensuremath{\mathsf{OUT}}\xspace_{C^*},\mathsf{val}_b(\tau^c_i))$ where $\tau^c_i$ is the transcript of {\bf ExtCom-$c$-$i$} and  
    $$
\mathsf{val}_b(\tau^c_i) \coloneqq 
\begin{cases}
\mathsf{val}(\tau^c_i) & b = \top\\
\bot & b = \bot
\end{cases}.
$$
\end{itemize}

The extractability of $\ensuremath{\mathsf{ExtCom}}\xspace$ implies 
\begin{align}\label{eq:exp_prime_to_exp_ci}
\{\mathsf{Exp}_{c,i}(\lambda,z)\}_{\lambda\in \mathbb{N},z\in \{0,1\}^*}\ensuremath{\stackrel{\text{s}}{\approx}}\xspace \{\mathsf{Exp}'_{c,i}(\lambda,z)\}_{\lambda\in \mathbb{N},z\in \{0,1\}^*}.
\end{align}

Below, we prove the following:
\begin{align}\label{eq:exp_prime_to_exp}
\{\mathsf{Exp}(\lambda,z)\}_{\lambda\in \mathbb{N},z\in \{0,1\}^*}\ensuremath{\stackrel{\text{s}}{\approx}}\xspace \{\mathsf{Exp}'_{c,i}(\lambda,z)\}_{\lambda\in \mathbb{N},z\in \{0,1\}^*}.
\end{align}

For proving \Cref{eq:exp_prime_to_exp}, it suffices to prove that the probability that $b=\top$ and $\mathsf{val}(\tau)\ne\mathsf{val}(\tau^i_c)$ is negligible in $\mathsf{Exp}(\lambda,z)$. 
For proving this, we consider another modified experiment $\mathsf{Exp}'(\lambda,z)$ that works similarly to  $\mathsf{Exp}(\lambda,z)$ except that it runs the witness-extended emulator for {\bf WIPoK-2} instead of running it honestly. By the PoK property (as per \Cref{def:WEE}), the joint distribution of $\tau$, $\tau^i_c$, and $b$ does not change. Thus, it suffices to prove that the probability that $b=\top$ and $\mathsf{val}(\tau)\ne\mathsf{val}(\tau^i_c)$ is negligible in $\mathsf{Exp}'(\lambda,z)$. 

Let $\tilde{w}$ be the extracted witness from {\bf WIPoK-2}. By the PoK property (as per \Cref{def:WEE}), $\tilde{w}$ is a valid witness for $(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace}, Y^A, Y^B, V_0,V_1) \in \ensuremath{\mathcal{L}}\xspace_{\beta} \vee \ensuremath{\mathcal{L}}\xspace^t_f \vee \ensuremath{\mathcal{L}}\xspace^{n-t}_f \vee \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ 
 except for a negligible probability when $b=\top$. 

We can show that $\tilde{w}$ cannot be a witness of $Y^A\in \ensuremath{\mathcal{L}}\xspace^t_f$ except for a negligible probability by using the one-wayness of $f$ and WI of {\bf WIPoK-1-A}. Indeed, this can be seen as follows. 
\begin{itemize}
    \item In $\mathsf{Exp}'_{c,i}(\lambda,z)$, the receiver uses $(1,x^A_1,r^A_1)$ as a witness for {\bf WIPoK-1-A}. Therefore, if the probability that $\tilde{w}=(j,x^A_j)$ such that $y^A_j=f(x^A_j)$ for some $j\neq 1$ is non-negligible, it clearly breaks the one-wayness of $f$ or the computational hiding property of $\mathsf{Com}$. 
    \item If the probability that $\tilde{w}=(1,x^A_1)$ such that $y^A_1=f(x^A_1)$ is non-negligible, by the WI property of {\bf WIPoK-1-A}, a similar statement holds even if the receiver uses $(2,x^A_2,r^A_2)$ instead of $(1,x^A_1,r^A_1)$  as a witness for {\bf WIPoK-1-A}. Then, by a similar argument to the above case, it also breaks the one-wayness of $f$ or the computational hiding property of $\mathsf{Com}$.  
\end{itemize}

By similar arguments, $\tilde{w}$ cannot be a witness of $Y^B\in \ensuremath{\mathcal{L}}\xspace^{n-t}_f$ or $(V_0,V_1)\in \ensuremath{\mathcal{L}}\xspace_{f}^{\mathrm{OR}}$ except for a negligible probability. 
Thus, $\tilde{w}$ is a witness for $(\mathsf{com},\{\tau^c_i\}_{(c,i)\in \ensuremath{J}\xspace})\in \ensuremath{\mathcal{L}}\xspace_{\beta}$ except for a negligible probability when $b=\top$.  This implies $\mathsf{val}(\tau)=\mathsf{val}(\tau^i_c)$. 
Thus, we obtain \Cref{eq:exp_prime_to_exp}.

By combining \Cref{eq:exp_prime_to_exp_ci,eq:exp_prime_to_exp}, we complete the proof of \Cref{lem:ExtCom_soundness}.
\fi
\end{proof}

Next, we analyze the bad cases one by one.

\subsubsection{Analysis of $\mathsf{Bad}~1$}
\begin{lemma}\label{lem:bad:1}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is non-malleable against asynchronous PPT adversaries whose schedule satisfies $\mathsf{Bad}~1$.
\end{lemma}
\begin{proof}
The proof for this case is easy. When $\mathsf{Bad}~1$ occurs, the right commitment $\tilde{\mathsf{com}}$ (in \Cref{item:small-tag:async:step:committing}) is sent before the left commitment $\mathsf{com}$ (in \Cref{item:small-tag:async:step:committing}) is sent. Then, a straightforward reduction to the computational hiding of the left session works by extracting $\tilde{m}$ from $\tilde{\mathsf{com}}$ by brute-force and treating it as non-uniform advice of an adversary against computational hiding. 

\end{proof}

\subsubsection{Analysis of $\mathsf{Bad}~2$}
\begin{lemma}\label{lem:bad:2}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is non-malleable against asynchronous PPT adversaries whose schedule satisfies $\mathsf{Bad}~2$.
\end{lemma}
\begin{proof}
Recall that $\mathsf{Bad}~2$ means that 
    the left message of \Cref{item:small-tag:async:step:OWFs} is sent before the right message of \Cref{item:small-tag:async:step:committing} is sent. 
We assume that $\mathcal{M}$ receives the right message of \Cref{item:small-tag:async:step:Naor-rho} at first w.l.o.g.
In particular, no massage in the right session is sent during the execution of the left {\bf WIPoK-Trap}. 


We consider the following sequence of hybrids.
\begin{itemize}
    \item {Hybrid $H_1^{\mathcal{M}}(\lambda, m, z)$:} This hybrid is the real man-in-the-middle experiment $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)$. The output of the experiment can be written as $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}},\mathsf{val}_b(\tilde{\tau}))$ where $\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}$ is $\mathcal{M}$'s final output, $b$ is the $R$'s decision bit, and $\tilde{\tau}$ is Naor's commitment generated in \Cref{item:small-tag:async:step:Naor-rho,item:small-tag:async:step:committing} in the right session, and
$$
\mathsf{val}_b(\tilde{\tau}) \coloneqq 
\begin{cases}
\mathsf{val}(\tilde{\tau}) & b = \top\\
\bot & b = \bot
\end{cases}.
$$
   \item {Hybrid $H_2^{\mathcal{M}}(\lambda, m, z)$:}  It is identical to $H_1^{\mathcal{M}}(\lambda, m, z)$ except that it runs the witness-extended emulator for the left {\bf WIPoK-Trap} instead of running it honestly. Let $v$ be the extracted witness. If 
   $C$ accepts the left {\bf WIPoK-Trap} but  
   $v$ is not a valid witness for $(V_0,V_1)\in \ensuremath{\mathcal{L}}\xspace_f^{\mathrm{OR}}$, it aborts with outputting $(\bot,\bot)$. Otherwise, it works similarly to $H_1^{\mathcal{M}}(\lambda, m, z)$. We remark that it does not use $v$ though it extracts it. 
     \item {Hybrid $H_3^{\mathcal{M}}(\lambda, m, z)$:}  It is identical to $H_2^{\mathcal{M}}(\lambda, m, z)$ except that it uses $v$ extracted from the left {\bf WIPoK-Trap} as a witness in the left {\bf WIPoK-2}. 
      \item {Hybrid $H_4^{\mathcal{M}}(\lambda, m, z)$:}  It is identical to $H_3^{\mathcal{M}}(\lambda, m, z)$ except that it commits to $0$ instead of $m$ in all slots of {\bf ExtCom-\{1,2,3\}}.  
  
\end{itemize}
We prove that each pair of neighboring hybrids is computationally indistinguishable.  
\begin{MyClaim}\label{cla:bad:2:hybrid:1}
It holds that
\begin{align*}
\{H_1^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace,m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)},z \in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{s}}{\approx}}\xspace \{H_2^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*}.
\end{align*}
\end{MyClaim}
\begin{proof}[Proof of \Cref{cla:bad:2:hybrid:1}]
This follows from the PoK property (as per \Cref{def:WEE}) of the left {\bf WIPoK-Trap} straightforwardly. 

\end{proof}

\begin{MyClaim}\label{cla:bad:2:hybrid:2}
It holds that
\begin{align*}
\{H_2^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{H_3^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*}.
\end{align*}
\end{MyClaim}
\begin{proof}[Proof of \Cref{cla:bad:2:hybrid:2}]
We introduce the following additional hybrids:
\begin{itemize}
    \item {Hybrid $\bar{H}_2^{\mathcal{M}}(\lambda, m, z)$:}
    Choose the smallest $i^*\in [n_5]$ such that the right {\bf ExtCom-1-$i^*$} does not interleave with the left {\bf WIPoK-2}, i.e., no message of the left {\bf WIPoK-2} is sent during the execution of the right {\bf ExtCom-1-$i^*$}.\footnote{\Cref{rem:adaptive_good_slot} applies here.} 
    Such $i^*$ exists by the pigeonhole principle since we assume that $n_5$ is larger than the round complexity of {\bf WIPoK-2}.  
    This experiment is identical to $H_2^{\mathcal{M}}(\lambda, m, z)$ except that it runs the extractor of the right {\bf ExtCom-1-$i^*$} to extract $\tilde{m}^*$, and outputs $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}},\Gamma_b(\tilde{m}^*))$ instead of $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}},\mathsf{val}_b(\tilde{\tau}))$ where  
$$
\Gamma_b(m^*) \coloneqq 
\begin{cases}
m^* & b = \top\\
\bot & b = \bot
\end{cases}.
$$
\item {Hybrid $\bar{H}_3^{\mathcal{M}}(\lambda, m, z)$:}  It is identical to $\bar{H}_2^{\mathcal{M}}(\lambda, m, z)$ except that it uses $v$ extracted from the left {\bf WIPoK-Trap} as a witness in the left {\bf WIPoK-2}. 
\end{itemize}
Note that both $\bar{H}_2^{\mathcal{M}}(\lambda, m, z)$ and $\bar{H}_3^{\mathcal{M}}(\lambda, m, z)$ are efficient since they no longer need to output $\mathsf{val}_b(\tilde{\tau})$. 
Then, by the assumption that the right {\bf ExtCom-1-$i^*$} does not interleave with the left {\bf WIPoK-2}, the WI property of the left {\bf WIPoK-2} gives 
\begin{align}\label{eq:hybrid_barH2_to_barH3}
    \{\bar{H}_2^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{\bar{H}_3^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*}.
\end{align}

By the assumption that $\mathsf{Bad}~2$ occurs and that $\mathcal{M}$ receives the right message of \Cref{item:small-tag:async:step:Naor-rho} at first,  hybrids $H_2^{\mathcal{M}}(\lambda, m, z)$ and $H_3^{\mathcal{M}}(\lambda, m, z)$ do not rewind the right session at all.
Indeed, they only rewind the left {\bf WIPoK-Trap}, but the right message of \Cref{item:small-tag:async:step:Naor-rho} is sent before the left {\bf WIPoK-Trap} starts by our simplifying assumption and the rest of messages in the right session is sent after the left {\bf WIPoK-Trap} finishes by the assumption that $\mathsf{Bad}~2$ occurs. 
Thus, by considering the combination of $\mathcal{M}$ and $C$ as a single cheating committer,  \Cref{lem:ExtCom_soundness} gives
\begin{align}\label{eq:hybrid_H2_to_barH2}
\{H_2^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{\bar{H}_2^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*}
\end{align}
and 
\begin{align}\label{eq:hybrid_H3_to_barH3}
\{H_3^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{\bar{H}_3^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*}.
\end{align}
By combining \Cref{eq:hybrid_barH2_to_barH3,eq:hybrid_H2_to_barH2,eq:hybrid_H3_to_barH3}, we complete the proof of \Cref{cla:bad:2:hybrid:2}. 

\end{proof}

\begin{MyClaim}\label{cla:bad:2:hybrid:3}
It holds that
\begin{align*}
\{H_3^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{H_4^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*}.
\end{align*}
\end{MyClaim}
\begin{proof}[Proof of \Cref{cla:bad:2:hybrid:3}]
This follows from a similar argument to that in the proof of \Cref{cla:bad:2:hybrid:2}. 
However, we remark that we cannot prove it at once since the \emph{total} round complexity of {\bf ExtCom-\{1,2,3\}} is larger than $n_5$, in which case we cannot choose $i^*$ such that the right {\bf ExtCom-1-$i^*$} does not interleave with any message of the left {\bf ExtCom-\{1,2,3\}}. 
To resolve this issue, we replace the committed message $m$ with $0$ for each execution of $\ensuremath{\mathsf{ExtCom}}\xspace$ in {\bf ExtCom-\{1,2,3\}} one by one. Since we assume that $n_5$ is larger than the round complexity of $\ensuremath{\mathsf{ExtCom}}\xspace$, a similar argument to the proof of \Cref{cla:bad:2:hybrid:2} works by using the computational indistinguishability of $\ensuremath{\mathsf{ExtCom}}\xspace$.

\end{proof}

\begin{MyClaim}\label{cla:bad:2:hybrid:4}
It holds that
\begin{align*}
\{H_4^{\mathcal{M}}(\lambda, m_0, z)\}_{\lambda,m_0,m_1,z} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{H_4^{\mathcal{M}}(\lambda, m_1, z)\}_{\lambda,m_0,m_1,z},
\end{align*}
 where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $(m_0,m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}\times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
\end{MyClaim}
\begin{proof}[Proof of \Cref{cla:bad:2:hybrid:4}]
This immediately follows from the computational hiding property of Naor's commitment noting that the left message $m$ is only used for generating Naor's commitment in \Cref{item:small-tag:async:step:committing} in $H_4^{\mathcal{M}}(\lambda, m, z)$.
 
\end{proof}

By combining \Cref{cla:bad:2:hybrid:1,cla:bad:2:hybrid:2,cla:bad:2:hybrid:3,cla:bad:2:hybrid:4}, we obtain 
\begin{align*}
\{H_1^{\mathcal{M}}(\lambda, m_0, z)\}_{\lambda,m_0,m_1,z} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{H_1^{\mathcal{M}}(\lambda, m_1, z)\}_{\lambda,m_0,m_1,z}
\end{align*}
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $(m_0,m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}\times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
This completes the proof of \Cref{lem:bad:2}.


\end{proof}

\subsubsection{Analysis of $\mathsf{Bad}~3$}
\begin{lemma}\label{lem:bad:3}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is non-malleable against asynchronous PPT adversaries whose schedule satisfies $\mathsf{Bad}~3$.
\end{lemma}
\begin{proof}
Recall that $\mathsf{Bad}~3$ means that 
    the right {\bf WIPoK-1-A} starts before the left message of \Cref{item:small-tag:async:step:OWFs} is sent.

We consider the following sequence of hybrids.
\begin{itemize}
    \item {Hybrid $H_1^{\mathcal{M}}(\lambda, m, z)$:} This hybrid is the real man-in-the-middle experiment $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)$. The output of the experiment can be written as $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}},\mathsf{val}_b(\tilde{\tilde{\tau}}))$ where $\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}$ is $\mathcal{M}$'s final output, $b$ is the $R$'s decision bit, and $\tilde{\tau}$ is Naor's commitment generated in \Cref{item:small-tag:async:step:Naor-rho,item:small-tag:async:step:committing} in the right session, and
$$
\mathsf{val}_b(\tilde{\tau}) \coloneqq 
\begin{cases}
\mathsf{val}(\tilde{\tau}) & b = \top\\
\bot & b = \bot
\end{cases}.
$$
\item {Hybrid $H_2^{\mathcal{M}}(\lambda, m, z)$:} 
Choose the smallest $i^*\in [n_5]$ such that the right {\bf ExtCom-1-$i^*$} does not interleave with Steps \ref{item:small-tag:async:step:Naor-rho} to \ref{item:small-tag:async:step:OWFs} in the left, i.e., no message of the left {\bf WIPoK-2} is sent during the execution of the right {\bf ExtCom-1-$i^*$}.\footnote{\Cref{rem:adaptive_good_slot} applies here.} 
Such $i^*$ exists by the pigeonhole principle since we assume that $n_5$ is larger than the total round complexity of Steps \ref{item:small-tag:async:step:Naor-rho} to \ref{item:small-tag:async:step:OWFs}.   
This experiment is identical to $H_1^{\mathcal{M}}(\lambda, m, z)$ except that it runs the extractor of the right {\bf ExtCom-1-$i^*$} to extract $\tilde{m}^*$, and outputs $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}},\Gamma_b(\tilde{m}^*))$ instead of $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}},\mathsf{val}_b(\tilde{\tau}))$ where  
$$
\Gamma_b(m^*) \coloneqq 
\begin{cases}
m^* & b = \top\\
\bot & b = \bot
\end{cases}.
$$
\end{itemize}

\begin{MyClaim}\label{cla:bad:3:hybrid:1}
It holds that
\begin{align*}
\{H_1^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*} \ensuremath{\stackrel{\text{s}}{\approx}}\xspace \{H_2^{\mathcal{M}}(\lambda, m, z)\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace, m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}, z \in \ensuremath{\{0,1\}}\xspace^*}.
\end{align*}
\end{MyClaim}
\begin{proof}[Proof of \Cref{cla:bad:3:hybrid:1}]
This immediately follows from \Cref{lem:ExtCom_soundness}.

\end{proof}

\begin{MyClaim}\label{cla:bad:3:hybrid:2}
It holds that
\begin{align*}
\{H_2^{\mathcal{M}}(\lambda, m_0, z)\}_{\lambda,m_0,m_1,z} \ensuremath{\stackrel{\text{s}}{\approx}}\xspace \{H_2^{\mathcal{M}}(\lambda, m_1, z)\}_{\lambda,m_0,m_1,z}
\end{align*}
 where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $(m_0, m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
\end{MyClaim}
\begin{proof}
By the choice of $i^*$ and the assumption that $\mathsf{Bad}~3$ occurs, $H_2^{\mathcal{M}}(\lambda, m, z)$ does not rewind the left session at all. Therefore, by considering the combination of $\mathcal{M}$ and $R$ as a single cheating receiver,  \Cref{cla:bad:3:hybrid:2} follows from the computational hiding property of \Cref{prot:small-tag:classical}. 

\end{proof}
By combining \Cref{cla:bad:3:hybrid:1,cla:bad:3:hybrid:2}, we obtain  
\begin{align*}
\{H_1^{\mathcal{M}}(\lambda, m_0, z)\}_{\lambda,m_0,m_1,z} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \{H_1^{\mathcal{M}}(\lambda, m_1, z)\}_{\lambda,m_0,m_1,z}
\end{align*}
 where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m_0,m_1 \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
This completes the proof of \Cref{lem:bad:3}.

\end{proof}


\subsubsection{Analysis of $\mathsf{Bad}~4$}
\begin{lemma}\label{lem:bad:4}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is non-malleable against asynchronous PPT adversaries whose schedule satisfies $\mathsf{Bad}~4$.
\end{lemma}
\begin{proof}
Recall that $\mathsf{Bad}~4$ means that 
    the right {\bf WIPoK-1-B} starts before the left {\bf WIPoK-1-A} finishes.   
\Cref{lem:bad:4} can be proven similarly to \Cref{lem:bad:3} except that we extract $\tilde{m}$ from the right {\bf ExtCom-2-$i^*$} that does not interleave with Steps \ref{item:small-tag:async:step:Naor-rho} to \ref{item:small-tag:async:step:WIPoK:1A} in the left.

\end{proof}

\subsubsection{Analysis of $\mathsf{Bad}~5$}
\begin{lemma}\label{lem:bad:5}
The commitment scheme $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:classical} is non-malleable against asynchronous PPT adversaries whose schedule satisfies $\mathsf{Bad}~5$.
\end{lemma}
\begin{proof}
 Recall that $\mathsf{Bad}~5$ means that 
    the right {\bf WIPoK-2} starts before the left {\bf WIPoK-1-B} finishes. 
\Cref{lem:bad:5} can be proven similarly to \Cref{lem:bad:3} except that we extract $\tilde{m}$ from the right {\bf ExtCom-3-$i^*$} that does not interleave with Steps \ref{item:small-tag:async:step:Naor-rho} to \ref{item:small-tag:async:step:WIPoK:2} in the left.

\end{proof}

By combining \Cref{lem:good_case,lem:bad:1,lem:bad:2,lem:bad:3,lem:bad:4,lem:bad:5} along with \Cref{lem:adaptive-predetermined:async}, we complete the proof of \Cref{thm:nm:small-tag:classical}.
\section{Small-Tag, One-sided, Synchronous, Post-Quantum Setting}\label{pq:sec:small-tag-one-sided-sync-pq}

\subsection{Construction} 
In this section, we prove that \Cref{prot:one-sided:classical} is post-quantumly secure if we rely on post-quantum building-blocks. 
Similarly to the classical case in \Cref{sec:small-tag-one-sided-sync-classical}, we present the construction assuming the existence of post-quantum {\em injective} OWFs.  
The assumption can be relaxed to  {\em any} OWFs by an appropriate modification to the protocol similarly to the classical case.  
Since this is exactly the same as that in the classical setting (i.e., \Cref{sec:removing-injectivity}), we do not repeat it in this section. 

Our construction is based on the following building blocks:
\begin{itemize}
\item
A post-quantum {\em injective} OWF $f$; 
\item
Naor's commitment $\mathsf{Com}$ that is implemented with a post-quantum OWF.\footnote{In this way, the Naor's commitment is statistically binding and {\em post-quantumly} computationally hiding.};
\item
A post-quantum witness-indistinguishable argument of knowledge with $\epsilon$-close emulation $\ensuremath{\mathsf{WIAoK}}\xspace$
(as per \Cref{def:PQWIAoK}). 
\end{itemize}
\begin{ProtocolBox}[label={pq:prot:one-sided:classical}]{Small-Tag One-Sided Synchronous Post-Quantum NMCom \textnormal{$\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$}}
The tag space is defined to be $[n]$ where $n$ is a polynomial on $\lambda$. Let $t \in [n]$ be the tag for the following interaction. Let $m$ be the message to be committed to.

\para{Commit Stage:}
\begin{enumerate}
\item\label[Step]{pq:item:one-sided:step:Naor-rho}
Receiver $R$ samples and sends the first message $\beta$ for Naor's commitment; 
\item\label[Step]{pq:item:one-sided:step:committing}
Committer $C$ commits to $m$ using the second message of Naor's commitment. Formally, $C$ samples a random tape $r$ and sends $\mathsf{com} = \mathsf{Com}_\beta(m;r)$;
\item\label[Step]{pq:item:one-sided:step:OWFs}
$R$ computes $\Set{y_i = f(x_i)}_{i \in [t]}$ with $x_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [t]$. $R$ sends $Y = (y_1, \ldots, y_t)$ to $C$;
\item\label[Step]{pq:item:one-sided:step:WIAoK:1}
{\bf (WIAoK-1.)} $R$ and $C$ execute an instance of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y_i$ contained in $Y$ (defined in \Cref{pq:item:one-sided:step:OWFs}). Formally, $R$ proves that $Y \in \ensuremath{\mathcal{L}}\xspace^t_f$, where \begin{equation}\label[Language]{pq:eq:one-sided:Lang:OWF}
\ensuremath{\mathcal{L}}\xspace^t_f \coloneqq \Set{(y_1, \ldots, y_t)~|~\exists (i, x_i) ~s.t.~ i \in [t] \wedge y_i = f(x_i)}.
\end{equation}
Note that $R$ uses $(1,x_1)$ as the witness when executing this $\ensuremath{\mathsf{WIAoK}}\xspace$.
\item\label[Step]{pq:item:one-sided:step:WIAoK:2}
{\bf (WIAoK-2.)} $C$ and $R$ execute an instance of $\ensuremath{\mathsf{WIAoK}}\xspace$ where $C$ proves to $R$ that he ``knows'' {\em either} the message committed in $\mathsf{com}$ (defined in \Cref{pq:item:one-sided:step:committing}), {\em or} a pre-image of some $y_i$ contained in $Y$ (defined in \Cref{pq:item:one-sided:step:OWFs}). Formally, $C$ proves that $(\mathsf{com}, Y) \in \ensuremath{\mathcal{L}}\xspace_\beta \vee \ensuremath{\mathcal{L}}\xspace^t_f$, where $\ensuremath{\mathcal{L}}\xspace_\beta \vee \ensuremath{\mathcal{L}}\xspace^t_f$ denotes the  OR-composed language (as per \Cref{def:OR-Comp}), $\ensuremath{\mathcal{L}}\xspace^t_f$ was defined in \Cref{pq:eq:one-sided:Lang:OWF} and 
\begin{equation}\label[Language]{pq:eq:one-sided:Lang:Com}
\ensuremath{\mathcal{L}}\xspace_\beta\coloneqq \Set{\mathsf{com} ~|~ \exists (m, r)~s.t.~ \mathsf{com} = \mathsf{Com}_\beta(m;r)}.
\end{equation}
Note that $C$ uses the $(m, r)$ defined in \Cref{pq:item:one-sided:step:committing} as the witness when executing this $\ensuremath{\mathsf{WIAoK}}\xspace$.
\end{enumerate}
\para{Decommit Stage:} 
$C$ sends $(m, r)$. $R$ accepts if $\mathsf{com} = \mathsf{Com}_\beta(m;r)$, and rejects otherwise.
\end{ProtocolBox}

Remark that the above protocol is exactly the same as \Cref{prot:one-sided:classical} except that we use post-quantum WIAoK with $\epsilon$-close emulation and assume post-quantum security for all other  building-blocks.

\para{Security.} Completeness is straightforward from the description of \Cref{pq:prot:one-sided:classical}. 
The statistical binding property follows from that of Naor's commitment. Computational hiding of any non-malleable commitment follows from its non-malleability. So, we only need to show that \Cref{pq:prot:one-sided:classical} is non-malleable. This is established by the following \Cref{pq:thm:one-sided:non-malleability}, which we prove in subsequent subsections.


\begin{theorem}\label{pq:thm:one-sided:non-malleability}
The commitment scheme $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ in \Cref{pq:prot:one-sided:classical} is non-malleable against  one-sided synchronous QPT adversaries with tag space $[n]$, with $n$ being any polynomial on $\lambda$.
\end{theorem}	

\subsection{Proving Non-Malleability}
\label{pq:one-sided:non-malleability:proof:classical}



We prove \Cref{pq:thm:one-sided:non-malleability} in \Cref{pq:one-sided:non-malleability:proof:classical,pq:sec:one-sided:core-lemma:proof,pq:lem:small-tag:proof:se:proof,pq:sec:lem:small-tag:proof:se:proof:K:proof,pq:sec:lem:bound:Ki:proof,pq:sec:proof:claim:K'':non-abort}.
The proof follows the same template used in \Cref{one-sided:non-malleability:proof:classical}.
The only exception is the proof of \Cref{pq:lem:small-tag:proof:se} (which is the post-quantum counterpart of \Cref{lem:small-tag:proof:se}). Recall that in \Cref{lem:small-tag:proof:se}, we amplify the extractor $\mathcal{K}$ to the simulation-extractor $\mathcal{SE}$ by rewinding. In the current post-quantum setting, we cannot rewind quantum algorithms in general. Therefore, we rely on an alternative argument based on our new extract-and-simulate lemma~(\Cref{lem:extract_and_simulate}).
The rest of the proof is almost the same as its classical counterpart; Thus, many parts of the proof are taken verbatim from there. Essentially, the only difference is that we have to deal with noticeable errors that come from witness-extended $\epsilon$-close emulator (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}). We highlight differences from the classical counterpart in {\color{Plum} purple color} throughout this section.

We use the same notation as in the proof of \Cref{thm:one-sided:non-malleability}, with the only difference that now the adversaries are non-uniform QPT (instead of PPT) machines. It is worth noting that the honest committer and receiver are still classical (i.e., non-uniform PPT) machines. 


\if0
\begin{remark}[Structure of the Proof of \Cref{pq:thm:one-sided:non-malleability}.]
Since the proof of \Cref{pq:thm:one-sided:non-malleability} is lengthy, we provide a road map here.
We prove \Cref{pq:thm:one-sided:non-malleability} in \Cref{pq:one-sided:non-malleability:proof:classical,sec:one-sided:core-lemma:proof,lem:small-tag:proof:se:proof,sec:lem:small-tag:proof:se:proof:K:proof,sec:lem:bound:Ki:proof,sec:proof:claim:K'':non-abort}.
In each subsection, we introduce a lemma or claim whose proof is deferred to the next subsection. Specifically,
\begin{itemize}
    \item In the rest of \Cref{pq:one-sided:non-malleability:proof:classical}, we prove \Cref{pq:thm:one-sided:non-malleability} assuming that \Cref{pq:lem:one-sided:proof:core} is correct.
     \item In \Cref{pq:sec:one-sided:core-lemma:proof}, we prove \Cref{pq:lem:one-sided:proof:core} assuming that \Cref{pq:lem:small-tag:proof:se} is correct.
      \item In  \Cref{pq:lem:small-tag:proof:se:proof}, we prove \Cref{pq:lem:small-tag:proof:se} assuming that \Cref{pq:lem:small-tag:proof:se:proof:K} is correct.
        \item In  \Cref{pq:sec:lem:small-tag:proof:se:proof:K:proof}, we prove \Cref{pq:lem:small-tag:proof:se:proof:K} assuming that \Cref{pq:lem:bound:Ki} is correct.
        \item  In  \Cref{pq:sec:lem:bound:Ki:proof}, we prove \Cref{pq:lem:bound:Ki} assuming that \Cref{pq:claim:K'':non-abort} is correct.
        \item In \Cref{pq:sec:proof:claim:K'':non-abort}, we prove \Cref{pq:claim:K'':non-abort}. 
\end{itemize}
Putting everything together, we complete the proof of  \Cref{pq:thm:one-sided:non-malleability}.
\end{remark}
\fi

In the sequel, we write $\langle C, R \rangle$ to mean $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ for notational convenience. 

\para{Game $H^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda)$:\label{pq:gameH:description}} This game is identical to its classical counterpart defined on \Cpageref{gameH:description}, except that $\mathcal{M} = \Set{\mathcal{M}_\lambda, \rho_\lambda}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}$ now is a (non-uniform) QPT machine.
That is, this is the man-in-the-middle execution of the commit stage of the $\langle C, R \rangle$ defined in \Cref{pq:prot:one-sided:classical}, where the left committer commits to $m$ and $\mathcal{M}$'s non-uniform advice is $\rho_\lambda$. 
The output of $H^{\mathcal{M}_\lambda}(m,\rho_\lambda)$ is again defined to be $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}, \tilde{\tau}, b)$, where $\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}$ is the (quantum) output of $\mathcal{M}_\lambda(\rho_\lambda)$ at the end of this game, $\tilde{\tau}$ consists of the \Cref{pq:item:one-sided:step:Naor-rho,pq:item:one-sided:step:committing} messages exchanged in the right session, and $b \in \Set{\top, \bot}$ is the honest receiver's final decision.

\if0
\para{Game $H^{\mathcal{M}}(\lambda,m,z)$:\label{pq:gameH:description}} This is the man-in-the-middle execution of the commit stage of the $\langle C, R \rangle$ defined in \Cref{pq:prot:one-sided:classical}, where the left committer commits to $m$ and $\mathcal{M}$'s non-uniform advice is $z$. The output of this game consists of the following three parts:
\begin{enumerate}
\item
$\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}$: this is the output of $\mathcal{M}$ at the end of this game;
\item
$\tilde{\tau}$: this is defined to be $\tilde{\tau} \coloneqq (\tilde{\beta}, \tilde{\mathsf{com}})$, where (i.e., $\tilde{\beta}$ and $\tilde{\mathsf{com}}$ are the \Cref{pq:item:one-sided:step:Naor-rho} and \Cref{pq:item:one-sided:step:committing} messages exchanged between $\mathcal{M}$ and the honest receiver $R$;
\item
$b \in \Set{\top, \bot}$: this is the output of the honest receiver $R$, indicating if the man-in-the-middle's commitment (i.e., the right session) is accepted ($b = \top$) or not ($b = \bot$).
\end{enumerate}
\fi

\para{Notation.} 
Recall from \Cref{def:NMCom:pq} that the man-in-the middle game for a QPT adversary $\mathcal{M}$ is denoted by $\bar{\mathsf{mim}}^{\mathcal{M}_\lambda}_{\langle C, R \rangle}(m, \rho_\lambda)$. 
Also, note that ``$\ensuremath{\stackrel{\text{c}}{\approx}}\xspace$'' refers to {\em quantumly} computational indistinguishability throughout this section.

For any $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{M}}, \tilde{\tau}, b)$ in the support of $H^{\mathcal{M}_\lambda}(\lambda,m,z)$, we define $\mathsf{val}_b(\tilde{\tau})$ similarly to the classical case, i.e., 
$$
\mathsf{val}_b(\tilde{\tau}) \coloneqq 
\begin{cases}
\mathsf{val}(\tilde{\tau}) & b = \top\\
\bot & b = \bot
\end{cases},
$$
where $\mathsf{val}(\tilde{\tau})$ denote the value statistically-bound in \Cref{pq:item:one-sided:step:Naor-rho,pq:item:one-sided:step:committing} of the right session.

Similarly to \Cref{eq:classical:mim-H}, we have
\begin{align}
\big\{\bar{\mathsf{mim}}^{\mathcal{M}_\lambda}_{\langle C, R \rangle}(m, \rho_\lambda)\big\} \ensuremath{\stackrel{\text{i.d.}}{=\mathrel{\mkern-3mu}=}}\xspace \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, \mathsf{val}_b(\tilde{\tau})\big): (\ensuremath{\mathsf{OUT}}\xspace, \tilde{\tau}, b) \gets H^{\mathcal{M}_\lambda}(m,\rho_\lambda) \big\},
\end{align}
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.

Then, similarly to \Cref{eq:classical:H:m-0:m-1}, the post-quantum non-malleability can be reduced to establishing the following equation:
\begin{align*}
&\big\{\big(\ensuremath{\mathsf{OUT}}\xspace^0, \mathsf{val}_{b^0}(\tilde{\tau}^0)\big): (\ensuremath{\mathsf{OUT}}\xspace^0, \tilde{\tau}^0, b^0) \gets H^{\mathcal{M}_\lambda}(m_0,\rho_\lambda) \big\} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~& 
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace^1, \mathsf{val}_{b^1}(\tilde{\tau}^1)\big): (\ensuremath{\mathsf{OUT}}\xspace^1, \tilde{\tau}^1, b^1) \gets H^{\mathcal{M}_\lambda}(m_1,\rho_\lambda) \big\} \numberthis \label{pq:eq:classical:H:m-0:m-1},
\end{align*}
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $(m_0, m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.


\para{Proof by Contradiction.} Similarly to \Cref{eq:one-sided:proof:contra-assump}, we assume for contradiction that there are a (possibly non-uniform) QPT distinguisher $\mathcal{D} = \Set{\mathcal{D}_\lambda, \sigma_\lambda}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}$ and a function $\delta(\lambda) = 1/\mathsf{poly}(\lambda)$ such that for infinitely many $\lambda \in \ensuremath{\mathbb{N}}\xspace$, it holds that
\begin{equation}\label[Inequality]{pq:eq:one-sided:proof:contra-assump}
\bigg|\Pr[\mathcal{D}_\lambda\big(\ensuremath{\mathsf{OUT}}\xspace^0, \mathsf{val}_{b^0}(\tilde{\tau}^0); \sigma_\lambda\big)=1] - \Pr[\mathcal{D}_\lambda\big(\ensuremath{\mathsf{OUT}}\xspace^1, \mathsf{val}_{b^1}(\tilde{\tau}^1); \sigma_\lambda\big)=1] \bigg|\ge 3 \cdot \delta(\lambda),
\end{equation}
where the first probability is taken over the random procedure $(\ensuremath{\mathsf{OUT}}\xspace^0, \tilde{\tau}^0, b^0) \gets H^{\mathcal{M}_\lambda}(m_0,\rho_\lambda)$,
and the second probability is taken over the random procedure $(\ensuremath{\mathsf{OUT}}\xspace^1, \tilde{\tau}^1, b^1) \gets H^{\mathcal{M}_\lambda}(m_1,\rho_\lambda)$ (and the randomness due to the measurements performed by $\mathcal{D}_\lambda$ (if any) for both probabilities).

Then, we show the following \Cref{pq:lem:one-sided:proof:core}, which should be understood as the post-quantum counterpart of \Cref{lem:one-sided:proof:core}. 
\begin{lemma}\label{pq:lem:one-sided:proof:core}
For the above $\delta(\lambda)$,
there exits a hybrid $G$ such that for any QPT $\mathcal{M}=\Set{\mathcal{M}_\lambda, \rho_\lambda}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}$, the following holds
\begin{enumerate}
\item\label[Property]{pq:item:lem:one-sided:proof:core:1}
$\big\{(\ensuremath{\mathsf{OUT}}\xspace^0, \msf{Val}^0):(\ensuremath{\mathsf{OUT}}\xspace^0, \msf{Val}^0) \gets G^{\mathcal{M}_\lambda}(\lambda,m_0,\rho_\lambda) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{(\ensuremath{\mathsf{OUT}}\xspace^1, \msf{Val}^1):(\ensuremath{\mathsf{OUT}}\xspace^1, \msf{Val}^1) \gets G^{\mathcal{M}_\lambda}(\lambda,m_1,\rho_\lambda) \big\}$,
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $(m_0, m_1) \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \times \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.
\item\label[Property]{pq:item:lem:one-sided:proof:core:2}
\begingroup\fontsize{9.5pt}{0}\selectfont
$\big\{(\ensuremath{\mathsf{OUT}}\xspace^{G}, \msf{Val}^{G}):(\ensuremath{\mathsf{OUT}}\xspace^{G}, \msf{Val}^{G}) \gets G^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda) \big\}
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\delta(\lambda)} 
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace^{H}, \mathsf{val}_{b^{H}}(\tilde{\tau}^{H})\big): (\ensuremath{\mathsf{OUT}}\xspace^{H}, \tilde{\tau}^{H}, b^{H}) \gets H^{\mathcal{M}_\lambda}(\lambda,m,\rho_\lambda) \big\}$,
\endgroup  
where both ensembles are indexed by $\lambda \in \ensuremath{\mathbb{N}}\xspace$ and $m \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)}$.
\end{enumerate}
\end{lemma}

It is easy to see that if \Cref{pq:lem:one-sided:proof:core} is true, it contradicts our assumption in \Cref{pq:eq:one-sided:proof:contra-assump}. Therefore, it will finish the proof of non-malleability. Indeed, this lemma is the most technically involved part. We prove it in \Cref{pq:sec:one-sided:core-lemma:proof}.

\subsection{Proof of \Cref{pq:lem:one-sided:proof:core}}
\label{pq:sec:one-sided:core-lemma:proof} 
Similarly to \Cref{hybrid:H:reinterpretation}, we provide a new but equivalent interpretation of the game $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ in \Cref{pq:hybrid:H:reinterpretation}. We also provide a picture in \Cref{pq:figure:one-sided:H:re-interpretation} to illustrate it.
\begin{AlgorithmBox}[label={pq:hybrid:H:reinterpretation}]{Re-interpretation of Game \textnormal{$H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$}}
Game $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ can be split into the following stages:
\begin{enumerate}
\item \label[Stage]{pq:hybrid:H:reinterpretation:1}
{\bf Prefix Generation:}
First, execute \Cref{pq:item:one-sided:step:Naor-rho,pq:item:one-sided:step:committing} of the man-in-the-middle game of \Cref{pq:prot:one-sided:classical}. That is, it plays as the left honest committer committing to $m$ and the right honest receiver, with $\mathcal{M}_{\lambda}(\rho_\lambda)$ being the man-in-the-middle adversary.

\subpara{Notation:} Let $\mathsf{st}_{\mathcal{M}}$ denote the state of $\mathcal{M}$ at the end of \Cref{pq:item:one-sided:step:committing}; Let $\mathsf{st}_C$  (resp.\ $\mathsf{st}_R$) denote the state of the honest committer (resp.\ receiver) at the end of \Cref{pq:item:one-sided:step:committing}; Let $\tilde{\tau}$ denote the tuple $(\tilde{\beta}, \tilde{\mathsf{com}})$\footnote{Recall that $\tilde{\beta}$ and  $\tilde{\mathsf{com}}$ are the \Cref{pq:item:one-sided:step:Naor-rho,pq:item:one-sided:step:committing} messages in the right session; they constitutes an execution of Naor's commitment.}. In terms of notation, we denote the execution of this stage by 
\begin{equation}\label[Expression]{pq:expression:hybrid:H:prefix}
(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})\gets H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda).
\end{equation}
We will call the tuple $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ the {\em prefix} and denote it by $\mathsf{pref}$. It is worth noting that this $\mathsf{pref}$ contains all the information such that a QPT machine can ``complete'' the remaining execution of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ starting from $\mathsf{pref}$.

\item \label[Stage]{pq:stage:hybrid:H:remainder}
{\bf The Remainder:}
Next, it simply resumes from where the {\bf Prefix Generation} stage stops, to finish the remaining steps of the man-in-the-middle execution $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$.

\subpara{Notation:} We introduce the following notations to describe this stage. Define a QPT machine $\ensuremath{\mathcal{A}}\xspace$ that takes as input $(\mathsf{st}_{\mathcal{M}}, \tilde{\tau})$; Machine $\mathcal{A}_\lambda$ is supposed to run the residual strategy of $\mathcal{M}_\lambda$ starting from $\mathsf{st}_{\mathcal{M}}$. Also, define a QPT machine $\mathcal{B}$ that takes as input $(\mathsf{st}_C, \mathsf{st}_R, \tilde{\tau})$; Machine $\mathcal{B}$ is supposed to run the residual strategies of the honest committer $C$ and receiver $R$, starting from 
$\mathsf{st}_C$ and $\mathsf{st}_R$ respectively\footnote{Note that it is not necessary to give $\tilde{\tau}$ as common input to these parties; indeed, it can be included in their respective internal states. We choose to make $\tilde{\tau}$ explicit only to match the syntax of \Cref{lem:extract_and_simulate}.}. With the above notations, we can denote the execution of the remaining steps of $H^{\mathcal{M}}(\lambda, m,z)$ by
\begin{equation}\label[Expression]{pq:expression:hybrid:H:remainder}
(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b)\gets \langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau}),
\end{equation}
where $\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}$ is the output of $\mathcal{A}_\lambda$, and $b \in \Set{\bot, \top}$ is the output of the honest receiver $R$ (in the right), indicating if the man-in-the-middle's commitment (i.e., the right session) is accepted ($b = \top$) or not ($b = \bot$). (We remark that $\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace$ is nothing but the man-in-the-middle $\mathcal{M}$'s final output.)

\item
{\bf Output:} It outputs the tuple $(\ensuremath{\mathsf{OUT}}\xspace_\ensuremath{\mathcal{A}}\xspace, \tilde{\tau}, b)$.  
\end{enumerate}
\end{AlgorithmBox}

We prove the following lemma.
\begin{lemma}\label{pq:lem:small-tag:proof:se}
Let $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, $\mathcal{A}_\lambda$, and $\mathcal{B}$ be as defined in \Cref{pq:hybrid:H:reinterpretation}.
There exists a QPT machine $\mathcal{SE}$ (the simulation-extractor) such that for any $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, any noticeable $\epsilon(\lambda)$, it holds that
\begin{align*}
& \big\{ (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) : (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{M}},\mathsf{st}_{R},\tau, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon(\lambda)} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, \mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} 
\end{align*}
\end{lemma}
{\color{Plum}
\begin{remark}\label{rmk:input_instead_of_oracle}
Compared to the classical counterpart (\Cref{lem:small-tag:proof:se}), $\mathcal{SE}$ takes $\mathcal{A}_\lambda$ and $\mathsf{st}_{\mathcal{M}}$ as part of its input instead of accessing $\mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}})$. 
Though we can see that $\mathcal{SE}$ actually makes only black-box use of $\mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}})$ in a certain sense, we do not try to formally state it because black-box simulation is not our focus. 
Another minor difference is that we removed $b_{\mathcal{SE}}$ from the output of $b_{\mathcal{SE}}$. This is because $b_{\mathcal{SE}}$ was only used in the proof of the classical counterpart of \Cref{pq:lem:small-tag:proof:se}  (i.e., \Cref{lem:small-tag:proof:se}), which will be replaced with a different proof based on \Cref{lem:extract_and_simulate}.   
\end{remark}
}

\Cref{pq:lem:small-tag:proof:se} is the main technical lemma for the current proof of \Cref{pq:lem:one-sided:proof:core}. We present its proof in \Cref{pq:lem:small-tag:proof:se:proof}. In the following, we finish the proof of \Cref{pq:lem:one-sided:proof:core}  assuming that \Cref{pq:lem:small-tag:proof:se} is true.



With \Cref{pq:lem:small-tag:proof:se}, we are now ready to present the description of $G$.
\begin{AlgorithmBox}[label={pq:hybrid:G}]{Hybrid \textnormal{${G}^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$}}
This hybrid proceeds as follows:
\begin{enumerate}
\item
{\bf Prefix Generation:}
This stage is identical to \Cref{pq:hybrid:H:reinterpretation:1} of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$. Formally, it executes 
$$(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau}) \gets H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda),$$
where $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$ is defined in \Cref{pq:hybrid:H:reinterpretation:1} of \Cref{pq:hybrid:H:reinterpretation}.
\item
{\bf The Remainder:}
Define $\mathcal{A}_\lambda$ in the same way as in \Cref{pq:stage:hybrid:H:remainder} of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$. With this $\mathcal{A}_\lambda$  and the $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_R, \tau,\tilde{\tau})$ from the previous stage, ${G}^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ invokes the $\mathcal{SE}$ prescribed in \Cref{pq:lem:small-tag:proof:se}. Formally, it executes the following procedure:
$$(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace(1^\lambda, 1^{\delta^{-1}},\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{M}},\mathsf{st}_R,\tau,\tilde{\tau}),$$
where the $\delta$ is the statistical distance that we want to show for \Cref{pq:item:lem:one-sided:proof:core:2} of \Cref{pq:lem:one-sided:proof:core}.

\begin{remark}
We emphasize that in this stage, ${G}^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ does {\em not} make use of $\mathsf{st}_C$.
\end{remark}
\item
{\bf Output:}
It outputs $(\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}})$.
\end{enumerate}
\end{AlgorithmBox}

\para{Proving \Cref{pq:item:lem:one-sided:proof:core:1} of \Cref{pq:lem:one-sided:proof:core}.} Observe that hybrid $G^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ is an efficient machine, since both $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$ and $\ensuremath{\mathcal{SE}}\xspace(1^\lambda, 1^{\delta^{-1}},\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{M}},\mathsf{st}_R,\tau,\tilde{\tau})$ are efficient. Moreover, it does not rewind \Cref{pq:item:one-sided:step:Naor-rho,pq:item:one-sided:step:committing} of the man-in-the-middle execution, and $\ensuremath{\mathcal{SE}}\xspace(1^\lambda, 1^{\delta^{-1}},\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{M}},\mathsf{st}_R,\tau,\tilde{\tau})$ does {\em not} need to know $\mathsf{st}_C$. Therefore, \Cref{pq:item:lem:one-sided:proof:core:1} of \Cref{pq:lem:one-sided:proof:core} follows immediately from the computationally-hiding property of the left Naor's commitment (i.e., \Cref{pq:item:one-sided:step:Naor-rho,pq:item:one-sided:step:committing} in the left session). 

\para{Proving \Cref{pq:item:lem:one-sided:proof:core:2} of \Cref{pq:lem:one-sided:proof:core}.} First, observe that the distribution of the prefix is identical in $G^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ and $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$.
For each fixed prefix, \Cref{pq:lem:small-tag:proof:se} implies that $G^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ and $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ are $\delta(\lambda)$-computationally indistinguishable (notice that $G^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ runs $\mathcal{SE}$ with the second input $1^{\delta^{-1}}$). 
This immediately implies \Cref{pq:item:lem:one-sided:proof:core:2} of \Cref{pq:lem:one-sided:proof:core}.  


\subsection{Proof of \Cref{pq:lem:small-tag:proof:se}}
\label{pq:lem:small-tag:proof:se:proof}
\begin{figure}[!h]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=1]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:H:re-interpretation}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=2]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:G1}
     \end{subfigure}
     \caption{Machines $H^{\mathcal{M}}$ and $\mathcal{G}_1$ {\scriptsize (Difference is highlighted in red color)}}
     \label{pq:figure:one-sided:games:M:G1}
\end{figure}



First, we describe a machine $\mathcal{G}_1$ that simulates the real execution without using $\mathsf{st}_C$.   
{\color{Plum}
Unlike its classical counterpart, 
$\mathcal{G}_1$ is parameterized by a noticeable function $\epsilon_\mathsf{wiaok}(\lambda)$, which is used as the error parameter for witness-extended emulators for $\ensuremath{\mathsf{WIAoK}}\xspace$ (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}).  
}

\para{Machine $\mathcal{G}_1{\color{Plum}[\epsilon_\mathsf{wiaok}]}$:} (Illustrated in \Cref{pq:figure:one-sided:G1}\label{pq:pageref:one-sided:proof:G1}) For any prefix $\mathsf{pref}$, $\mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to \Cref{pq:stage:hybrid:H:remainder} of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ shown in \Cref{pq:hybrid:H:reinterpretation} (and depicted in \Cref{pq:figure:one-sided:H:re-interpretation}), except for the following difference: Instead of executing the left {\bf WIAoK-1} honestly, it uses the witness-extended emulator (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}) of the left {\bf WIAoK-1} {\color{Plum} with the error parameter $\epsilon_\mathsf{wiaok}(\lambda)$} to extract a witness, and
\begin{itemize}
\item
 If the left committer accepts the left {\bf WIAoK-1} and the extracted witness is valid (i.e., it is a $(j, x_j)$ pair such that $y_j = f(x_j)$ for some $j \in [t]$), $\mathcal{G}_1$ uses $(j, x_j)$ to finish the left {\bf WIAoK-2}. Similarly to $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$, $\mathcal{G}_1$ eventually outputs $\mathcal{M}$'s final state and the right receiver's decision bit $b$; 
 \item
 If the left committer accepts the left {\bf WIAoK-1}  but the extracted witness is invalid, it aborts immediately and outputs $(\bot, \bot)$.
 \item If the left committer rejects the left {\bf WIAoK-1}, it runs the rest of execution of $H^{\mathcal{M}_\lambda}(\lambda, m, \rho_\lambda)$ to output $\mathcal{M}$'s final state and the right receiver's decision bit $b$.  Note that it does not need to run the left {\bf WIAoK-2} in this case since the left committer aborts after the left {\bf WIAoK-1}. 
\end{itemize}
We denote the above procedure by $(\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$. 
It is worth noting that $\mathcal{G}_1$ does {\em not} need to know $\mathsf{st}_C$.

\if0
\begin{remark}[Precise Meaning of Extraction]\label{pq:rem:meaning_extraction}
In the description of $\mathcal{G}_1$, we say that ``it uses the witness-extended emulator of the left {\bf WIAoK-1} to extract a witness". 
Precisely, this means the following: 
We consider a cheating prover against the left {\bf WIAoK-1} that takes the states of $\mathcal{M}$ and the right receiver right before starting the left {\bf WIAoK-1} as advice, interacts with the left committer while simulating $\mathcal{M}$ and the right receiver, and outputs the states of $\mathcal{M}$ and the right receiver right after finishing the left {\bf WIAoK-1}. $\mathcal{G}_1$ runs the witness-extended emulator of the left {\bf WIAoK-1} (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}) w.r.t. the above described cheating prover to simulate the states of $\mathcal{M}$ and the right receiver right after finishing the left {\bf WIAoK-1}, the decision bit of the left {\bf WIAoK-1} by the left committer as well as extracting a (candidate of) witness of $\ensuremath{\mathcal{L}}\xspace_f^t$.  
We use similar convention many times throughout the paper. 
\end{remark}
\fi


Next, we prove a lemma that shows that  $\mathcal{G}_1[\epsilon_\mathsf{wiaok}]$ simulates the real execution {\color{Plum} up to an error $\epsilon_\mathsf{wiaok}$}. 
\begin{lemma}\label{pq:lem:main-thread:sim:real}
Let $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, $\mathcal{A}_\lambda$, and $\mathcal{B}$ be as defined in \Cref{pq:hybrid:H:reinterpretation}. For any $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, it holds that
\begin{align*}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b \big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
{\color{Plum}\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon_\mathsf{wiaok}(\lambda)}} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, ~b\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}. 
\end{align*}
\end{lemma}
\begin{proof}
We first define an intermediate machine $\mathcal{G}'_1  [\epsilon_\mathsf{wiaok}]$ below. 
\begin{figure}[!h]
\centering
\fbox{
     \includegraphics[width=0.55\textwidth,page=3]{figures/figures-PQ.pdf}
     }
     \caption{Machine $\mathcal{G}'_1$ {\scriptsize (Difference with $\mathcal{G}_1$ is highlighted in red color)}}
     \label{pq:figure:one-sided:G'1}
\end{figure}

\para{Machine $\mathcal{G}'_1{\color{Plum} [\epsilon_\mathsf{wiaok}]}$:} (Illustrated in \Cref{pq:figure:one-sided:G'1}\label{pq:pageref:one-sided:proof:G'1}) For any prefix $\mathsf{pref}$, $\mathcal{G}'_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}_1 [\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it uses $(m,r)$ as the witness in the left {\bf WIAoK-2} even if it succeeds in extracting a valid witness from the left {\bf WIAoK-1}.

By the WI property of the left {\bf WIAoK-2}, it holds that 
\begin{align} 
\begin{split}\label{pq:eq:G1_to_G'1}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace}
\end{split}.
\end{align}


Note that the only difference between $\mathcal{G}'_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ and $\langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})$ is that the former runs the witness-extended emulator of the left {\bf WIAoK-1} {\color{Plum} with the error parameter $\epsilon_\mathsf{wiaok}(\lambda)$} (but does not use the extracted witness at all). Thus, by the AoK property of the left {\bf WIAoK-1}, it holds that 
\begin{align} 
\begin{split}\label{pq:eq:G'1_to_real}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~b\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
{\color{Plum} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon_\mathsf{wiaok}(\lambda)}} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, ~b\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\end{split}.
\end{align}

By combining \Cref{pq:eq:G1_to_G'1,pq:eq:G'1_to_real}, we obtain \Cref{pq:lem:main-thread:sim:real}. 

\end{proof}

Next, we define the probability of $R$ being convinced in the execution of $\mathcal{G}_1[\epsilon_\mathsf{wiaok}]$. This value plays an important role later in our proof.
\begin{definition}\label{pq:def:p-sim-pref}
For any $(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ in the support of $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$ {\color{Plum} and any noticeable $\epsilon_\mathsf{wiaok}$}, we define the following value $p^{\mathsf{Sim}}_{\mathsf{pref}}[\epsilon_\mathsf{wiaok}]$:
$$p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum}[\epsilon_\mathsf{wiaok}]} \coloneqq \Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1{\color{Plum}  [\epsilon_\mathsf{wiaok}]}(\mathsf{st}_\mathcal{M}, \mathsf{st}_R, \tau,\tilde{\tau})]$$
\end{definition}

Next, we show a technical lemma that gives an extractor $\mathcal{K}$ without the simulation property. 
\begin{lemma}\label{pq:lem:small-tag:proof:se:proof:K}
Let $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$, $\mathcal{A}_\lambda$, $\mathcal{B}$ be as defined in \Cref{pq:hybrid:H:reinterpretation}. There exists a QPT machine $\mathcal{K}$ such that for any noticeable $\epsilon(\lambda)$, {\color{Plum} there is a noticeable $\epsilon_\mathsf{wiaok}(\lambda)$ that is efficiently computable from $\epsilon(\lambda)$} such that the following holds  for any $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$:  \takashi{I think only considering honestly generated prefix is insufficient for using \Cref{lem:extract_and_simulate}. We should require the following hold for all $\mathsf{st}_{\mathcal{M}}$ that may be outside the support. I believe this is already proven because we do not use any security of primitive in the prefix, but this should be carefully stated.
A simple fix may be to replace this with ``for any $\mathsf{pref}=(\mathsf{st}_{\mathcal{M}},  \mathsf{st}_C, \mathsf{st}_R, \tau,\tilde{\tau})$ such that $\mathsf{val}(\tilde{\tau})\neq \bot$" (in this lemma and also other lemmas in this section.) But then we have to carefully re-examine that they really hold for an arbitrary prefix with $\mathsf{val}(\tilde{\tau})\neq \bot$ instead of honestly generated ones.}
\begin{enumerate}
\item \label[Property]{pq:property:small-tag:proof:se:proof:K:syntax}
{\bf (Syntax.)} $\mathcal{K}$ takes as input $(1^\lambda,{\color{Plum} 1^{\epsilon^{-1}}}, \mathcal{A}_{\lambda}, \mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$. It outputs a value $\mathsf{Val}_{\mathcal{K}} \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \cup \Set{\bot}$ such that $\mathsf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val}_{\mathcal{K}} \ne \bot$.

\item \label[Property]{pq:property:small-tag:proof:se:proof:K}
If $p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum}  [\epsilon_\mathsf{wiaok}]} \ge \epsilon(\lambda)$, then it holds that
$$\Pr[\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau}) : \msf{Val}_{\mathcal{K}} \gets \mathcal{K}(1^\lambda,{\color{Plum} 1^{\epsilon^{-1}}}, \mathcal{A}_{\lambda}, \mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge \frac{\epsilon'(\lambda)}{\tilde{t}},$$
where  $\epsilon'(\lambda) \coloneqq \frac{\epsilon(\lambda)}{10t^2}$.
\end{enumerate}
\end{lemma}
{\color{Plum}
\begin{remark}
Compared to the classical counterpart (\Cref{lem:small-tag:proof:se:proof:K}), $\mathcal{K}$ takes $1^{\epsilon^{-1}}$ as an additional input. 
This is needed because we only assume the AoK property via witness-extended {\em $\epsilon$-close} emulation  (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}). 
As a positive effect of the above difference, $\mathcal{K}$ in \Cref{pq:lem:small-tag:proof:se:proof:K} runs in \emph{strict} QPT whereas it runs in \emph{expected} PPT in the classical counterpart (\Cref{lem:small-tag:proof:se:proof:K}). 
Also, we give $\mathcal{A}_{\lambda}$ and $ \mathsf{st}_{\mathcal{M}}$ as part of input to $\mathcal{K}$ instead of giving oracle access to $\mathcal{A}_{\lambda}(\mathsf{st}_{\mathcal{M}})$ for a similar reason in \Cref{rmk:input_instead_of_oracle}.
\end{remark}
}

\if0
\begin{remark}[On the Output of $\mathcal{K}$]
\label{pq:rmk:small-tag:proof:se:proof:K:output}
The output $\mathsf{Val}_{\mathcal{K}}$ is expected to be the value committed in $\tilde{\tau}$, i.e., $\mathsf{val}(\tilde{\tau})$. If $\mathsf{Val}_{\mathcal{K}} = \bot$, it indicates that $\mathcal{K}$ did not extract the correct $\mathsf{val}(\tilde{\tau})$. We explicitly include $\bot$ in the range of $\mathcal{K}$ for the following purpose: looking ahead, the simulation-extractor $\mathcal{SE}$ that we are going to build will invoke $\mathcal{K}$ for several times, until the value $\mathsf{val}(\tilde{\tau})$ is extracted. However, $\mathcal{SE}$ cannot tell if the extracted value is indeed $\mathsf{val}(\tilde{\tau})$. Thus, the case $\mathsf{Val}_{\mathcal{K}} = \bot$ serves as an indicator, telling $\mathcal{SE}$ if the extraction by $\mathcal{K}$ succeeds (more accurately, fails). 

As a vigilant reader may have already realized, there is an alternative formalism: simply ask $\mathcal{K}$ to output both $\mathsf{val}(\tau)$ {\em and the decommitment information} so that $\mathcal{SE}$ can test by itself whether $\mathcal{K}$'s extraction is successful. We remark that it indeed works for the current proof {\em in classical setting}. However, it may not extend when we prove {\em post-quantum} non-malleability. In short, that is because to make this proof work in the quantum setting, our technique requires that the valid output of $\mathcal{K}$ should be {\em unique}; Only in this way, can we ask $\mathcal{K}$ to ``forget'' other information, such that the extraction procedure can be ``un-computed'' to rewind $\mathcal{M}$ back without much disturbance to its initial state. (This point will become clearer in the proof of \Cref{lem:extract_and_simulate}.) However, if we include the decommitment information in the output of $\mathcal{K}$, then the valid output may not be unique, even if the commitment scheme is perfect-binding---There could exists different ways to decommit to the {\em unique} committed value.

To make the proof consistent in both classical and quantum settings, we choose the current formalism in \Cref{pq:property:small-tag:proof:se:proof:K:syntax}.
\end{remark}
\fi

We will prove \Cref{pq:lem:small-tag:proof:se:proof:K} in \Cref{pq:sec:lem:small-tag:proof:se:proof:K:proof}.
In the rest of this subsection, we finish the proof of \Cref{pq:lem:small-tag:proof:se} assuming \Cref{pq:lem:small-tag:proof:se:proof:K} is true.
{\color{Plum} This is the only part of the proof of \Cref{pq:thm:one-sided:non-malleability} that significantly differs from its classical counterpart.


\begin{proof}[Proof of \Cref{pq:lem:small-tag:proof:se}]\label{pageref:different_part}
We apply \Cref{lem:extract_and_simulate} where $\mathcal{G}_1[\epsilon_\mathsf{wiaok}]$, $\mathcal{K}$, $(\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{M}},\mathsf{st}_R,\tau)$, $\tilde{\tau}$, and $\mathsf{val}({\tilde{\tau}})$ play the roles of $\mathcal{G}$, $\mathcal{K}$, $\rho_\lambda$, $z_\lambda$, and $s^*_{z_\lambda}$ in \Cref{lem:extract_and_simulate}, respectively. 
Then, \Cref{pq:lem:small-tag:proof:se:proof:K} ensures that the assumptions of \Cref{lem:extract_and_simulate} are satisfied.\footnote{Remark that $\epsilon(\lambda)$ and $\frac{\epsilon'(\lambda)}{\tilde{t}}$ in \Cref{pq:lem:small-tag:proof:se:proof:K} play the roles of $\gamma(\lambda)$ and  $\delta(\lambda)$ in \Cref{lem:extract_and_simulate}, respectively.
} Thus, there exists a polynomial $\mathsf{poly}$ and a QPT machine $\mathcal{SE}'$ such that for any noticeable function $\bar{\epsilon}(\lambda)$,  
\begin{align}
\begin{split}\label{pq:eq:ind_SE_and_G1}
& \big\{ (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}'}, \mathsf{Val}_{\mathcal{SE}'}) : (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}'}, \mathsf{Val}_{\mathcal{SE}'}) \gets \ensuremath{\mathcal{SE}}\xspace'(1^\lambda,1^{\bar{\epsilon}^{-1}},\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{M}},\mathsf{st}_{R},\tau, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{s}}{\approx}}\xspace_{\bar{\epsilon}(\lambda)} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace, \mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} 
\end{split}
\end{align}
for $\epsilon_\mathsf{wiaok}(\lambda)=\mathsf{poly}(\bar{\epsilon}(\lambda))$. 

Moreover, since $\mathsf{val}_b(\tilde{\tau})$ is determined by $b$ for each fixed $\tilde{\tau}$, \Cref{pq:lem:main-thread:sim:real} directly implies 
\begin{align} 
\begin{split}\label{pq:eq:ind_G1_and_real}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~\mathsf{val}_b(\tilde{\tau})\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon_\mathsf{wiaok}(\lambda)} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, ~\mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\end{split}.
\end{align}
By taking $\bar{\epsilon}(\lambda)$ to be sufficiently small so that $\bar{\epsilon}(\lambda) + \epsilon_\mathsf{wiaok}(\lambda)\leq \epsilon(\lambda)$ and defining $\mathcal{SE}(1^\lambda,1^{\epsilon^{-1}},...):= \mathcal{SE}'(1^\lambda,1^{\bar{\epsilon}^{-1}},...)$, \Cref{pq:eq:ind_SE_and_G1,pq:eq:ind_G1_and_real} give \Cref{pq:lem:small-tag:proof:se}. 

\end{proof}



\if0
\begin{proof}[Proof of \Cref{pq:lem:small-tag:proof:se}]
We apply \Cref{lem:extract_and_simulate} where $\mathcal{G}_1[\epsilon_\mathsf{wiaok}]$, $\mathcal{K}$, $(\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{\lambda}},\mathsf{st}_R,\tau,\tilde{\tau})$, and $\mathsf{val}({\tilde{\tau}})$ play the roles of $\mathcal{G}$, $\mathcal{K}$, $\rho_\lambda$, and $s^*$ in \Cref{lem:extract_and_simulate}, respectively. 
Then, \Cref{pq:lem:small-tag:proof:se:proof:K} ensures that the assumptions of \Cref{lem:extract_and_simulate} are satisfied.\footnote{Remark that $\epsilon(\lambda)$ and $\frac{\epsilon'(\lambda)}{\tilde{t}}$ in \Cref{pq:lem:small-tag:proof:se:proof:K} plays the roles of $\beta(\lambda)$ and  $\delta(\lambda)$ in \Cref{lem:extract_and_simulate}, respectively.
} Thus, there exists a QPT machine $\mathcal{SE}$ such that 
\begin{align}
\begin{split}\label{pq:eq:ind_SE_and_G1}
& \big\{ (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) : (\ensuremath{\mathsf{OUT}}\xspace_{\mathcal{SE}}, \mathsf{Val}_{\mathcal{SE}}) \gets \ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\mathcal{A}_\lambda,\mathsf{st}_{\mathcal{M}},\mathsf{st}_{R},\tau, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{s}}{\approx}}\xspace_{\epsilon(\lambda)} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace, \mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace} 
\end{split}.
\end{align}
Moreover, since $\mathsf{val}_b(\tilde{\tau})$ is determined by $b$ for each fixed $\tilde{\tau}$, \Cref{pq:lem:main-thread:sim:real} directly implies 
\begin{align} 
\begin{split}\label{pq:eq:ind_G1_and_real}
& \big\{\big(\ensuremath{\mathsf{OUT}}\xspace, ~\mathsf{val}_b(\tilde{\tau})\big): (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1[\epsilon_\mathsf{wiaok}](\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau}) \big\}_{\lambda \in \ensuremath{\mathbb{N}}\xspace} \\
\ensuremath{\stackrel{\text{c}}{\approx}}\xspace_{\epsilon_\mathsf{wiaok}(\lambda)} ~&
\big\{\big(\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, ~\mathsf{val}_b(\tilde{\tau})\big) : (\ensuremath{\mathsf{OUT}}\xspace_\mathcal{A}, b) \gets \langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})\big\}_{\lambda\in \ensuremath{\mathbb{N}}\xspace}
\end{split}.
\end{align}
By combining \Cref{pq:eq:ind_SE_and_G1,pq:eq:ind_G1_and_real} and $\epsilon_\mathsf{wiaok}(\lambda)\leq \epsilon(\lambda)$, we obtain \Cref{pq:lem:small-tag:proof:se}.  
\end{proof}
\fi
}


\subsection{Extractor $\mathcal{K}$ (Proof of \Cref{pq:lem:small-tag:proof:se:proof:K})}
\label{pq:sec:lem:small-tag:proof:se:proof:K:proof}
{\color{Plum} In the following, we fix a noticeable function $\epsilon(\lambda)$ for which we want to prove \Cref{pq:lem:small-tag:proof:se:proof:K}. We show that it suffices to set $\epsilon_\mathsf{wiaok}(\lambda):= \frac{t+1}{t^2+6t+3}\cdot \epsilon'(\lambda)=\frac{t+1}{10t^2(t^2+6t+3)}\cdot \epsilon(\lambda)$. 
Since we fix $\epsilon$ and $\epsilon_\mathsf{wiaok}$, we omit the dependence on $\epsilon_\mathsf{wiaok}$ in our notation, i.e., we simply write $p^{\mathsf{Sim}}_{\mathsf{pref}}$ and $\mathcal{G}_1$ to mean $p^{\mathsf{Sim}}_{\mathsf{pref}}[\epsilon_\mathsf{wiaok}]$ and $\mathcal{G}_1[\epsilon_\mathsf{wiaok}]$. 
Similarly, machines introduced in the following also depend on $\epsilon_\mathsf{wiaok}$, but we do not explicitly write it in our notation. 
We also omit writing $(1^\lambda,1^{\epsilon^{-1}},\mathcal{A}_\lambda)$ from inputs of those machines for notational simplicity. 
}

\begin{figure}[!h]
\centering
\fbox{
     \includegraphics[width=0.55\textwidth,page=4]{figures/figures-PQ.pdf}
     }
     \caption{Machine $\mathcal{G}_i$ {\scriptsize (Difference with $\mathcal{G}_1$ is highlighted in red color)}}\vspace{1em}
     \label{pq:figure:one-sided:Gi}
\end{figure}

\vspace{1em}

\begin{figure}[!h]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=5]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:G'i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=6]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:G''i}
     \end{subfigure}
     \caption{Machines $\mathcal{G}'_i$ and $\mathcal{G}''_i$ {\scriptsize (Difference is highlighted in red color)}}
     \label{pq:figure:one-sided:hybrid:G'i:G''i}
\end{figure}

\para{Machine $\mathcal{G}_{i}$ ($i \in [\tilde{t}]$):\label{pq:machine:Gi:new}} (Illustrated in \Cref{pq:figure:one-sided:Gi}.)
Recall that we have already defined the machine $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ on \Cpageref{pq:pageref:one-sided:proof:G1}. Now, for $i \in [\tilde{t}] \setminus \Set{1}$, $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it uses $(i, \tilde{x}_i)$ as the witness in the right {\bf WIAoK-1}.


\begin{MyClaim}\label{pq:claim:bound:Gi:new}  
$\forall i \in [\tilde{t}], ~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}}  {\color{Plum} - 2\epsilon_\mathsf{wiaok}(\lambda)} -\mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
We define hybrid machines $\mathcal{G}'_i$ and $\mathcal{G}''_i$ as follows.

\para{Machine $\mathcal{G}'_{i}$ ($i \in [\tilde{t}]$):\label{pq:machine:G'i:new}} (Illustrated in \Cref{pq:figure:one-sided:G'i}.)
Recall that we have already defined the machine $\mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ on \Cpageref{pq:pageref:one-sided:proof:G'1}. Now, for $i \in [\tilde{t}] \setminus \Set{1}$, $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it uses $(i, \tilde{x}_i)$ as the witness in the right {\bf WIAoK-1}.

\para{Machine $\mathcal{G}''_i$ ($i \in [\tilde{t}]$):} (Illustrated in \Cref{pq:figure:one-sided:G''i}\label{pq:pageref:one-sided:proof:G''1}) For any prefix $\mathsf{pref}$, $\mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\mathcal{G}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ except that it honestly runs the left {\bf WIAoK-1} instead of running the witness-extended emulator. In other words, $\mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ behaves identically to $\langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})$ except that it uses $(i,\tilde{x}_i)$ as the witness in the right {\bf WIAoK-1}. 
In particular, $\mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ is identical to $\langle \mathcal{A}_\lambda(\mathsf{st}_{\mathcal{M}}), \mathcal{B}(\mathsf{st}_C, \mathsf{st}_R) \rangle(1^\lambda, \tilde{\tau})$. 

Then, \Cref{pq:claim:bound:Gi:new} follows from the following sequence of inequalities. 
\begin{itemize}
\item
By the  WI property of the left {\bf WIAoK-2} and the definition of $p^{\mathsf{Sim}}_{\mathsf{pref}}$, it holds that:
$$\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} - \mathsf{negl}(\lambda).$$
\item
By the AoK property of the left {\bf WIAoK-1} and the above inequality, it holds that:
$$\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} {\color{Plum} - \epsilon_\mathsf{wiaok}(\lambda)} -\mathsf{negl}(\lambda).$$
\item
By the WI property of the right {\bf WIAoK-1} and the above inequality, it holds that:
$$\forall i \in [\tilde{t}],~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum} - \epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda).$$
\item
By the AoK property of the left {\bf WIAoK-1} and the above inequality, it holds that:
$$\forall i \in [\tilde{t}],~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum} - 2\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda).$$
\item
By the  WI property of the left {\bf WIAoK-2} and the above inequality, it holds that:
$$\forall i \in [\tilde{t}],~\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} {\color{Plum} - 2\epsilon_\mathsf{wiaok}(\lambda)}- \mathsf{negl}(\lambda).$$
\end{itemize}
\end{proof}




\begin{figure}[!th]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=7]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:Ki}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=8]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:K}
     \end{subfigure}
     \caption{Machines $\mathcal{K}_i$ and $\mathcal{K}$ {\scriptsize (Difference is highlighted in red color)}}
     \label{pq:figure:one-sided:hybrid:Ki:K}
\end{figure}

\para{Machine $\mathcal{K}_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{pq:figure:one-sided:Ki}.) For a prefix $\mathsf{pref}$, $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ 
behaves identically to the $\mathcal{G}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ depicted in \Cref{pq:figure:one-sided:Gi}, except for the following difference. Machine $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ uses the witness-extended emulator (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}) {\color{Plum} with the error parameter $\epsilon_\mathsf{wiaok}(\lambda)$} to finish the right {\bf WIAoK-2}, instead of playing the role of the honest receiver. 

\subpara{$\mathcal{K}_i$'s Output:\label{pq:subpara:K-i:output}} Let $w'$ denote the third output of the witness-extended emulator (see \Cref{item:PQWEE} of \Cref{def:PQWIAoK}), which is supposed to be the witness used by $\mathcal{M}$ in the right {\bf WIAoK-2} (for the statement $(\tilde{\mathsf{com}}, \tilde{Y}$) w.r.t.\ the language $\ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}\vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$). Depending on the value of $w'$, we define a value $\mathsf{Val} \in \ensuremath{\{0,1\}}\xspace^{\ell(\lambda)} \cup \Set{\bot_{\tilde{Y}}, \bot_{\mathsf{invalid}}}$ as follows:
\begin{enumerate}
\item \label[Case]{pq:K-i:output:case:1}
If $w'$ is a valid witness for $(\tilde{\mathsf{com}}, \tilde{Y}) \in \ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}\vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$. Then, there are tow sub-cases:
\begin{enumerate}
\item \label[Case]{pq:K-i:output:case:1a}
$w'$ is a valid witness for $\tilde{\mathsf{com}} \in \ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}$. In this case, $w'$ consists of the value $\mathsf{val}(\tilde{\tau})$, i.e., the value committed in $\tilde{\tau}=(\tilde{\beta}, \tilde{\mathsf{com}})$, and the randomness $\tilde{r}$. We set $\mathsf{Val} \coloneqq \mathsf{val}(\tilde{\tau})$. Importantly, notice that we do {\em not} include the randomness $\tilde{r}$ in $\mathsf{Val}$.
\item \label[Case]{pq:K-i:output:case:1b}
$w'$ is a valid witness for $\tilde{Y} \in \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$: In this case, we set $\mathsf{Val} \coloneqq \bot_{\tilde{Y}}$.
\end{enumerate}

\item \label[Case]{pq:K-i:output:case:2}
Otherwise, set $\mathsf{Val} \coloneqq \bot_{\mathsf{invalid}}$.
\end{enumerate}


The output of $\mathcal{K}_i$ is defined to be the above $\mathsf{Val}$. Notice that this is in contrast to all previous machines, for which the output is defined to be the main-in-the-middle's  output and the honest receiver's decision bit. We emphasize that such a $\mathsf{Val}$ satisfies the syntax requirement in \Cref{pq:property:small-tag:proof:se:proof:K:syntax} of \Cref{pq:lem:small-tag:proof:se:proof:K}. In particular, {\em $\mathsf{Val} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val} \ne \bot$}.\footnote{Note that here we defined two types of abortion: $\bot_{\tilde{Y}}$ and $\bot_{\mathsf{invalid}}$, while \Cref{pq:property:small-tag:proof:se:proof:K:syntax} of \Cref{pq:lem:small-tag:proof:se:proof:K} only allows a single abortion symbol $\bot$. We remark that this is only a cosmetic difference---It can be made consistent using the following rules: $\bot = \bot_{\tilde{Y}}$ {\em and} $\bot = \bot_{\mathsf{invalid}}$ (i.e., $\mathsf{Val} \ne \bot  \Leftrightarrow (\mathsf{Val} \ne \bot_{\tilde{Y}} \wedge \mathsf{Val} \ne \bot_{\mathsf{invalid}})$).}

\begin{MyClaim}\label{pq:claim:bound:Ki}
$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum} - 3\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows from \Cref{pq:claim:bound:Gi:new} and the AoK property of the right {\bf WIAoK-2}. 

\end{proof}

Finally, we are ready to define the extractor $\mathcal{K}$. Intuitively, $\mathcal{K}$ can be conceived as an average-case version of $\Set{\mathcal{K}_i}_{i\in[\tilde{t}]}$:

\para{Extractor $\mathcal{K}$:\label{pq:extractorK:description}} (Illustrated in \Cref{pq:figure:one-sided:K}.)  For a prefix $\mathsf{pref}$, $\mathcal{K}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ samples uniformly at random an index $i \ensuremath{\leftarrow}\xspace [\tilde{t}]$, executes $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$, and outputs whatever $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ outputs.


Next, we show that the extractor $\mathcal{K}$ satisfies the requirements in \Cref{pq:lem:small-tag:proof:se:proof:K}.

\para{Running Time of $\mathcal{K}$.} Observe that for each $i \in [\tilde{t}]$, $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau,\tilde{\tau})$ differs from the real man-in-the-middle execution only in the following places: 
\begin{itemize}
\item
$(i,\tilde{x}_i)$ is used in the right {\bf WIAoK-1};
\item
the witness-extended emulator is used in the right {\bf WIAoK-2} and the left {\bf WIAoK-1}. 
\end{itemize}
Since the witness-extended emulator (as per \Cref{item:PQWEE} of \Cref{def:PQWIAoK}) runs in QPT, so does $\mathcal{K}_i$. Thus, $\mathcal{K}$ is QPT.

\para{Proving \Cref{pq:property:small-tag:proof:se:proof:K:syntax} of \Cref{pq:lem:small-tag:proof:se:proof:K}.} It is straightforward to see that the $\mathcal{K}$ defined above satisfies the syntax requirement in \Cref{pq:lem:small-tag:proof:se:proof:K}. In particular, we have $\mathsf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau})$ whenever $\mathsf{Val}_{\mathcal{K}} \ne \bot$, because this is true for each $\mathcal{K}_i$ by definition (see the paragraph for ``\underline{$\mathcal{K}_i$'s Output}'' on \Cpageref{pq:subpara:K-i:output}).


\para{Proving \Cref{pq:property:small-tag:proof:se:proof:K} of \Cref{pq:lem:small-tag:proof:se:proof:K}.} First, recall that \Cref{pq:property:small-tag:proof:se:proof:K} requires that 
for any $\mathsf{pref}$ in the support of $H^{\mathcal{M}_\lambda}_{\mathsf{pre}}(\lambda, m, \rho_\lambda)$ , if $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, then it holds that
\begin{equation}\label[Inequality]{pq:eq:bound:averageK}
\Pr[\msf{Val}_{\mathcal{K}} = \mathsf{val}(\tilde{\tau}) : \msf{Val}_{\mathcal{K}} \gets \mathcal{K}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \frac{\epsilon'(\lambda)}{\tilde{t}}.
\end{equation} 
Also recall that $\mathcal{K}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ is defined to execute the machine $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$  with  $i$ uniformly sampled from $[\tilde{t}]$. Therefore, \Cref{pq:eq:bound:averageK} can be reduced to the following \Cref{pq:lem:bound:Ki}. We will prove \Cref{pq:lem:bound:Ki} in \Cref{pq:sec:lem:bound:Ki:proof}, which will eventually finish the current proof of \Cref{pq:lem:small-tag:proof:se:proof:K}.
\begin{lemma}\label{pq:lem:bound:Ki}
Let $\epsilon(\lambda) = \frac{1}{\mathsf{poly}(\lambda)}$ and $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{t^2}$.
For any $\mathsf{pref} = (\mathsf{st}_{\mathcal{M}},\mathsf{st}_C, \mathsf{st}_R, \tau, \tilde{\tau})$, if $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, then there exists an $i \in [\tilde{t}]$ such that 
$$\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau}) :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \epsilon'(\lambda).$$
\end{lemma}


\subsection{Proof of \Cref{pq:lem:bound:Ki}}
\label{pq:sec:lem:bound:Ki:proof}

\para{Notation.} We highly recommend reviewing the ``\underline{$\mathcal{K}_i$'s Output}'' part on \Cpageref{pq:subpara:K-i:output} (in particular, the meanings of $\mathsf{Val}$, $\bot_{\tilde{Y}}$, and $\bot_{\mathsf{invalid}}$) before starting reading this subsection.  Recall that $\mathcal{K}_i$'s output $\mathsf{Val}$ is determined by the $w'$ output by the witness-extended emulator of the right {\bf WIAoK-2}. 
In this subsection, we will need to refer to this $w'$, although it is not included as a part of $\mathcal{K}_i$'s output. Particularly, we will make use of the following notation: whenever we write an expression of the form 
 $$\Pr[\text{Some Event $E_{w'}$ about $w'$}: \mathsf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})],$$
it should be understood as the probability of $E_{w'}$, where $w'$ refers to the $w'$ generated during the random procedure $\mathsf{Val} \gets\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$, over which the probability is taken. 

Using these notations, we can partition the event $\mathsf{Val} = \bot_{\tilde{Y}}$ as the following {\em mutually exclusive} events: $w' = (1, \tilde{x}_1)$, or, $\ldots$, or $w' =(\tilde{t}, \tilde{x}_{\tilde{t}})$, where $\tilde{y}_i = \tilde{f}(\tilde{x}_i)$ for each $i \in [\tilde{t}]$. Formally, we express this relation by 
\begin{equation}\label{pq:eq:bot-tilde-Y:partition}
\Pr[\mathsf{Val} = \bot_{\tilde{Y}}: \mathsf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] = \sum_{i = 1}^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i): \mathsf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]
\end{equation}

With the above notations, we prove \Cref{pq:lem:bound:Ki} in the following.

\para{Proof of \Cref{pq:lem:bound:Ki}.} We assume for contradiction that for some $\mathsf{pref}$ satisfying $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$, it holds that 
\begin{equation}\label[Inequality]{pq:eq:proof:averageK:contra-assump}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau}) :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] < \epsilon'(\lambda).
\end{equation}
\begin{MyClaim}\label{pq:cliam:bound:Ki-xi}
Under the assumption in \Cref{pq:eq:proof:averageK:contra-assump}, it holds that 
$$\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i) :\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum} - 3\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof}
In this proof, all the probabilities are taken over the random procedure $\msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$.

 First, notice that
\begin{align*}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot_{\mathsf{invlid}}] 
& = 
\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] +  \Pr[\msf{Val} = \bot_{\tilde{Y}}] \\
\text{(by \Cref{pq:eq:bot-tilde-Y:partition})} ~& = 
\Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] + \Pr[w' = (i, \tilde{x}_i)] + \sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j, \tilde{x}_j)]. \numberthis \label{pq:eq:bound:Ki-xi:1}
\end{align*}
Then, the following holds:
{\begingroup\fontsize{10.5pt}{0pt}\selectfont
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i)] 
& = 
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}] - \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j, \tilde{x}_j)] \bigg)  \label{pq:eq:bound:Ki-xi:derive:1} \\
& \ge p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum} - 3\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) - \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j,\tilde{x}_j)] \bigg)  \label[Inequality]{pq:eq:bound:Ki-xi:derive:2}\\
& \ge p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum} - 3\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) - \epsilon'(\lambda) -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[w' = (j,\tilde{x}_j)] \bigg), \label[Inequality]{pq:eq:bound:Ki-xi:derive:3}
\end{align}
\endgroup}
where \Cref{pq:eq:bound:Ki-xi:derive:1} follows from \Cref{pq:eq:bound:Ki-xi:1}, \Cref{pq:eq:bound:Ki-xi:derive:2} follows from \Cref{pq:claim:bound:Ki}, and \Cref{pq:eq:bound:Ki-xi:derive:3} follows from \Cref{pq:eq:proof:averageK:contra-assump}.

Now, to prove \Cref{pq:cliam:bound:Ki-xi}, it suffices to show that 
\begin{equation}
\forall i \in [\tilde{t}],~\forall j \in [\tilde{t}]\setminus \Set{i}, ~\Pr[w' = (j,\tilde{x}_j) : \msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] = \mathsf{negl}(\lambda).
\end{equation}
This can be reduced via standard techniques to the (post-quantum) one-wayness of the OWF $\tilde{f}$ in \Cref{pq:item:one-sided:step:OWFs} of the right execution. In more details, we assume for contradiction that there exist $i^*, j^* \in [\tilde{t}]$ such that $i^* \ne j^*$ and that the probability $\Pr[w' = (j^*, \tilde{x}_{j^*}) : \msf{Val} \gets \mathcal{K}_{i^*}(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]$ is non-negligible, where, by definition, $\tilde{x}_{j^*}$ is the preimage of $\tilde{y}_{j^*}$ under the right OWF $\tilde{f}$. Then, we can build a QPT adversary $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ breaking one-wayness in the following way: $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ obtains the challenge $y^*$ from the external one-wayness challenger; it then runs the machine $\mathcal{K}_{i^*}(\mathsf{pref})$ internally, for which $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ uses $y^*$ in place of $\tilde{y}_{j^*}$ when executing \Cref{pq:item:one-sided:step:OWFs} in the right. Note that the internal execution of $\mathcal{K}_{i^*}(\mathsf{pref})$ is identically to the real execution of $\mathcal{K}_{i^*}$, thus the extracted $w' =(j^*, \tilde{x}_{j^*})$ must satisfy $\tilde{f}(\tilde{x}_{j^*}) = \tilde{y}_j^*~(=y^*)$ with non-negligible probability, breaking one-wayness. 

This finishes the proof of \Cref{pq:cliam:bound:Ki-xi}.

\end{proof}


\para{Machine $\mathcal{K}'_i$ ($i \in [\tilde{t}]$):\label{pq:machineK':description}} (Illustrated in \Cref{pq:figure:one-sided:K'i}.) For a prefix $\mathsf{pref}$, $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ proceeds as follows:
\begin{enumerate}
\item
It first finishes \Cref{pq:item:one-sided:step:OWFs} of the man-in-the-middle execution in the same way as $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$. In particular, it will see in the left execution the values $Y = (y_1, \ldots, y_t)$ sent from $\mathcal{M}$; 
\item
It then recovers $(x_1, \ldots, x_t)$ by brute-force: Namely, for each $i \in [t]$, it inverts the OWF $f$ to find $x_i$ s.t.\ $f(x_i) = y_i$. It is possible that there exist some ``bad'' $y_i$'s that are not in the range of $f$. For such bad $i$'s, it sets $x_i = \bot$. If all the $x_i$'s are bad, $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ halts and outputs $\mathsf{Fail}$;
\item \label[Step]{pq:item:machineK':3}
If this step is reached, we know that $(x_1, \ldots, x_t)$ cannot be all-$\bot$. $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ then picks an $(s, x_s)$ uniformly at random from the good (i.e.\ non-$\bot$) $x_i$'s.
\item
Then, $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ continues to finish the execution in the same way as $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$, except that it uses $(s, x_s)$ as the witness when executing the left {\bf WIAoK-2}. 
\end{enumerate}
It is worth noting that the $(j, x_j)$ extracted by the witness-extended emulator for the left {\bf WIAoK-1} (inherited from $\mathcal{K}_i(\mathsf{pref})$) is not used any more by $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$. 

It is easy to see that if the $(s, x_s)$ picked by $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ is equal to the $(j, x_j)$ extracted in $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ from its left {\bf WIAoK-1}, then $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ and $\mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ are identical.\footnote{Similar to \Cref{rmk:injectivity-of-OWF}, this is the only place we make use of the injectivity of $f$.} Since $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ samples $(s,x_s)$ uniformly from all the good $(i, x_i)$'s, it must hold with probability at least $1/t$ that $(s, x_s) = (j,x_j)$.
Therefore, the following must hold:
{\begingroup\fontsize{10.5pt}{0pt}\selectfont
\begin{equation}\label[Inequality]{pq:eq:bound:K'i}
\forall i \in [\tilde{t}], ~\Pr[w' = (i, \tilde{x}_i) : \msf{Val} \gets \mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \frac{1}{t}\cdot \Pr[w' = (i, \tilde{x}_i) : \msf{Val} \gets \mathcal{K}_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})].
\end{equation}
\endgroup}

\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=9]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:K'i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=10]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:K''i}
     \end{subfigure}
     \caption{Machines $\mathcal{K}'_i$ and $\mathcal{K}''_i$ {\scriptsize (Difference is highlighted in red color)}}
     \label{pq:figure:one-sided:K'i-K''i}
\end{figure}

\para{Machine $\mathcal{K}''_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{pq:figure:one-sided:K''i}.) For a prefix $\mathsf{pref}$,  $\mathcal{K}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ behaves identically to $\mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ except that it plays as the honest committer in the left {\bf WIAoK-1}, instead of running the witness-extended emulator. Recall that starting from $\mathcal{K}'_i$, the witness $(j, x_j)$ extracted by the witness-extended emulator from the left {\bf WIAoK-1} is not used any more. Thus, machine $\mathcal{K}''_i$ does not need to perform this witness-extended emulation.

By the AoK property
of the left {\bf WIAoK-1}, it holds that
\begin{align*}
\forall i \in [\tilde{t}], ~&\big|\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}'_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]\big| \\
&\le {\color{Plum}  \epsilon_\mathsf{wiaok}(\lambda)}+\mathsf{negl}(\lambda). \numberthis \label[Inequality]{pq:eq:relation:K'-K''}
\end{align*}
Next, by the (non-uniform) WI property of the right {\bf WIAoK-1}, it holds that
\begin{align*}
\forall i \in [\tilde{t}], ~&\big|\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]\big|  \\
 &\le \mathsf{negl}(\lambda). \numberthis \label[Inequality]{pq:eq:relation:K:WI}
\end{align*}
\begin{remark}[Power of Non-Uniform Reductions]\label{pq:rmk:non-uniform_reduction}
Note that we can rely on the AoK and WI properties even though $\mathcal{K}'_i$ and $\mathcal{K}''_i$ perform brute-force to recover $(x_1,...,x_t)$. This is because the brute-forcing step is done before {\bf WIAoK-1} or {\bf WIAoK-2} starts; Thus, $(x_1,...,x_t)$ can be treated as a non-uniform advice in the reductions. This non-uniform type of argument will be used again in this section later.
\end{remark}

Then, we have the following claim:
\begin{MyClaim}\label{pq:claim:bound:K''1}
It holds that 
$$\forall i \in [\tilde{t}], ~\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \ge \frac{1}{t} \cdot \big(p^{\mathsf{Sim}}_{\mathsf{pref}} {\color{Plum}-(t+3)\epsilon_\mathsf{wiaok}(\lambda)}-  \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof} 
This claim follows from \Cref{pq:cliam:bound:Ki-xi} and \Cref{pq:eq:bound:K'i,eq:relation:K'-K'',eq:relation:K:WI}. Formally, (in the following, we omit the input $(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ to $\mathcal{K}_i$, $\mathcal{K}'_i$, and $\mathcal{K}''_i$)
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_1] 
 & \ge \Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}''_i]  - \mathsf{negl}(\lambda)
\label[Inequality]{pq:claim:bound:K''1:proof:1}\\
 & \ge 
\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}'_i] {\color{Plum}-\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) 
\label[Inequality]{pq:claim:bound:K''1:proof:2}\\
 & \ge 
\frac{1}{t}\cdot\Pr[w' = (i,\tilde{x}_i):\msf{Val} \gets \mathcal{K}_i] {\color{Plum}-\epsilon_\mathsf{wiaok}(\lambda)}  - \mathsf{negl}(\lambda) 
\label[Inequality]{pq:claim:bound:K''1:proof:3}\\
& \ge 
\frac{1}{t} \cdot \big(p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum}-3\epsilon_\mathsf{wiaok}(\lambda)}  - \epsilon'(\lambda)\big){\color{Plum}-\epsilon_\mathsf{wiaok}(\lambda)}  - \mathsf{negl}(\lambda), \label[Inequality]{pq:claim:bound:K''1:proof:4}
\end{align}
where \Cref{pq:claim:bound:K''1:proof:1} follows from \Cref{pq:eq:relation:K:WI}, \Cref{pq:claim:bound:K''1:proof:2} follows from \Cref{pq:eq:relation:K'-K''}, \Cref{pq:claim:bound:K''1:proof:3} follows from \Cref{pq:eq:bound:K'i}, and \Cref{pq:claim:bound:K''1:proof:4} follows from \Cref{pq:cliam:bound:Ki-xi}.

\end{proof}
Now, we show the last claim which, together with \Cref{pq:claim:bound:K''1}, will lead to the desired contradiction.
\begin{MyClaim}\label{pq:claim:K'':non-abort}
It holds that
$$\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}:\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \le p^{\mathsf{Sim}}_{\mathsf{pref}}  {\color{Plum} +2\epsilon_\mathsf{wiaok}(\lambda)} + \mathsf{negl}(\lambda).$$
\end{MyClaim}
\para{Deriving the Contradiction.} Before proving \Cref{pq:claim:K'':non-abort}, we first show why \Cref{pq:claim:bound:K''1,claim:K'':non-abort} are contradictory. In the following, all the probabilities are taken over $\msf{Val} \gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$:
\begin{align*}
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}] 
& = \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})]  + \Pr[\msf{Val} = \bot_{\tilde{Y}}] \\
& = \Pr[\msf{Val} = \mathsf{val}(\tilde{\tau})] + \sum_{i =1 }^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i)] \numberthis \label{pq:eq:bound:Ki:final-contradiction:0}\\
& \ge  \sum_{i =1 }^{\tilde{t}} \Pr[w' = (i,\tilde{x}_i)] \\
&\ge \tilde{t} \cdot \frac{1}{t} \cdot \big(p_{\mathsf{pref}}{\color{Plum}-(t+3)\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{pq:eq:bound:Ki:final-contradiction:1}\\
& \ge (1+\frac{1}{t}) \cdot (p_{\mathsf{pref}}{\color{Plum}-(t+3)\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda)) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{pq:eq:bound:Ki:final-contradiction:2}\\
& = (1+\frac{1}{t}) \cdot \bigg(p_{\mathsf{pref}}{\color{Plum}-\frac{t^2+6t+3}{t+1}\cdot\epsilon_\mathsf{wiaok}(\lambda)} - \epsilon'(\lambda)\bigg){\color{Plum}+ 2\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) \\
& = (1+\frac{1}{t}) \cdot \bigg(p_{\mathsf{pref}}{\color{Plum}- 2\epsilon'(\lambda)}\bigg){\color{Plum}+ 2\epsilon_\mathsf{wiaok}(\lambda)} - \mathsf{negl}(\lambda) \numberthis \label{pq:eq:bound:Ki:final-contradiction:2.5}\\
& = p_{\mathsf{pref}}^{\mathsf{Sim}}{\color{Plum}+ 2\epsilon_\mathsf{wiaok}(\lambda)} + \bigg(\frac{p^{\mathsf{Sim}}_{\mathsf{pref}}}{t} {\color{Plum}- 2\epsilon'(\lambda) - \frac{2\epsilon'(\lambda)}{t}}\bigg) - \mathsf{negl}(\lambda)\\
& \ge p^{\mathsf{Sim}}_{\mathsf{pref}}{\color{Plum}+ 2\epsilon_\mathsf{wiaok}(\lambda) + \frac{5t^2 - t -1}{5t^3}\cdot \epsilon(\lambda)} - \mathsf{negl}(\lambda)) \numberthis \label[Inequality]{pq:eq:bound:Ki:final-contradiction:3}\\
\end{align*}
where \Cref{pq:eq:bound:Ki:final-contradiction:0} follows from \Cref{pq:eq:bot-tilde-Y:partition}, \Cref{pq:eq:bound:Ki:final-contradiction:1} follows from \Cref{pq:claim:bound:K''1}, \Cref{pq:eq:bound:Ki:final-contradiction:2} follows from the assumption that $\tilde{t} \ge t+1$, 
{\color{Plum} \Cref{pq:eq:bound:Ki:final-contradiction:2.5} follows from our parameter setting $\epsilon_\mathsf{wiaok}(\lambda)=\frac{t+1}{t^2+6t+3}\cdot \epsilon'(\lambda)$,}  
and \Cref{pq:eq:bound:Ki:final-contradiction:3} follows from the assumption that $p^{\mathsf{Sim}}_{\mathsf{pref}} \ge \epsilon(\lambda)$ and our parameter setting $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{10t^2}$.

Recall that $t$ is the tag taking values from $[n]$ with $n$ being a polynomial of $\lambda$. Also recall that $\epsilon(\lambda)$ is an inverse polynomial on $\lambda$. Therefore, \Cref{pq:eq:bound:Ki:final-contradiction:3} can be written as:
$$\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}}:\msf{Val} \gets \mathcal{K}''_1({\mathsf{pref}})] \ge p^{\mathsf{Sim}}_{\mathsf{pref}} + \frac{1}{\mathsf{poly}(\lambda)} - \mathsf{negl}(\lambda),$$
which contradicts \Cref{pq:claim:K'':non-abort}.

This eventually finishes the proof of \Cref{pq:lem:bound:Ki} (modulo the proof of \Cref{pq:claim:K'':non-abort}, which we show in \Cref{pq:sec:proof:claim:K'':non-abort}).



\subsection{Proof of \Cref{pq:claim:K'':non-abort}}
\label{pq:sec:proof:claim:K'':non-abort}
We first define two extra machines $\mathcal{K}^{**}_1$ and $\mathcal{K}^*_1$.

\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=11]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:K**i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=12]{figures/figures-PQ.pdf}
         }
         \caption{}
         \label{pq:figure:one-sided:K*i}
     \end{subfigure}
     \caption{Machines $\mathcal{K}^{**}_1$ and $\mathcal{K}^{*}_1$ {\scriptsize (Difference is highlighted in red color)}}
     \label{pq:figure:one-sided:K**i-K*i}
\end{figure}
\para{Machine $\mathcal{K}^{**}_1$:} (Illustrated in \Cref{pq:figure:one-sided:K**i}.) For a prefix $\mathsf{pref}$, $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ behaves identically as $\mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ except that $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ finishes the right {\bf WIAoK-2} using the honest receiver's algorithm, instead of using the witness-extended emulator. 

\subpara{$\mathcal{K}^{**}_1$'s Output.} We define the output of $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ to be the honest receiver's decision $b \in \Set{\top, \bot}$. This is in contrast to previous hybrids $\mathcal{K}'_i$, $\mathcal{K}''_i$, and $\mathcal{K}_i$, whose output is defined to be the value $\mathsf{Val}$ that depends on the value $w'$ extracted by the $\mathcal{SE}$ for the right {\bf WIAoK-2}.

 By the AoK property 

 of the right {\bf WIAoK-2}, it holds that
\begin{equation}\label[Inequality]{pq:eq:K''1-K**1}
\big|\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val}\gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[b = \top : b\gets \mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \big| \le {\color{Plum} \epsilon_\mathsf{wiaok}(\lambda)}+\mathsf{negl}(\lambda).
\end{equation}

\para{Machine $\mathcal{K}^{*}_1$:} (Illustrated in \Cref{pq:figure:one-sided:K*i}.) For a prefix $\mathsf{pref}$, $\mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ behaves identically as $\mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ except the following difference: $\mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})$ uses the witness-extended emulator {\color{Plum} with the error parameter $\epsilon_\mathsf{wiaok}(\lambda)$} to extract a witness $(j,x_j)$ from the left {\bf WIAoK-1}, and if $x_j$ is not a valid preimage for $y_j$,  $\mathcal{K}^{*}_1$ aborts.

 By the AoK property 

 of the left {\bf WIAoK-1}, it holds that
\begin{equation}\label[Inequality]{pq:eq:K**1-K*1}
\big|\Pr[b = \top : b \gets \mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[b = \top : b\gets \mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \big| \le {\color{Plum} \epsilon_\mathsf{wiaok}(\lambda)}+\mathsf{negl}(\lambda).
\end{equation}

\para{Compare $\mathcal{K}^{*}_1$ with $\mathcal{G}_1$.} Now, let us compare $\mathcal{K}^{*}_1$ with the $\mathcal{G}_1$ depicted in \Cref{pq:figure:one-sided:Gi}. They only differ in the witness used in the left {\bf WIAoK-2} (and that $\mathcal{G}_1$ does not need to perform brute-forcing for $Y$, as it does not use those preimages). Therefore, by the (non-uniform) WI property of the left {\bf WIAoK-2}, it holds that
$$
\big|\Pr[b = \top : b \gets \mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - \Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] \big| \le \mathsf{negl}(\lambda).
$$
Also, recall (from \Cref{pq:def:p-sim-pref}) that $\Pr[b = \top : (\ensuremath{\mathsf{OUT}}\xspace, b) \gets \mathcal{G}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]$ is exactly the definition of $p^{\mathsf{Sim}}_{\mathsf{pref}}$. Thus, the above implies:
\begin{equation}\label[Inequality]{pq:eq:K*1-G1}
\big|\Pr[b = \top : b \gets \mathcal{K}^{*}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] - p^{\mathsf{Sim}}_{\mathsf{pref}} \big| \le \mathsf{negl}(\lambda).
\end{equation}

Therefore, the following holds:
\begin{align}
\Pr[\msf{Val} \ne \bot_{\mathsf{invalid}} :\msf{Val}\gets \mathcal{K}''_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})] & \le \Pr[b = \top : b\gets \mathcal{K}^{**}_1(\mathsf{st}_{\mathcal{M}}, \mathsf{st}_R, \tau, \tilde{\tau})]{\color{Plum} +\epsilon_\mathsf{wiaok}(\lambda)} +  \mathsf{negl}(\lambda) \label[Inequality]{pq:eq:K'':non-abort:final:1} \\
& \le \Pr[b = \top : b \gets \mathcal{K}^{*}_1({\mathsf{pref}})]{\color{Plum} +2\epsilon_\mathsf{wiaok}(\lambda)} + \mathsf{negl}(\lambda) \label[Inequality]{pq:eq:K'':non-abort:final:2} \\
& \le p^{\mathsf{Sim}}_{\mathsf{pref}} {\color{Plum} +2\epsilon_\mathsf{wiaok}(\lambda)} +\mathsf{negl}(\lambda), \label[Inequality]{pq:eq:K'':non-abort:final:3}
\end{align}
where \Cref{pq:eq:K'':non-abort:final:1} follows from \Cref{pq:eq:K''1-K**1}, \Cref{pq:eq:K'':non-abort:final:2} follows from \Cref{pq:eq:K**1-K*1}, and \Cref{pq:eq:K'':non-abort:final:3} follows from \Cref{pq:eq:K*1-G1}. 

This finishes the proof of \Cref{pq:claim:K'':non-abort}.
\section{Small-Tag, Synchronous, Classical Setting}
\label{sec:small-tag:classical:sync}
In this section, we show how to make $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ (i.e., \Cref{prot:one-sided:classical}) secure without the ``one-sided'' restriction. We emphasize that this section still focuses on the small-tag, synchronous setting against classical (i.e., non-uniform PPT) adversaries. 

\subsection{High-Level Idea} 
\label{sec:small-tag:classical:sync:high-level}
Our proof for the non-malleability of $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ (shown in \Cref{prot:one-sided:classical}) works only if $t<\tilde{t}$. However, this is not guaranteed in the real main-in-the-middle attack---the adversary can of course use a smaller tag in the right session. Fortunately, this problem can be addressed by the so-called ``two-slot'' technique proposed by Pass and Rosen \cite{STOC:PasRos05}. The idea is to create a situation where no matter how the man-in-the-middle $\mathcal{M}$ schedules the messages, there is always a ``slot'' for which the ``$t<\tilde{t}$'' condition holds; As long as this is true,  non-malleability can be proven using the same technique as in \Cref{sec:small-tag-one-sided-sync-classical}.

To do that, first observe that the only place where \Cref{prot:one-sided:classical} makes use of the tag $t$ is \Cref{item:one-sided:step:OWFs,item:one-sided:step:WIPoK:1}. Let us call these two messages a ``{\bf Slot}''. Our modification is to execute this {\bf Slot} twice sequentially, where
\begin{itemize}
\item
for the first execution (referred to as {\bf Slot-A}), we ask $R$ to use tag $t$ as in the original construction;
\item
for the second execution (referred to as {\bf Slot-B}), we ask $R$ to use $n-t$ as the tag.
\end{itemize}
We also modify the language instance proven by {\bf WIPoK-2} in the expected way---Now $C$ needs to prove that it ``knows'' the $(m,r)$ tuple, or the preimage of one of the $y_i$'s sent in {\bf Slot-A}, {\em or the preimage of one of the $y_i$'s sent in {\bf Slot-B}}.

By the above design, it is easy to see that one of the following case must happen for any man-in-the-middle execution (note that we are still in the synchronous setting):
\begin{enumerate}
\item
{$t = \tilde{t}$:} This is the trivial case that is already ruled out by the definition of non-malleability.
\item
{$t < \tilde{t}$:} In this case, non-malleability follows by applying the argument in \Cref{sec:small-tag-one-sided-sync-classical} to {\bf Slot-A}. We sometimes refer to this case by saying that {\em {\bf Slot-A} is the good slot}.
\item
{$t > \tilde{t}$:} In this case, it holds that $(n-t) < (n-\tilde{t})$. In other words, the tag for the left {\bf Slot-B} is smaller than the tag for the right {\bf Slot-B}. Therefore,  non-malleability follows by applying the argument in \Cref{sec:small-tag-one-sided-sync-classical} to {\bf Slot-B}. We sometimes refer to this case by saying that {\em {\bf Slot-B} is the good slot}.
\end{enumerate}
Therefore, the modified protocol is non-malleable without the ``one-sided'' restriction.

\if0
\para{On Adaptive Schedule.} \takashi{I don't see why we need to consider adaptive scheduling here. In this section, we are still considering synchronous adversaries, so can't we just assume that tags are declared at the beginning? (Otherwise, I don't see even how to define non-malleability against synchronous adversaries.)} \xiao{You are right! We can move this text (with necessary modifications) to the non-sync section, to allow us to prove NM case-by-case.} As a vigilant reader may have already realized, the above ``case-by-case'' analysis relies on an implicit assumption: we know in advance which one out of the three cases $\Set{t = \tilde{t}, t< \tilde{t}, t < \tilde{t}}$ will happen. This is because different cases require different proof strategies. If we do not know which schedule the man-in-the-middle adversary $\mathcal{M}$ will pick, the security reduction will not know which proof strategy to use. Moreover, $\mathcal{M}$ can determine the schedule {\em adaptively}---even flipping one single bit in the very first message could cause $\mathcal{M}$ to change the schedule for later messages completely (e.g., changing from ``{\bf Slot-A} is good'' to ``{\bf Slot-B} is good''). This is particularly problematic when the security proof needs to rewind $\mathcal{M}$ several times (like our proof in \Cref{sec:small-tag-one-sided-sync-classical}).

The above problem is not specific to our construction. It was there and has been addressed in several previous works (e.g., \cite{STOC:PasRos05,FOCS:PasRos05,STOC:Goyal11,FOCS:GLOV12,BLS21}). So we will address this issue by adapting known techniques. In particular, we will make use of the strategy from \cite{BLS21} because it is a general approach that works for both quantum and classical settings. We provide a formal treatment of this issue in \Cref{sec:adaptive-predetermined:two-slot}.
\fi

\subsection{Construction of $\langle C, R\rangle^{\mathsf{sync}}_{\mathsf{tg}}$}
 We refer to the construction described in \Cref{sec:small-tag:classical:sync:high-level} as $\langle C, R \rangle^{\mathsf{sync}}_{\mathsf{tg}}$, and formally present it in \Cref{prot:small-tag:sync:classical}. This protocol makes use of the same building blocks as for \Cref{prot:one-sided:classical}, namely:
 \begin{itemize}
 \item
An OWF $f$, (Note that we do not require injectivity any more, because \Cref{prot:small-tag:sync:classical} makes use of the technique discussed in \Cref{sec:removing-injectivity}.)
\item
Naor's commitment $\mathsf{Com}$;
\item
A witness-indistinguishable proof of knowledge $\ensuremath{\mathsf{WIPoK}}\xspace$
(as per \Cref{def:WIPoK}). 
 \end{itemize} 
We remark that we further optimize the ``two-slot'' approach from \Cref{sec:small-tag:classical:sync:high-level} by sending the first message of {\bf Slot-A} and the first message of {\bf Slot-B} together. 
\begin{ProtocolBox}[label={prot:small-tag:sync:classical}]{Small-Tag Synchronous NMCom \textnormal{$\langle C, R\rangle^{\mathsf{sync}}_{\mathsf{tg}}$}}
The tag space is defined to be $[n]$ where $n$ is a polynomial on $\lambda$. Let $t \in [n]$ be the tag for the following interaction. Let $m$ be the message to be committed to. 

\para{Commit Stage:}
\begin{enumerate}
\item\label[Step]{item:small-tag:sync:step:Naor-rho}
Receiver $R$ samples and sends the first message $\beta$ for Naor's commitment.
\item\label[Step]{item:small-tag:sync:step:committing}
Committer $C$ commits to $m$ using the second message of Naor's commitment. $C$ also sends a $\beta'$ that will be used as the first Naor's message for $R$ to generate a commitment in next step. Formally, $C$ samples $r$ and $\beta'$ and sends the tuple $\big(\mathsf{com} = \mathsf{Com}_\beta(m;r),~\beta'\big)$. 

\subpara{Comment:} The $\beta'$ is to address the injectivity issue as discussed in \Cref{sec:removing-injectivity}.
\item\label[Step]{item:small-tag:sync:step:OWFs}
$R$ performs the following computation:
\begin{enumerate}
\item \label[Step]{item:small-tag:sync:step:OWFs:A}
$R$ computes $\Set{y^A_i = f(x^A_i)}_{i \in [t]}$ with $x^A_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [t]$, and sets $Y^A \coloneqq (y^A_1, \ldots, y^A_t)$. $R$ also computes $\Set{\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i;r^A_i)}_{i\in [t]}$, where $r^A_i$ is a random string for each $i\in [t]$.  
\item \label[Step]{item:small-tag:sync:step:OWFs:B}
$R$ computes $\Set{y^B_i = f(x^B_i)}_{i \in [n-t]}$ with $x^B_i \ensuremath{\leftarrow}\xspace \ensuremath{\{0,1\}}\xspace^\lambda$ for each $i \in [n-t]$, and sets $Y^B \coloneqq (y^B_1, \ldots, y^B_{n-t})$. $R$ also computes $\Set{\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i;r^B_i)}_{i\in [n-t]}$, where $r^B_i$ is a random string for each $i\in [n-t]$.  
\end{enumerate}
$R$ sends the tuple $\big(Y^A,~\Set{\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i;r^A_i)}_{i\in [t]},~Y^B,~\Set{\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i;r^B_i)}_{i\in [n-t]}\big)$.

\subpara{Comment:} Compared with \Cref{item:one-sided:step:OWFs} of \Cref{prot:one-sided:classical}, the current \Cref{item:small-tag:sync:step:OWFs} has two differences: (1) $R$ additionally commits to the preimages of $y_i$'s. This is to address the injectivity issue as discussed in \Cref{sec:removing-injectivity}. (2) $R$ sends {\em two copies} of the $(Y, \Set{\mathsf{com}_i}_i)$ tuple, indexed by superscripts $A$ and $B$ respectively. This is corresponding to the ``two-slot'' approach discussed in \Cref{sec:small-tag:classical:sync:high-level} (with the first message of {\bf Slot-B} being sent in parallel with the first message of {\bf Slot-A}).


\item\label[Step]{item:small-tag:sync:step:WIPoK:1A}
{\bf (WIPoK-1-A.)} $R$ and $C$ execute an instance of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y^A_i$ contained in $Y^A$, and $y^A_i$ are consistent with $\mathsf{com}^A_i$ (as defined in \Cref{item:small-tag:sync:step:OWFs:A}). Formally, $R$ proves that $(Y^A, \Set{\mathsf{com}^A_i}_{i\in[t]}) \in \ensuremath{\mathcal{L}}\xspace^t_{f,\beta'}$, where
\begin{equation}\label[Language]{eq:small-tag:sync:Lang:OWF:A}
\ensuremath{\mathcal{L}}\xspace^t_{f,\beta'} \coloneqq \Bigg\{(y^A_1, \ldots, y^A_t), (\mathsf{com}^A_1, \ldots, \mathsf{com}^A_t)~\Bigg|~\exists (i, x^A_i, r^A_i) ~s.t.~~
\begin{array}{l}
i \in [t] ~\wedge \\
y^A_i = f(x^A_i) ~\wedge \\
\mathsf{com}^A_i = \mathsf{Com}_{\beta'}(x^A_i; r^A_i)
\end{array}\Bigg\}.
\end{equation}
Note that $R$ uses $(1, x^A_1, r^A_1)$ as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.

\item\label[Step]{item:small-tag:sync:step:WIPoK:1B}
{\bf (WIPoK-1-B.)} $R$ and $C$ execute an instance of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $R$ proves to $C$ that he ``knows'' a pre-image of some $y^B_i$ contained in $Y^B$, and $y^B_i$ are consistent with $\mathsf{com}^B_i$ (as defined in \Cref{item:small-tag:sync:step:OWFs:B}). Formally, $R$ proves that $(Y^B, \Set{\mathsf{com}^B_i}_{i\in[n-t]}) \in \ensuremath{\mathcal{L}}\xspace^{n-t}_{f,\beta'}$, where
\begin{equation}\label[Language]{eq:small-tag:sync:Lang:OWF:B}
\ensuremath{\mathcal{L}}\xspace^{n-t}_{f,\beta'} \coloneqq \Bigg\{(y^B_1, \ldots, y^B_{n-t}), (\mathsf{com}^B_1, \ldots, \mathsf{com}^B_{n-t})~\Bigg|~\exists (i, x^B_i, r^B_i) ~s.t.~~ 
\begin{array}{l}
i \in [n-t] ~\wedge \\
y^B_i = f(x^B_i) ~\wedge \\
\mathsf{com}^B_i = \mathsf{Com}_{\beta'}(x^B_i; r^B_i)
\end{array}\Bigg\}.
\end{equation}
Note that $R$ uses $(1, x^B_1, r^B_1)$ as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.

\item\label[Step]{item:small-tag:sync:step:WIPoK:2}
{\bf (WIPoK-2.)} $C$ and $R$ execute an instance of $\ensuremath{\mathsf{WIPoK}}\xspace$ where $C$ proves to $R$ that he ``knows'' the message committed in $\mathsf{com}$ (defined in \Cref{item:small-tag:sync:step:committing}), {\em or} a pre-image of some $y^A_i$ contained in $Y^A$ (defined in \Cref{item:small-tag:sync:step:OWFs:A}), {\em or} a pre-image of some $y^B_i$ contained in $Y^B$ (defined in \Cref{item:small-tag:sync:step:OWFs:B}). Formally, $C$ proves that $(\mathsf{com}, Y^A, Y^B) \in \ensuremath{\mathcal{L}}\xspace_\beta \vee \ensuremath{\mathcal{L}}\xspace^t_f \vee \ensuremath{\mathcal{L}}\xspace^{n-t}_f$, where 
\begin{align}
& \ensuremath{\mathcal{L}}\xspace_\beta \coloneqq \Set{\mathsf{com} ~|~ \exists (m, r)~s.t.~ \mathsf{com} = \mathsf{Com}_\beta(m;r)}, \label[Language]{eq:small-tag:sync:Lang:Com}\\
& \ensuremath{\mathcal{L}}\xspace^t_f \coloneqq \Set{(y^A_1, \ldots, y^A_t) ~|~ \exists (i, x^A_i)~s.t.~ i \in [t] \wedge y^A_i = f(x^A_i)}, \\
& \ensuremath{\mathcal{L}}\xspace^{n-t}_f \coloneqq \Set{(y^B_1, \ldots, y^B_{n-t}) ~|~ \exists (i, x^B_i)~s.t.~ i \in [n-t] \wedge y^B_i = f(x^B_i)}.
\end{align}
Note that $C$ uses the $(m, r)$ defined in \Cref{item:small-tag:sync:step:committing} as the witness when executing this $\ensuremath{\mathsf{WIPoK}}\xspace$.

\subpara{Comment:} Compared with \Cref{item:one-sided:step:WIPoK:2} of \Cref{prot:one-sided:classical}, we add $\ensuremath{\mathcal{L}}\xspace^{n-t}_f$ as an additional OR part to the language to be proven. This is corresponding to the new {\bf Slot-B} as discussed in \Cref{sec:small-tag:classical:sync:high-level}.
\end{enumerate}
\para{Decommit Stage:} 
$C$ sends $(m, r)$. $R$ accepts if $\mathsf{com} = \mathsf{Com}_\beta(m;r)$, and rejects otherwise.
\end{ProtocolBox}

\para{Security.} Completeness is straightforward from the description of \Cref{prot:small-tag:sync:classical}. 
The statistical binding property follows from that of Naor's commitment. Computational hiding of any commitment scheme follows directly from non-malleability. So it remains for us to show that our commitment protocol is non-malleable, which we establish by the following theorem.

\begin{theorem}\label{thm:nm:small-tag:sync:classical}
The commitment scheme $\langle C, R\rangle^{\mathsf{sync}}_{\mathsf{tg}}$ in \Cref{prot:small-tag:sync:classical} is non-malleable against synchronous PPT adversaries with tag space $[n]$, with $n$ being any polynomial on $\lambda$.
\end{theorem}

\if0
To prove \Cref{thm:nm:small-tag:sync:classical}, we first show a lemma in \Cref{sec:adaptive-predetermined:two-slot}. This lemma will allow us to only focus on man-in-the-middle adversaries that use {\em some predetermined type of} schedules (i.e., we address the issue discussed toward the end of \Cref{sec:small-tag:classical:sync:high-level}). With this lemma, we will then show the proof of \Cref{thm:nm:small-tag:sync:classical} in \Cref{sec:proof:nm:small-tag:sync:classical}.



\subsection{Adaptive Schedule vs.\ Predetermined Schedule}
\label{sec:adaptive-predetermined:two-slot}

In this subsection, we show that we can assume w.t.o.g.\ that man-in-the-middle adversaries always use a predetermined type of schedules in maul attacks.

As discussed in \Cref{sec:small-tag:classical:sync:high-level}, we categorize all possible schedules of min-in-the-middle executions in to the following three types:
\begin{itemize}
\item 
{\bf Type $T_{=}$:} a schedule where $t = \tilde{t}$ is called a type-$T_{=}$ schedule.
\item 
{\bf Type $T_{<}$:} a schedule where $t < \tilde{t}$ is called a  type-$T_{<}$ schedule.
\item 
{\bf Type $T_{>}$:} all schedule where $t > \tilde{t}$ is called a type-$T_{=}$ schedule.
\end{itemize} 

\begin{definition}
For any $T\in \Set{T_{=}, T_{<}, T_{>}}$, a non-uniform PPT adversary $\mathcal{M}_\lambda$ is type-$T$ if any man-in-the-middle execution in which $\mathcal{M}_\lambda$ participates is a type-$T$ schedule.
\end{definition}

The following \Cref{lem:adaptive-predetermined} is due to \cite[Lemma 5.1]{BLS21}: although they only show this lemma for their specific construction, their proof technique is general enough. Our proof of \Cref{lem:adaptive-predetermined} is identical to theirs except for some notational changes customized to our application.
\begin{lemma}[{\cite[Lemma 5.1]{BLS21}}]\label{lem:adaptive-predetermined}
If \Cref{prot:small-tag:sync:classical} is non-malleable against type-$T$ MIM adversaries for every $T \in \Set{T_{=}, T_{<}, T_{>}}$, then it is also non-malleable against arbitrary non-uniform PPT MIM adversaries.
\end{lemma}
\begin{proof}
Given an arbitrary non-uniform PPT MIM $\mathcal{M}$ and non-uniform PPT distinguisher $\mathcal{D}$ that break non-malleability for some
values $m_0, m_1$ with advantage $\delta$, we construct a new non-uniform PPT adversary with a predetermined type, which
breaks the scheme with probability $\delta/3$.

Consider an adversary $\mathcal{M}'$ that first samples uniformly at random a $T\ensuremath{\leftarrow}\xspace \Set{T_{=}, T_{<}, T_{>}}$. $\mathcal{M}'$ then emulates $\mathcal{M}$ in the following way: If at any point the execution is about to become inconsistent with $T$, $\mathcal{M'}$ halts and outputs $\bot$; If the emulation of $\mathcal{M}$ is completed consistently with $T$, $\mathcal{M}'$ outputs whatever $\mathcal{M}$ outputs.

Then, since every execution must be of one of the three types $\Set{T_{=}, T_{<}, T_{>}}$, $\mathcal{M}'$ breaks non-malleability
with probability exactly $\delta/3$  (with respect to the same distinguisher $\mathcal{D}$ and $m_0, m_1$). Finally, by an
averaging argument, we fix the choice of $\mathcal{M}'$ for a schedule to be of some type $T'$ that maximizes
$\mathcal{D}$'s distinguishing advantage. We obtain a corresponding MIM with a predetermined type of schedule with
the same advantage $\delta/3$.
\end{proof}
\fi


\subsection{Proving Non-Malleability (Proof of \Cref{thm:nm:small-tag:sync:classical})}
\label{sec:proof:nm:small-tag:sync:classical}
Since we only consider synchronous adversaries in this section, we can assume that the adversary declares $t$ and $\tilde{t}$ at the beginning w.l.o.g. Thus, we can analyze the three cases of $t=\tilde{t}$, $t<\tilde{t}$, and $t>\tilde{t}$ {\em separately}.   
Since the case of $t=\tilde{t}$ is already ruled out by the definition of non-malleability, we prove non-malleability for the other two cases below. 
\if0
\begin{itemize}
\item {\bf Case 1: $t=\tilde{t}$.} This is the trivial case that is already ruled out by the definition of non-malleability.
\end{itemize}
We show the proof of \Cref{thm:nm:small-tag:sync:classical} for the other two cases in \Cref{sec:proof:nm:small-tag:sync:classical:case2,sec:proof:nm:small-tag:sync:classical:case3} respectively. 
\fi


\subsubsection{The Case of \textnormal{$t<\tilde{t}$}}
\label{sec:proof:nm:small-tag:sync:classical:case2}

The proof for this case is almost identical to the proof  of \Cref{prot:one-sided:classical} in \Cref{sec:small-tag-one-sided-sync-classical}. 
To avoid re-doing the same work, we only focus on the places where modifications are needed. In the following, we assume that the reader has already read and understood the proof in \Cref{sec:small-tag-one-sided-sync-classical}.

First, by repeating the similar arguments in \Cref{one-sided:non-malleability:proof:classical,sec:one-sided:core-lemma:proof,lem:small-tag:proof:se:proof},  we can see that it suffices to construct a machine $\mathcal{K}$ that satisfies  similar properties as required in \Cref{lem:small-tag:proof:se:proof:K}. 
Roughly speaking, $\mathcal{K}$ is required to extract the committed message $\tilde{m}$ in the right session with a noticeable probability if it is given a prefix that leads to acceptance with a noticeable probability.\footnote{Strictly speaking, the input of $\mathcal{K}$ is not a prefix, but a prefix \emph{without $C$'s state $\ensuremath{\mathsf{ST}}\xspace_C$}. We also remark that the assumption is not that the prefix leads to $R$'s acceptance with a noticeable probability in the real experiment, but in the \emph{simulated} experiment defined similarly to $\mathcal{G}_1$ in \Cref{lem:small-tag:proof:se:proof}.} 
The construction of $\mathcal{K}$ is identical to that in \Cref{sec:lem:small-tag:proof:se:proof:K:proof} except that it extracts a witness $(j,x_j^A,r_j^A)$ from {\bf WIPoK-1-A} and 
always uses the same witness $(1,\tilde{x}^B_1,\tilde{r}^B_1)$ for the right {\bf WIPoK-1-B}.
Specifically, $\mathcal{K}$ honestly runs the man-in-the-middle experiment starting from the given prefix except for the following modifications:
\begin{enumerate}
   
    \item \label{item:choose_i}
    Use the witness $(i,\tilde{x}^A_i,\tilde{r}^A_i)$ for the right {\bf WIPoK-1-A} for $i\ensuremath{\leftarrow}\xspace [\tilde{t}]$;
   
    \item Extract a witness $(j,x^A_j,r^A_j)$ from the left {\bf WIPoK-1-A};
    \item Use the witness $(j,x^A_j)$ in the left {\bf WIPoK-2};
    \item Extract a witness $\tilde{w}$ from the right {\bf WIPoK-2};
    \item If $\tilde{w}$ is a valid witness $(\tilde{m},\tilde{r})$ for $\tilde{\mathsf{com}}\in \ensuremath{\mathcal{L}}\xspace_{\tilde{\beta}}
    $, it outputs $\tilde{m}$. Otherwise, it outputs $\bot$. 
\end{enumerate}  
We stress again that $\mathcal{K}$ uses the same witness $(1,\tilde{x}^B_1,\tilde{r}^B_1)$ for the right {\bf WIPoK-1-B} regardless of the $i$ sampled in \Cref{item:choose_i}.\footnote{Changing the witness for {\bf Slot-B} to $(i,\tilde{x}^B_i,\tilde{r}^B_i)$ by using the WI property also works, but that is redundant.}
We also remark that $\mathcal{K}$ extracts a witness from the left {\bf WIPoK-1-A} but not from the left {\bf WIPoK-1-B}.

The proof that the above $\mathcal{K}$ satisfies similar properties as in \Cref{lem:small-tag:proof:se:proof:K} is almost identical to that in \Cref{sec:lem:small-tag:proof:se:proof:K:proof,sec:lem:bound:Ki:proof,sec:proof:claim:K'':non-abort} in the one-sided setting.
The only difference is the following.
We define $\mathcal{K}_i$ similarly to that in \Cref{sec:lem:small-tag:proof:se:proof:K:proof}, i.e., it works similarly to $\mathcal{K}$ with the random $i$ (in \Cref{item:choose_i}) being fixed. 
We need to ensure that the witness $\tilde{w}$ extracted from the right {\bf WIPoK-2} by $\mathcal{K}_i$ cannot be a witness for {\bf Slot-B}, i.e., a witness for $Y^B \in \ensuremath{\mathcal{L}}\xspace_f^{n-t}$ with a non-negligible probability. 
This is needed in the proof of a counterpart of \Cref{cliam:bound:Ki-xi} in \Cref{sec:lem:bound:Ki:proof}.
It can be shown as follows: 
\begin{itemize}
\item It is easy to see that $\tilde{w}=(j,\tilde{x}^B_j)$ for $j\neq 1$ with a negligible probability: Since $\mathcal{K}_i$ uses $(1,\tilde{x}^B_1,\tilde{r}^B_1)$ for the right {\bf WIPoK-1-B}, extracting  $(j,\tilde{x}^B_j,\tilde{r}^B_j)$ for $j\neq 1$ directly breaks the one-wayness of $f$ or the computational hiding of $\mathsf{Com}$. 
\item Suppose that $\tilde{w}=(1,\tilde{x}^B_1)$  with a non-negligible probability.
The probability remains non-negligible even if we replace the witness used in the right {\bf WIPoK-1-B} with  $(2,\tilde{x}^B_2,\tilde{r}^B_2)$ by the WI property of the right {\bf WIPoK-1-B}. Then, due to a similar reason to the above case, this also breaks the one-wayness of $f$ or the computational hiding of $\mathsf{Com}$.  
It is worth mentioning that this step relies on the fact that the left {\bf WIPoK-1-A} and the right {\bf WIPoK-1-B} do not interleave with each other by the synchronicity assumption. (Otherwise we have to rewind the right {\bf WIPoK-1-B} when rewinding the left {\bf WIPoK-1-A}, in which case we cannot rely on the WI property of the right {\bf WIPoK-1-B}.) This point will become relevant when dealing with asynchronous adversaries in \Cref{sec:small-tag:async:classical}.
\end{itemize}
Except for the above, the rest of the proof follows from a straightforward adaptation of that in \Cref{sec:small-tag-one-sided-sync-classical}. 

\subsubsection{The Case of \textnormal{$t > \tilde{t}$}}
\label{sec:proof:nm:small-tag:sync:classical:case3}
In this case, we have $n-t < n-\tilde{t}$. Thus, we can simply do the same analysis as the case of $t < \tilde{t}$ with the roles of {\bf Slot-A} and {\bf Slot-B} being swapped. 

By combining the analysis for the above cases, we obtain \Cref{thm:nm:small-tag:sync:classical}. 


\if 0
To avoid re-doing the same work, we only focus on the places where modifications are needed. In the sequel, we assume that the reader has already read and understood the proof in \Cref{sec:small-tag-one-sided-sync-classical}.

\subsubsection{High-Level Structure}\label{sec:test}
At a high level, the current proof for $T = T_{<}$ follows the same structure as that in \Cref{sec:small-tag-one-sided-sync-classical}. In the following, we review the proof structure in \Cref{sec:small-tag-one-sided-sync-classical} \xiao{(Maybe I should say we break the proof of \Cref{thm:one-sided:non-malleability} into XXX steps)}, and point out what need to change.

\para{Step 1: Proof by Contradiction.}
In the proof of \Cref{thm:one-sided:non-malleability}, we first denoted the MIM execution by $H^{\mathcal{M}}(\lambda, m, z)$ (on \Cpageref{gameH:description}). 
We then assumed for contradiction that a (potentially non-uniform) PPT adversary can distinguish the outputs of $H^{\mathcal{M}}(\lambda, m_0, z)$ and $H^{\mathcal{M}}(\lambda, m_1, z)$ with advantage $3 \cdot \delta(\lambda)$, with $\delta(\lambda)$ being some polynomial (i.e., \Cref{eq:one-sided:proof:contra-assump}). Next, we showed the existence of a machine $G^{\mathcal{M}}$ (in \Cref{lem:one-sided:proof:core}) such that 
\begin{enumerate}
\item
the outputs of $G^{\mathcal{M}}(\lambda, m_0, z)$ and $G^{\mathcal{M}}(\lambda, m_1, z)$ are computationally close, and 
\item
the statistical distance between the outputs of $G^{\mathcal{M}}(\lambda, m_b, z)$ and $H^{\mathcal{M}}(\lambda, m_b, z)$ is at most $\delta(\lambda)$ for any $b \in \ensuremath{\{0,1\}}\xspace$.
\end{enumerate}
The existence of such a $G^{\mathcal{M}}$ finished the proof of \Cref{thm:one-sided:non-malleability}, because it contradicts the assumption that there exists some PPT MIM that tells the difference between $H^{\mathcal{M}}(\lambda, m_0, z)$ and $H^{\mathcal{M}}(\lambda, m_1, z)$ with advantage $3 \cdot \delta(\lambda)$. The remaining parts of the proof for \Cref{thm:one-sided:non-malleability} were then devoted to constructing such a $G^{\mathcal{M}}$.

\subpara{The Current Proof.}

\red{\noindent\makebox[\linewidth]{\rule{\paperwidth-8em}{2pt}Update upto here}}{}
\fi



\section{Tag Amplification}

\takashi{I moved BLS theorem to the post-quantum section. I believe you will not use that in the classical case.}

\takashi{It may be fine to omit the details of the tag-amplification in the classical case given that the post-quantum case is the main result.}

\section{Technical Overview}
\label{sec:tech-overview}
We will first present a construction $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ that is non-malleable {\em in the classical setting} and with the following restrictions:
\begin{itemize}
\item
{\bf Small-Tag:} It only supports tags from the polynomial-size space $[n] \coloneqq \Set{1, \ldots, n(\lambda)}$, where $n(\lambda)$ is a polynomial on the security parameter $\lambda$;
\item
{\bf One-Sided:} Its non-malleability holds only if, in the MIM game, the left-session tag $t$ is smaller than the right-session tag $\tilde{t}$.
\item
{\bf Synchronous:} Its non-malleability holds only in the synchronous setting. This refers to the setting where upon receiving a message in the right (resp.\ left) session, the MIM adversary immediately responds with the corresponding message in the left (resp.\ right) session.
\end{itemize} 
It is a common approach in the literature to first obtain a construction under the above conditions, and then convert it to a full-fledged non-malleable commitment. While there exist standard techniques that take care of the latter step, the former step (i.e., constructing $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$) is typically where difficulty lies.

Once we obtain $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$, we can apply known techniques to remove the {\bf One-Sided} restriction, yielding a small-tag, synchronous protocol, which we denote as $\langle C, R\rangle^{\mathsf{sync}}_{\mathsf{tg}}$. Then, known compilers (e.g., \cite{FOCS:Wee10}) can be used to remove the {\bf Small-Tag} and {\bf Synchronous} restrictions {\em at one stroke}.  This gives a full-fledged non-malleable commitment $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{TG}}$. 

We emphasize that all these protocols are non-malleable {\em only in the classical setting}. However, they are designed deliberately using quantum-friendly techniques, which makes it possible to quantize their security proofs. We elaborate on that in the sequel.

\para{Post-Quantum Tag Amplification.} Recall that our eventual goal is to achieve {\em post-quantum} non-malleability. The use of quantum-friendly techniques will allow us to prove {\em post-quantum} non-malleability of $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$; Also, the aforementioned conversion from $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ to $\langle C, R\rangle^{\mathsf{sync}}_{\mathsf{tg}}$ works in the post-quantum setting as well. However, the classical compiler from $\langle C, R\rangle^{\mathsf{sync}}_{\mathsf{tg}}$ to $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{TG}}$ seems not to extend to the quantum setting. 

This has already been observed in \cite{BLS21}. The authors of \cite{BLS21} addressed this issue by constructing a new tag amplifier that converts a small-tag, asynchronous post-quantum non-malleable commitment to a large-tag (i.e, $t \in [2^\lambda]$), asynchronous post-quantum non-malleable commitment. But it is worth noting that this tag amplifier requires the small-tag protocol to be {\em asynchronously} secure;  This is in contrast to the aforementioned classical compiler, which handles asynchronicity and tag size at one stroke. 

To overcome this problem, we will first show that our post-quantum version of $\langle C, R\rangle^{\mathsf{sync}}_{\mathsf{tg}}$ can be made secure in the asynchronous setting, yielding a protocol $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$, which is exactly a small-tag, asynchronously-secure non-malleable commitment in the post-quantum setting. Now, the \cite{BLS21} tag amplifier can be applied to $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$, leading to the full-fledged post-quantum non-malleable commitment $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{TG,PQ}}$ we want.

\para{Organization of Technical Overview.} In \Cref{sec:tech-overview:small-tag:one-sided}, we overview the main idea behind $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ in the classical setting. This is the most technically-involved part and where the main difficulty lies. 

As mentioned earlier, protocol $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ is designed using only quantum-friendly techniques. Thus, the proof of its non-malleability can be extended to the post-quantum setting once we replace its building blocks by their post-quantum counterparts. We show how this can be done in \Cref{sec:tech-overview:small-tag:one-sided:sync:PQ}, where we obtain the one-sided, small-tag, synchronous, {\em post-quantum} non-malleable commitments $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$.

Finally, we will provide a brief overview on how to convert $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ to the full-fledged post-quantum non-malleable commitment  $\langle C, R\rangle^{\mathsf{async}}_{\mathsf{TG,PQ}}$ in \Cref{sec:tech-overview:full-fledged}.


 










\subsection{Small-Tag, One-Sided, Synchronous, Classical Setting}
\label{sec:tech-overview:small-tag:one-sided}



Our construction of $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ is easy to describe. It supports tags from the space $[n(\lambda)]$, where $n(\lambda)$ is any (fixed) polynomial on the security parameter $\lambda$. 

To proceed with a tag $t \in [n]$, we first ask the committer $C$ to commit to $m$ using a statistically-binding scheme $\mathsf{com}=\mathsf{Com}(m;r)$ (e.g., Naor's commitment). Then, the receiver $R$ sends a {\em non-interactive hard puzzle} that has $t$ distinct witnesses; $R$ also gives a witness-indistinguishable proof of knowledge (referred to as {\bf WIPoK-1}) to prove that he knows one of the $t$ witnesses.  Finally, $C$ is required to prove using another WIPoK (referred to as {\bf WIPoK-2}) that he knows either the value committed in $\mathsf{com}$ or one witness for $R$'s hard puzzle. 

We depict this construction (in the MIM setting) in \Cref{figure:one-sided:tech-overview:real}, where the ``hard puzzle'' is implemented with the problem of ``finding one of the preimages of the $t$ OWF images $\Set{y_i}_{i \in [t]}$''. Throughout this overview, we assume that the OWF $f$ is injective. But this is only to ease the presentation---There is a simple trick to remove this injectivity requirement, which we will describe in \Cref{sec:removing-injectivity}. 
\begin{figure}
 \centering
         \fbox{
         \includegraphics[width=0.95\textwidth,page=1]{figures/figures-new-tech-overview.pdf}
         }
         \caption{Man-in-the-Middle Execution of $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$}
         \label{figure:one-sided:tech-overview:real}
\end{figure}




\para{The First Attempt.}  In the MIM execution shown in \Cref{figure:one-sided:tech-overview:real}, imagine that we invoke the knowledge extractor\footnote{We remark that there exist different definitions for Proofs of Knowledge. Throughout this paper, we use Lindell's formalism called {\em Witness Extended Emulation} \cite{JC:Lindell03}. This definition ensures the existence of a knowledge extractor $\mathcal{WE}$ such that for any $P^*$ that convinces $V$ with probability $p$, $\mathcal{WE}^{P^*}$ will extract a valid witness with probability $\ge p - \mathsf{negl}(\lambda)$. See \Cref{sec:prelim:WIPoK} for more details.} for the right {\bf WIPoK-2} to extract a witness $w'$. It is easy to see that the only possible values for $w'$ is $(\tilde{m}, \tilde{r})$ or $(1, \tilde{x}_1)$, because they are the only information that $\mathcal{M}$ could potentially use assuming it cannot break the one-wayness of the OWF $\tilde{f}$ in the right {\bf Step-3}. Furthermore, we know for sure that $w'$ can only be $(\tilde{m}, \tilde{r})$ because of the WI property of the right {\bf WIPoK-1} and the following (standard) argument: Imagine that we switch to using $(2, \tilde{x}_2)$ as the witness to finish the right {\bf WIPoK-1}. By the WI property of the right {\bf WIPoK-1}, we know that the distribution of the extracted $w'$ cannot change (up to negligible probability). That is, {\em if $w'$ could take the value $(1, \tilde{x}_1)$ before we switch to $(2, \tilde{x}_2)$ in the right {\bf WIPoK-1}, it will keep taking the value $(1, \tilde{x}_1)$ when we are using $(2, \tilde{x}_2)$ in the right {\bf WIPoK-1}}. But this cannot happen as it breaks the one-wayness of $\tilde{f}$ on the image $\tilde{y}_1$ using a standard reduction---Consider an external challenger for the one-wayness of $\tilde{f}$; The challenger sends us a challenge $y^*$; We run the game shown in \Cref{figure:one-sided:tech-overview:real}, while using $y^*$ in place of $\tilde{y}_1$ and using $(2, \tilde{x}_2)$ as the witness to go through the right {\bf WIPoK-1}. If we finally extract $w' = (1, x_1)$, we find a preimage for $y^*$.

With the above observation, we {\em hope to} prove non-malleability in the following way: We switch the left committed value from $m_0$ to $m_1$, while extracting the right committed value $w' = (\tilde{m},\tilde{r})$ using the knowledge extractor for the right {\bf WIPoK-2}. If $\mathcal{M}$ really makes $\tilde{m}$ depend on the left committed value, then the reduction can detect this change by checking the extracted $w'$. This breaks the hiding property\footnote{It is easy to see that our construction, in the stand-alone setting, is a computationally-hiding commitment.} of the left execution when the left committed value changes from $m_0$ and $m_1$.  However, this naive idea will not work: When we invoke the knowledge extractor for the right {\bf WIPoK-2}, $\mathcal{M}$ also rewinds the left {\bf WIPoK-2}. So, the left interaction is not in straight-line anymore. Thus, we could not build the reduction to the hiding property of the left interaction.

\para{Reduction to Naor's Commitment.} Though the above attempt does not work, it inspires the following thoughts: What if we reduce the non-malleability to the hiding property of Naor's commitment in the left {\bf Step-1} and {\bf Step-2}? There is at least some hope as the left Naor's commitment is not interleaved with the right {\bf WIPoK-2} (recall that we are in the synchronous setting). That is, we generate the {\bf Step-1} and {\bf Step-2} messages in the left interaction by forwarding messages between $\mathcal{M}$ and the (external) challenger for the hiding property of Naor's commitment; Meanwhile, we extract $w' = (\tilde{m}, \tilde{r})$ from the right {\bf WIPoK-2} as before. Then, if $\mathcal{M}$ make the value $\tilde{m}$ depend on the value committed in the first two steps in the left, we win the hiding game by checking the extracted $w'$. 

To implement this idea, we first need to make the interaction happening after the left {\bf Step-2} {\em independent of $m$}; Otherwise, we cannot rely on the hiding of the left Naor's commitment. To do that, we consider an intermediate execution $\mathcal{G}_1$ shown in \Cref{figure:one-sided:tech-overview:Gi} (with $i = 1$)---The only difference (shown in red) between $\mathcal{G}_1$ and the real MIM game shown in \Cref{figure:one-sided:tech-overview:real} is that $\mathcal{G}_1$ uses the knowledge extractor $\mathcal{WE}$ in the left {\bf WIPoK-1}, and uses the extracted witness $(j, x_j)$ as the witness to go through the left {\bf WIPoK-2}. In this way, the interaction after the left {\bf Step-2} does not depend on $m$ anymore. However, this introduces new problems: We can no longer make use of the WI property of the right {\bf WIPoK-1} as before, because (the left) $\mathcal{WE}$ needs to rewind {\bf WIPoK-1}. Thus, we can no longer argue that the extracted $w'$ must be $(\tilde{m},\tilde{r})$ as in {\bf The First Attempt} part. Fortunately, we can still show that $w' = (\tilde{m},\tilde{r})$ with good-enough probability by an alternative argument that leverages the asymmetry of tags, i.e.\ $t <\tilde{t}$ (recall that this is exactly our {\bf One-Sided} condition). In the following, we elaborate on this argument.

\begin{figure}[!h]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=2]{figures/figures-new-tech-overview.pdf}
         }
         \caption{}
         \label{figure:one-sided:tech-overview:Gi}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth,page=3]{figures/figures-new-tech-overview.pdf}
         }
         \caption{}
         \label{figure:one-sided:tech-overview:Ki}
     \end{subfigure}
     \caption{Machines $\mathcal{G}_i$ and $\hat{\mathcal{K}}_i$ {\scriptsize (Difference is highlighted in red color)}}
\end{figure}

\para{Relying on Tag Asymmetry.} We define  machines $\mathcal{G}_i$ for each $i\in [\tilde{t}]$ (as shown in \Cref{figure:one-sided:tech-overview:Gi}). Machine $\mathcal{G}_i$ for $i \ne 1$ behaves identically to the $\mathcal{G}_1$  described earlier, except that  $\mathcal{G}_i$ uses $(i, \tilde{x}_i)$ as the witness when performing the right {\bf WIPoK-1}. Again, we define the {\em extracted witness} $w'$ to be the witness extracted by running the knowledge extractor for the right {\bf WIPoK-2} in $\mathcal{G}_i$.
Then, we show the main technical lemma, which we will use to establish non-malleability later.
\begin{lemma}[Informal Version of \Cref{lem:small-tag:proof:se:proof:K}]\label{lem:tech-overview:main}
Assume that, {\em in the real MIM execution}, $\mathcal{M}$ convinces the honest right receiver $R$ with some noticeable probability $p(\lambda)$. Then, there exists some $i \in [\tilde{t}]$ such that the extracted witness $w'$ in $\mathcal{G}_i$ must be a valid opening $(\tilde{m},\tilde{r})$ for $\tilde{\mathsf{com}}$ with another noticeable probability $p'(\lambda)$. 
\end{lemma}
\subpara{Proof of \Cref{lem:tech-overview:main}.} We prove \Cref{lem:tech-overview:main} by contradiction. In the following, we assume for contradiction that for all $ i \in [\tilde{t}]$, the extracted $w'$ contains a valid opening to $\tilde{\mathsf{com}}$ with at most {\em non-noticeable} probability. (For simplicity, we ignore the difference between ``non-noticeable" and ``negligible" and we treat $R$'s acceptance probability as if it is negligible in this proof.)

First, we claim that in the game $\mathcal{G}_i$ for any $i \in [\tilde{t}]$, $R$ must also be convinced with probability $p \pm \mathsf{negl}(\lambda)$. This claim follows from the PoK property of the left {\bf WIPoK-1} and the WI property of the right {\bf WIPoK-1} and the left {\bf WIPoK-2}. Since this proof is rather standard, we do not elaborate on it in this overview. More details can be found in \Cref{sec:lem:small-tag:proof:se:proof:K:proof}.


Next, we observe that in $\mathcal{G}_i$, the extracted witness $w'$ can only take the values $(\tilde{m},\tilde{r})$ or $(i, \tilde{x}_i)$; Otherwise, we break the one-wayness of the right OWF $\tilde{f}$ (this follows from the same argument we made earlier). However, our assumption (for contradiction) says that in each $\mathcal{G}_i$, $w' \ne (\tilde{m},\tilde{r})$ except for with negligible probability. Therefore, we obtain the following inequality:
\begin{equation}\label[Inequality]{eq:tech-overview:Gi}
\forall i \in [\tilde{t}],~ \big|\Pr[w' = (i, \tilde{x}_i) ~\text{in}~\mathcal{G}_i] - p\big| \le \mathsf{negl}(\lambda).
\end{equation}

Next, we define $\Set{\hat{\mathcal{K}}_i}_{i \in [\tilde{t}]}$ (shown in \Cref{figure:one-sided:tech-overview:Ki})\footnote{For readers trying to find a correspondence between this technical overview and the main-body counterpart (i.e., \Cref{sec:small-tag-one-sided-sync-classical}), we would like to point out that the $\hat{\mathcal{K}}_i$ defined here does not match any machine in \Cref{sec:small-tag-one-sided-sync-classical}. In the current overview, $\hat{\mathcal{K}}_i$ actually serves the functionality of several machines defined in \Cref{sec:lem:small-tag:proof:se:proof:K:proof,sec:lem:bound:Ki:proof,sec:proof:claim:K'':non-abort}. But $\hat{\mathcal{K}}_i$ is most similar to the $\mathcal{K}''_i$ on \Cpageref{pageref:one-sided:K''i} (and depicted in \Cref{figure:one-sided:K''i}), which is essentially $\hat{\mathcal{K}}_i$ but additionally runs a knowledge extractor for the right {\bf WIPoK-2}.}.  For each $i \in [\tilde{t}]$, $\hat{\mathcal{K}}_{i}$ behaves identically as $\mathcal{G}_i$ except that $\hat{\mathcal{K}}_{i}$ does not invoke the knowledge extractor for the left {\bf WIPoK-1}; Instead, it obtains all the preimages $\Set{x_i}_{i \in [t]}$ for $\Set{y_i}_{i \in [t]}$ in the left {\bf Step-3} by {\em brute force}; It then picks a random index $s \ensuremath{\leftarrow}\xspace [t]$ and uses preimage $(s, x_s)$ as the witness to conduct the left {\bf WIPoK-2}. First, observe that if the $(s, x_s)$ picked by $\hat{\mathcal{K}}_i$ hits the $(j, x_j)$ extracted from the left {\bf WIPoK-1} in $\mathcal{G}_i$ (see \Cref{figure:one-sided:tech-overview:Gi}), then the games $\hat{\mathcal{K}}_i$ and $\mathcal{G}_i$ are identical (modulo that $\hat{\mathcal{K}}_i$ is inefficient). Since $\hat{\mathcal{K}}_i$ picks $s$ uniformly at random from $[t]$, we know that $\hat{\mathcal{K}}_i$ will be identical to $\mathcal{G}_i$ with probability $\ge 1/t$. It then follows from \Cref{eq:tech-overview:Gi} that
\begin{equation}\label[Inequality]{eq:tech-overview:Ki}
\forall i \in [\tilde{t}],~ \Pr[w' = (i, \tilde{x}_i) ~\text{in}~\hat{\mathcal{K}}_i] \ge \frac{1}{t} \cdot p - \mathsf{negl}(\lambda).
\end{equation}

Next, observe that in $\hat{\mathcal{K}}_i$, {\bf WIPoK-1} is not rewound anymore. Therefore, by the (non-uniform, to compensate for the brute-forcing step) WI property of the right {\bf WIPoK-1}, it follows that 
\begin{equation}\label[Inequality]{eq:tech-overview:Ki-K1}
\forall i \in [\tilde{t}],~ {\bigg|}\Pr[w' = (i, \tilde{x}_i) ~\text{in}~\hat{\mathcal{K}}_i] - \Pr[w' = (i, \tilde{x}_i) ~\text{in}~\hat{\mathcal{K}}_1] \bigg|\le \mathsf{negl}(\lambda).
\end{equation}
Combining \Cref{eq:tech-overview:Ki,eq:tech-overview:Ki-K1}, we have
\begin{equation}\label[Inequality]{eq:tech-overview:K1}
\forall i \in [\tilde{t}],~ \Pr[w' = (i, \tilde{x}_i) ~\text{in}~\hat{\mathcal{K}}_1] \ge \frac{1}{t} \cdot p - \mathsf{negl}(\lambda).
\end{equation}
\Cref{eq:tech-overview:K1} implies the following
\begin{equation}\label[Inequality]{eq:tech-overview:K1:lower}
\Pr[\text{$w'$ is a valid witness in}~\hat{\mathcal{K}}_1] \ge \tilde{t}\cdot\frac{1}{t} \cdot p - \mathsf{negl}(\lambda) \ge p + \frac{p}{t} -\mathsf{negl}(\lambda),
\end{equation}
where ``$w'$ is a valid witness'' refers to the event that $w'=(\tilde{m},\tilde{r}) \vee w'=(1, \tilde{x}_1) \vee \ldots \vee w' = (\tilde{t}, \tilde{x}_{\tilde{t}})$, and the last ``$\ge$''  follows from the requirement that $t < \tilde{t}$ (i.e., we are in the {\bf One-Sided} setting).

On the other hand, we claim that 
\begin{equation}\label[Inequality]{eq:tech-overview:K1:upper}
\Pr[\text{$w'$ is a valid witness in}~\hat{\mathcal{K}}_1] \le  p + \mathsf{negl}(\lambda).
\end{equation}
This can be seen by comparing $\hat{\mathcal{K}}_1$ with the real MIM execution shown in \Cref{figure:one-sided:tech-overview:real}: Recall that $p$ is the probability of $R$ being convinced in the real MIM execution. The only difference between $\hat{\mathcal{K}}_1$ and the real MIM execution is the witness used in the left {\bf WIPoK-2}. By the (non-uniform) WI property of the left {\bf WIPoK-2}, we know that $R$ must be convinced in $\hat{\mathcal{K}}_1$ with probability $\le p +\mathsf{negl}(\lambda)$. Then, by the proof of knowledge property, we must extract a valid witness in the right {\bf WIPoK-2} in $\hat{\mathcal{K}}_1$ with probability upper-bounded by $p +\mathsf{negl}(\lambda)$ as well (this is exactly \Cref{eq:tech-overview:K1:upper}).

Observe that \Cref{eq:tech-overview:K1:upper} contradicts \Cref{eq:tech-overview:K1:lower} because ${p}/{t}$ is non-negligible. This gives us the desired contradiction, thus finishing the proof of \Cref{lem:tech-overview:main}.


\para{Completing the Proof of Non-Malleability.} With \Cref{lem:tech-overview:main}, non-malleability can be reduced to the computationally-hiding property of Naor's commitment as follows. Assuming that $\mathcal{M}$ breaks the non-malleability of our scheme w.r.t. a distinguisher $D$, we construct an adversary $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ against the computationally-hiding property of Naor's commitment as follows:

\begin{itemize}
\item {\bf Main-Thread Simulation:}
$\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ runs $\mathcal{G}_1$ where it embeds the instance of the hiding game of Naor's commitment in the left {\bf Step-1} and {\bf Step-2}, and finishes other steps just as $\mathcal{G}_1$.
If $R$ rejects, it sets $\tilde{m}:= \bot$. (Notice that at the end of this step, $\mathcal{M}$ will give an output that is  computationally-indistinguishable with the one from the real MIM execution. This is due to the similarity between $\mathcal{G}_1$ and the real MIM execution.) 
\item {\bf Rewinding:} 
Unless $R$ rejects in the main-thread, 
$\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ repeats the following $N$ (to be specified later) times to extract the message $\tilde{m}$ committed in the right session:
\begin{itemize}
    \item It rewinds $\mathcal{M}$ to the point just after completing {\bf Step-2}. 
    \item It picks a random index $i\ensuremath{\leftarrow}\xspace [\tilde{t}]$, and finishes the execution in the same manner as $\mathcal{G}_i$ (depicted in \Cref{figure:one-sided:tech-overview:Gi}). 
    \item Extract a witness $\tilde{w}$ from the right {\bf WIPoK-2} of the simulated execution. 
    \item If $\tilde{w}=(\tilde{m},\tilde{r})$ is a valid opening to $\tilde{\mathsf{com}}$, it breaks the loop. Otherwise, it continues.
\end{itemize}
If it fails to extract $\tilde{m}$ within $N$ trials, it aborts and outputs a random guess.
\item {\bf Decision:}
It runs the distinguisher $D$ on $\mathcal{M}$'s final output at the end of the {\bf Main-Thread Simulation} step and $\tilde{m}$, and outputs whatever $D$ outputs. 
\end{itemize} 
It is easy to see that the above reduction works unless it fails to extract $\tilde{m}$. We show that the failure probability can be made an arbitrarily small noticeable $\epsilon(\lambda)$ if we take sufficiently large $N=\mathsf{poly}(\lambda)$ depending on $\epsilon$.
We call the snapshot (including the transcript and $\mathcal{M}$'s internal state) at the end of {\bf Step-2} of the main thread a \emph{prefix}. 
For each prefix $\mathsf{pref}$, let $p_\mathsf{pref}$ be the probability that the right receiver accepts in $\mathcal{G}_1$ starting from $\mathsf{pref}$. 
Then, \Cref{lem:tech-overview:main} ensures that\footnote{Strictly speaking, there are two minor differences from \Cref{lem:tech-overview:main}. First, we are considering experiments for each fixed $\mathsf{pref}$ whereas \Cref{lem:tech-overview:main} considers the whole experiment. This is not an issue since the proof of \Cref{lem:tech-overview:main} does not touch messages before {\bf Step-3} and thus works for any fixed $\mathsf{pref}$. Another difference is that we define $p_\mathsf{pref}$ w.r.t. $\mathcal{G}_1$ whereas $p$ is defined w.r.t. the real MIM experiment in \Cref{lem:tech-overview:main}. This is not an issue since $\mathcal{G}_1$ is computationally indistinguishable from the real MIM experiment.} for any fixed prefix $\mathsf{pref}$ such that $p_{\mathsf{pref}}\geq \epsilon(\lambda)$, 
if we run $\mathcal{G}_i$ for random $i\ensuremath{\leftarrow}\xspace [\tilde{t}]$ and extract $\tilde{w}$ from the right {\bf {WIPoK-2}} (as is done in each repetition described in the above {\bf Rewinding} step), then we will extract $\tilde{w}=(\tilde{m},\tilde{r})$ with at least another noticeable probability $\epsilon'(\lambda)$ (More accurately, it should be the $\epsilon'(\lambda)$ guaranteed by \Cref{lem:tech-overview:main} {\em divided by $\tilde{t}$} as we pick an $i$ randomly from $[\tilde{t}]$. But this does not affect the argument here as $\tilde{t}$ is bounded by a polynomial on $\lambda$---recall that we are in the {\bf Small-Tag} setting.) Now, we consider the following two cases
\begin{itemize}
    \item \underline{The Case of $p_\mathsf{pref}\geq \epsilon(\lambda)$:} In this case, if we set $N=\Omega(\epsilon'(\lambda)^{-1} \cdot \lambda)$, the reduction algorithm fails with at most a negligible probability (i.e., $(1-\epsilon'(\lambda))^{\Omega(\epsilon'(\lambda)^{-1} \cdot \lambda}$)
    \item \underline{The Case of $p_\mathsf{pref}<\epsilon(\lambda)$:}
    In this case, the right $R$ rejects in the main-thread except for a probability upper-bounded by $\epsilon(\lambda)$. Thus, the reduction  fails with probability at most $\epsilon(\lambda)$. 
\end{itemize}
Overall, the reduction algorithm works with an additive loss of $\epsilon(\lambda)$.
Since we have the freedom to set $\epsilon(\lambda)$ to an arbitrarily small noticeable function, the reduction from non-malleability to the computational hiding of Naor's commitment can be done properly. We omit further details. 

\para{On the Necessity of $N$ Rewindings.} Given that \Cref{lem:tech-overview:main} already guarantees a noticeable probability $p'(\lambda)$ for successful extraction, one may wonder why we need to perform $N$ rewindings in the above reduction to the computational hiding of Naor's commitment. That is, machine $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ seems to work as desired even if we set $N = 1$---if it extracts $\tilde{m}$, then the reduction is done; otherwise, it guesses at random in the Naor's hiding game. At the first glance, this seems to give a $\frac{1}{2} + p'(\lambda)$ advantage, which is sufficient for the security reduction.

Though this strategy is appealing due to its simplicity, it does not work. To explain the reason, we need to refer to \Cref{lem:small-tag:proof:se:proof:K} on page \Cpageref{lem:small-tag:proof:se:proof:K} (i.e., the formal version of \Cref{lem:tech-overview:main}). The explanation (provided below) is rather technical and orthogonal to the current discussion. The reader may feel free to skip it.

Notice that \Cref{lem:small-tag:proof:se:proof:K} refers to the prefix $\mathsf{pref}$ of the MIM execution, which consists of the first two rounds of the protocol. In particular, $\mathsf{pref}$ includes the left Naor's commitment from the hiding challenger. \Cref{lem:small-tag:proof:se:proof:K} says that for any noticeable probability $\epsilon$, if a $\mathsf{pref}$ leads to an accepting MIM execution with probability greater than $\epsilon$, then the extraction succeeds with a probability {\em lower-bounded} by $\epsilon'/\tilde{t}$, a value polynomially related to (but smaller than) $\epsilon$.

At a high level, \Cref{lem:small-tag:proof:se:proof:K} is not directly applicable in our reduction because there may be a correlation between $\mathcal{M}$'s view and the success of extraction. That is, conditioned on the success of  extraction, the {\em joint distribution} of $\mathcal{M}$'s view and the extracted right value may be distinguishable from those in the real MIM experiment. Consider the following distinguishing example: there are two prefixes $\mathsf{pref}_1$ and $\mathsf{pref}_2$ that lead to an accepting execution with the same probability $\epsilon$, and they appear with the same probability in the real experiment. Suppose that the extraction success probability is $\epsilon'/\tilde{t}$ for $\mathsf{pref}_1$, but $\epsilon$ ($> \epsilon'/\tilde{t}$) for $\mathsf{pref}_2$. Then, if we run the reduction  with \Cref{lem:small-tag:proof:se:proof:K} directly, the distinguisher may get to see $\mathsf{pref}_2$ much more often than $\mathsf{pref}_1$ (conditioned on successful extraction). But they should happen with the same probability in the real experiment.

The $N$ rewindings in our construction essentially ``amplify'' \Cref{lem:small-tag:proof:se:proof:K} to the following stronger version: For any noticeable $\epsilon$, if $\mathcal{M}$ convinces $R$ with probability greater than $\epsilon$, then the extraction succeeds with overwhelming probability (i.e., $1-\mathsf{negl}(\lambda)$).  This effectively ensures the following: Conditioned on a prefix that leads to acceptance with probability greater than $\epsilon$ {\em and} that $R$ is indeed convinced, the joint distribution of $\mathcal{M}$'s view and the extracted $\tilde{m}$ are negligibly close to their distribution in the real MIM execution. (Other cases are easy to handle: if $R$ is not convinced, we simply use $\bot$ as the extracted value; and no more than $\epsilon$ fraction of prefixes can lead to acceptance with probability $< \epsilon$.) Thus, our strategy eventually makes the joint distribution from simulation to be $\epsilon$-close to the real one. Since we have the freedom to pick any noticeable $\epsilon$, our reduction can achieve a non-negligible advantage in Naor's hiding game. We refer the reader to \Cref{lem:small-tag:proof:se:proof} for a formal treatment of this issue. 


















\if0
Then, it follows from \Cref{lem:tech-overview:main} that if $\mathcal{M}$ break non-malleability with some non-malleable probability $p$, $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ will win the hiding game with probability at least $p/t$, which is also non-negligible (as the tag $t$ is a polynomial on the security parameter).

With \Cref{lem:tech-overview:main}, non-malleability can be reduced to the computationally-hiding property of Naor's commitment easily. We construct an adversary $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ that picks a random $i \in [\tilde{t}]$, and runs $\mathcal{G}_i$ with the MIM adversary $\mathcal{M}$ in the following way:
\begin{itemize}
\item
$\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ simply relays the left {\bf Step-1} and {\bf Step-2} messages between $\mathcal{M}$ and the challenger for the hiding game of Naor's commitment.
\item
Also,  $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ runs the knowledge extractor for the right {\bf WIPoK-1} to extract the $\tilde{m}$ committed by $\mathcal{M}$ 
\end{itemize} 
Then, it follows from \Cref{lem:tech-overview:main} that if $\mathcal{M}$ break non-malleability with some non-malleable probability $p$, $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ will win the hiding game with probability at least $p/t$, which is also non-negligible (as the tag $t$ is a polynomial on the security parameter).
\fi


\takashi{Commented out the paragraphs Removing Injectivity and Comparison with \cite{STOC:Goyal11}.}

\if0
\para{Removing Injectivity.}\xiao{to do...}
\takashi{This may not be needed in the overview if we refer to the appropriate section.}


\subsection{Comparison with \cite{STOC:Goyal11}}
\label{sec:tech-overview:compare:Goyal11}
\takashi{I think this subsection may be moved to other place to not interrupt the overview.}\xiao{Let's remove this subsection. It's not that relevant to our results, and it could raise debates from the reviewers.}
To a reader familiar with the literature of non-malleable commitments,
the idea described above may appear to be similar to \cite{STOC:Goyal11} at the first glance---Both works make use of the asymmetry of the tags to reduce non-malleability to $\mathcal{M}$'s inability of wining some carefully designed hard puzzle. But we would like to remark that there is crucial difference.

The hard puzzle in our protocol is {\em non-interactive}. That is, it only consists of a set of OWF images $\Set{y_i}_{i\in [t]}$ transmitted in {\bf Step-3}. Also, the receiver $R$ (or the MIM $\mathcal{M}$, in the left interaction) is the party who prepares this hard puzzle, and the committer $C$ (or the MIM $\mathcal{M}$, in the right interaction) is the party who may potentially try to break this hard puzzle. In contrast, in \cite{STOC:Goyal11} the committer (or the MIM $\mathcal{M}$, in the right interaction) is the party who prepares this hard puzzle. Also, this hard puzzle is a three-round protocol, which contains a slot where the receiver (or the MIM $\mathcal{M}$, in the left interaction) challenges and the puzzle generator responds.



The above difference makes the proof strategy very different. Roughly speaking, \cite{STOC:Goyal11} treats the hard puzzle as a computationally-hiding gadget, and reduces non-malleability to its hiding property. Special techniques are needed to handle the situation that the reduction may rewind the challenge-response slot of the hard puzzle, when trying to extract the left $\tilde{m}$. This could be done because Goyal designed the hard puzzle in a clever way such that the reduction can ``fake'' the response to $\mathcal{M}$'s challenge in rewinding threads, without being detected by $\mathcal{M}$. In summary, Goyal's reduction to the hiding of the hard puzzle have the following structure:
\begin{enumerate}
\item {\bf Main Thread:}
It first runs the MIM execution once {\em in straight-line}, where it relays the left hard puzzle messages between $\mathcal{M}$ and the challenger $\mathcal{C}_{\mathsf{puzzle}}$ for the hiding property of the hard puzzle;
\item {\bf Rewinding Threads:} Next, the extraction for $\tilde{m}$ happens. When the reduction rewinds $\mathcal{M}$, $\mathcal{M}$ may also sends new challenge to the left puzzle generator. Since the reduction cannot rewind the external $\mathcal{C}_{\mathsf{puzzle}}$, it will ``fake'' response to $\mathcal{M}$ as mentioned above.
\end{enumerate}
While this ``main-thread-then-rewinding'' structure is common in the classical literature, it is unclear if it can be migrated to the post-quantum setting. \takashi{In this level of abstraction, our classical proof also uses this template. What's the difference? I don't have a good answer. We may not need to try to explain why it's difficult to quantize Goyal11 if there's no obvious reason. I feel all we can say is that it's unclear.} As mentioned earlier, existing quantum rewinding techniques need to treat the adversary to be rewound as a quantum machine, and run it {\em coherently}. Here, the machine to rewind is {\em the combination of $\mathcal{M}$ and $\mathcal{C}_{\mathsf{puzzle}}$}. Thus, the messages exchanged between them must also be done coherently during quantum rewinding. However, the above approach requires us to run the main-thread once, which translates to measuring the main-thread messages exchange between $\mathcal{M}$ and $\mathcal{C}_{\mathsf{puzzle}}$. This measurement may irreversibly destroys the quantum state of the adversary (i.e., the combination of $\mathcal{M}$ and $\mathcal{C}_{\mathsf{puzzle}}$) such that the rewinding threads may not give us the desired effects (in Goyal's setting, this refers to the guarantee that $\mathcal{M}$ cannot tell if the reduction is faking responses).

In contrast, the hard-puzzle stage in our construction will be incorporated totally inside the $\tilde{m}$-extractor (i.e., $\mathcal{G}_i$). Our hard puzzle (plus the asymmetry of tags) is only used to argue that if we extract from the left session, we will get $\tilde{m}$ with good probability; In particular, we do not need to consider an external hard-puzzle challenger that cannot be rewound as in \cite{STOC:Goyal11}---Indeed, in our construction, it is $\mathcal{M}$ who plays the role of puzzle generator.
Therefore, our classical proof of non-malleability can be easily quantized by replacing the building blocks with their post-quantum counterparts and 
executing (the parts after {\bf Stage-2} of) $\mathcal{G}_i$ coherently
(as we are about to show in \Cref{sec:tech-overview:small-tag:one-sided:sync:PQ}).
\fi

\subsection{Small-Tag, One-Sided, Synchronous, Post-Quantum Setting}
\label{sec:tech-overview:small-tag:one-sided:sync:PQ}
Next, we explain how to make the $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ described in \Cref{sec:tech-overview:small-tag:one-sided} post-quantumly secure. 
For that, we simply instantiate $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ with post-quantum building blocks. (We denote this post-quantum version by $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$.)
Here, we have to be careful about what security notion we should require for WIPoK. In the security proof in the classical setting, we often extract a witness from WIPoK while continuing the rest of the experiment.
For this to work, we implicitly require the knowledge extractor to have a \emph{simulation} property \cite{C:HalSmiSon11,AFRICACRYPT:LunNie11}, i.e., it can simulate the prover's internal state as in a real execution, while performing the extraction task. While this is almost trivial in the classical setting, it becomes hard in the post-quantum setting due to the no-cloning theorem. In particular, constant-round constructions for such ``simulatable'' post-quantum WIPoKs are not known from (polynomially-hard) post-quantum OWFs.\footnote{A recent work by Lombardi, Ma, and Spooner~\cite{cryptoeprint:2021:1543} gave such WIPoKs from super-polynomial hardness of post-quantum OWFs.} 

Fortunately, a recent work~\cite{cryptoeprint:2021:1516} shows that a constant-round construction from post-quantum OWFs is possible if we (i) relax the PoK to \emph{argument} of knowledge (AoK), which only requires extractability against (quantum) polynomial-time adversaries,  and (ii) relax the simulation requirement to the \emph{$\epsilon$-close} simulation property, where an (arbitrarily small) noticeable simulation error is allowed. Next, we show that such a $\epsilon$-simulatable WIAoK suffices for our purpose.
First, the relaxation from PoK to AoK is totally fine since we only apply the knowledge extractors for polynomial-time adversaries (possibly with non-uniform advice). 
Second, a noticeable error coming from extraction does not affect the proof of non-malleability if we take the noticeable error to be much smaller than the assumed MIM adversary's advantage. Thus, we ignore the noticeable errors, and assume that the error is negligible in the rest of this overview. 
 
By using such a post-quantum WIAoK  (as well as the post-quantum version of Naor's commitment $\mathsf{Com}$ and a post-quantum injective OWF $f$), we can see that the main technical part of the security proof in the classical setting (the proof of \Cref{lem:tech-overview:main}) can be migrated to the post-quantum setting almost immediately.   
The only non-trivial issue is how to complete the reduction to the computational hiding of Naor's commitment, assuming (a post-quantum analog of) \Cref{lem:tech-overview:main}. In the classical setting, we rely on a rewinding argument that is not applicable anymore when $\mathcal{M}$ is a quantum machine (again, due to the no-cloning theorem). Thus, we use a different argument here---We observe that the following lemma, which is a generalization of \cite[Lemma 4]{cryptoeprint:2021:1516}, suffices for this step.
\begin{lemma}[Extract-and-Simulate Lemma (Informal)]
\label{lem:tech:extract_and_simulate}
Let $\mathcal{G}$ and $\mathcal{K}$ be QPT algorithms that satisfy the following:\footnote{In the formal version of this lemma~(\Cref{lem:extract_and_simulate}), $\mathcal{G}$ and $\mathcal{K}$ additionally take $1^{\gamma^{-1}}$ as input so that they can run extractors with simulation errors  depending on $\gamma$. We ignore this in this overview since we assume negligibly-close simulation for simplicity.} 
\begin{enumerate}
 \item  \label[Property]{item:tech:s_star_or_bot}
    $\mathcal{K}$ takes $1^\lambda$ and a quantum state $\rho$ as input and outputs some unique $s^*$ or otherwise $\bot$. 
    \item \label[Property]{item:tech:gamma_delta}
 For any noticeable function $\gamma(\lambda)$, there exists a noticeable function $\delta(\lambda)$ such that for any polynomial-size quantum state $\rho$,
 if 
$$
\Pr[b=\top : (b,\rho_\mathsf{out}) \leftarrow \mathcal{G}(1^\lambda,\rho)]\geq  \gamma(\lambda),
$$  
then 
$$
\Pr[\mathcal{K}(1^\lambda,\rho)=s^*]\geq   \delta(\lambda).
$$
\end{enumerate}
Then, there exists a QPT algorithm $\ensuremath{\mathcal{SE}}\xspace$ such that for any polynomial-size quantum state $\rho$ and 
noticeable function $\epsilon=\epsilon(\lambda)$, 
\begin{align}\label{eq:tech:ind}
\{\ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\rho)\}_{\lambda}
\sind_{\epsilon} 
\{(\rho_\mathsf{out},\Gamma_b(s^*)):(b,\rho_\mathsf{out})\leftarrow \mathcal{G}(1^\lambda,\rho)\}_{\lambda}
\end{align}
where 
$$
\Gamma_b(s^*):= 
\begin{cases}
s^* & \text{if}~ b=\top \\
\bot & \text{otherwise}
\end{cases}.
$$
\end{lemma}
The above lemma is a generalization of \cite[Lemma 4]{cryptoeprint:2021:1516} and can be proven in a similar manner.\footnote{Indeed, such a generalized version was mentioned in the technical overview of \cite{cryptoeprint:2021:1516}.} We will explain the main intuition for this proof at the end of this subsection.

Assuming a post-quantum analog of \Cref{lem:tech-overview:main}, we can complete the reduction to the computational hiding of Naor's commitment by using \Cref{lem:tech:extract_and_simulate} as follows:
We let $\rho$ be the state of the experiment $\mathcal{G}_1$ (as defined in \Cref{figure:one-sided:tech-overview:Gi}, \Cref{sec:tech-overview:small-tag:one-sided}) right after finishing {\bf Step-2}; Let 
$\mathcal{G}$ be the experiment that runs the rest of  $\mathcal{G}_1$  starting from the state $\rho$;\footnote{Similar to the classical setting in \Cref{sec:tech-overview:small-tag:one-sided}, we stipulate that $\rho$ does {\em not} include the left committer $C$'s internal state $\mathsf{ST}_C$ at the end of {\bf Step-2} (otherwise, we cannot reduce non-malleability to the hiding of the left commitment). This requirement is valid as the remaining steps of $\mathcal{G}_1$, which will be executed by $\mathcal{G}$, do not depend on $\mathsf{ST}_C$.}  At the end, $\mathcal{G}$ outputs the final state of $\mathcal{M}$ as $\rho_\mathsf{out}$, and outputs the final decision of the right receiver $R$ as $b$. We define $\mathcal{K}$ as follows:
\begin{itemize}
    \item Upon receiving a state $\rho$, simulate $\mathcal{G}_i$  for $i\ensuremath{\leftarrow}\xspace [\tilde{t}]$. 
    \item Extract a witness $\tilde{w}$ from the right {\bf WIPoK-2} of the simulated execution. 
    \item If $\tilde{w}=(\tilde{m},\tilde{r})$ is a valid opening to $\tilde{\mathsf{com}}$, output $\tilde{m}$. Otherwise, output $\bot$.
\end{itemize}
It is worth noting that $\mathcal{K}$ corresponds to the repeated steps in the rewinding argument in \Cref{sec:tech-overview:small-tag:one-sided}. 
By construction, it is clear that $\mathcal{K}$ outputs $\tilde{m}$ whenever it does not output $\bot$ (for an overwhelming fraction of $\tilde{\beta}$ by the statistical binding property of Naor's commitment). Therefore, it satisfies \Cref{item:tech:s_star_or_bot} in \Cref{lem:tech:extract_and_simulate} with $s^*:= \tilde{m}$ (for each fixed prefix). (We stress that we set $s^*=\tilde{m}$ instead of $s^*=(\tilde{m},\tilde{r})$ for ensuring the uniqueness of $s^*$ by the statistical binding property of Naor's commitment.) 
Moreover, noting that $\mathcal{G}_1$ is computationally-indistinguishable from the real MIM experiment, \Cref{lem:tech-overview:main} implies that $\mathcal{K}$ also satisfies \Cref{item:tech:gamma_delta} in \Cref{lem:tech:extract_and_simulate}. 
Thus, there exists a machine $\mathcal{SE}$ that satisfies 
\Cref{eq:tech:ind} for $s^*=\tilde{m}$. Using this $\mathcal{SE}$, we can construct an adversary $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ against the computationally-hiding property of Naor's commitment as follows.

Assuming that $\mathcal{M}$ breaks the non-malleability of our scheme w.r.t. a distinguisher $D$, we construct an adversary $\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ against the computationally-hiding property of Naor's commitment as follows. 
\begin{itemize}
\item {\bf Prefix Generation:}
$\ensuremath{\mathcal{A}}\xspace_{\mathsf{hiding}}$ runs the real MIM experiment\footnote{Remark that the real MIM experiment and $\mathcal{G}_1$ are identical until {\bf Step-2}.} for an adversary $\mathcal{M}$ until {\bf Step-2} finishes, where it embeds the instance of the hiding game of Naor's commitment in the left {\bf Step-2} while simulating other steps of the left $C$ and the right $R$ honestly. 
Let $\rho$ be the state of the experiment at this point. 
\item {\bf Extract-and-Simulate:} It runs $\ensuremath{\mathcal{SE}}\xspace(1^\lambda,1^{\epsilon^{-1}},\rho)$ to extract $\tilde{m}^*$ while simulating the output $\rho_\mathsf{out}$ of the experiment $\mathcal{G}_1$. We remark that it succeeds in extracting $\tilde{m}^*$ whenever $R$ accepts in the simulated experiment except for probability $\epsilon$. 
\item {\bf Decision:}
It runs the distinguisher $D$ on $\rho_\mathsf{out}$ and $\tilde{m}$, and outputs whatever $D$ outputs. 
\end{itemize} 


By \Cref{lem:tech:extract_and_simulate}, the $(\rho_\mathsf{out},\tilde{m})$ given to $D$ is indistinguishable from that in $\mathcal{G}_1$ (up to an error $\epsilon$), which in turn is indistinguishable from that of the real MIM experiment. Since we have the freedom to set $\epsilon$ to any arbitrarily small noticeable function, this completes the reduction. 



\para{Proof Idea of \Cref{lem:tech:extract_and_simulate}.} 
We assume that $\rho$ is a pure state w.l.o.g., and denote it by $\ket{\psi}$. By a similar usage of Jordan's lemma as in \cite{C:ChiChuYam21,cryptoeprint:2021:1516}, for any noticeable function $\delta(\lambda)$, we can decompose $\ket{\psi}$ as $\ket{\psi}=\ket{\psi_{< \delta}}+\ket{\psi_{\geq \delta}}$ such that 
\begin{align}\label{eq:small_part}
\Pr[\mathcal{K}(1^\lambda,\ket{\psi_{< \delta}})=s^*]<  \delta(\lambda)    
\end{align}
and 
\begin{align}\label{eq:large_part}
\Pr[\mathcal{K}(1^\lambda,\ket{\psi_{\geq \delta}})=s^*]\geq   \delta(\lambda).
\end{align}




By the contraposition of \Cref{item:tech:gamma_delta} of \Cref{lem:tech:extract_and_simulate} and \Cref{eq:small_part}, it holds that
$$
\Pr[b=\top : (b,\rho_\mathsf{out}) \leftarrow \mathcal{G}(1^\lambda,\ket{\psi_{< \delta}})]<  \gamma(\lambda),
$$  
where $\gamma(\lambda)$ is a noticeable function that can be made arbitrarily small by taking sufficiently small $\delta(\lambda)$.  That is, $\mathcal{G}$ simply ``rejects" (i.e., outputs $b=\bot$) except for a small  probability $\gamma(\lambda)$, in which case $\Gamma_b(s^*)=\bot$. The simulation of this case is easy because we do not need to extract $s^*$ except for probability $\gamma(\lambda)$, which can be made arbitrarily small. 
This shows \Cref{lem:tech:extract_and_simulate} for the case where $\ket{\psi}$ only has $\ket{\psi_{< \delta}}$ component. 

On the other hand, by \Cref{eq:large_part}, we can extract $s^*$ from $\ket{\psi_{\geq \delta}}$ with an overwhelming probability if we can repeat $\mathcal{K}(1^\lambda,\ket{\psi_{\geq \delta}})$ for $\Theta(\delta(\lambda)^{-1}\lambda)$ times. Though such a repetition is not possible in general, the way of defining $\ket{\psi_{\geq \delta}}$ (as explained in \cite{cryptoeprint:2021:1516}) enables us to do so. As a result, we can extract $s^*$ from $\ket{\psi_{\geq \delta}}$ almost without disturbing the state by  the Almost-as-Good-as-New
lemma \cite[Lemma 2.2]{Aar05} (a.k.a.\ the gentle measurement lemma), which shows \Cref{lem:tech:extract_and_simulate} for the case where $\ket{\psi}$ only has $\ket{\psi_{\geq \delta}}$ component. 

In the above, we separately analyze 
$\ket{\psi_{< \delta}}$ and
$\ket{\psi_{\geq \delta}}$. In fact, we can see from the way we define them that they do not interfere with each other during the above described extraction procedure. 
As a result, the case of a superposition of $\ket{\psi_{< \delta}}$ and
$\ket{\psi_{\geq \delta}}$ can be reduced to the above two cases.

See \Cref{lem:extract_and_simulate} for the formal statement of the lemma and 
\Cref{sec:proof_extract_and_simulate} for the full proof.

\subsection{Full-Fledged Post-Quantum Non-Malleable Commitments}
\label{sec:tech-overview:full-fledged}

To make $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ a full-fledged post-quantum non-malleable commitments, we need to remove the one-side, small-tag, and synchronous restrictions. Due to space constraints, we will only briefly describe how to do that in this overview. We will provide more detailed overviews in the corresponding sections in the main body.

\para{Removing the One-Sided Restriction.} Notice that the non-malleability proof of $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ (and $\langle C, R\rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$) makes use of the one-sided condition in both {\bf Step-3} and {\bf WIPoK-1}. Let us refer to these two steps as a {\bf Slot}. As demonstrated in \Cref{sec:tech-overview:small-tag:one-sided}
, it is the asymmetry condition $t < \tilde{t}$ for this {\bf Slot} that allows us to argue that the extracted $w'$ must contain the right committed value $\tilde{m}$ with good-enough probability.

We can use the following standard approach to remove the one-sided restriction. We simply repeat the {\bf Slot} twice, sequentially. The first repetition, referred to as {\bf Slot-A}, is identical to the original {\bf Slot}; In particular, both parties use the tag $t$. The second repetition, referred to as {\bf Slot-B}, will instead use $(n - t)$ as the tag. 

Now, in a MIM execution, if $t < \tilde{t}$, we can perform the same non-malleable proof as in \Cref{sec:tech-overview:small-tag:one-sided} (and \Cref{sec:tech-overview:small-tag:one-sided:sync:PQ}) with {\bf Slot-A} playing the role of {\bf Slot}. Otherwise (i.e., $t > \tilde{t}$), it must hold that $(n - t) < (n - \tilde{t})$; In this case, we can perform the non-malleable proof again, with {\bf Slot-B} playing the role of {\bf Slot}. (Note that by the definition of non-malleability, we do not need to consider the case $t = \tilde{t}$.)

\para{Handling Asynchronous Schedules.} 
First, we observe that the proof strategy used in \Cref{sec:tech-overview:small-tag:one-sided}, which is  for the synchronous setting, relies crucially on the following three conditions
\begin{enumerate}
\item
Both {\bf Step-1} and {\bf Step-2} in both the left and right sessions should finish before {\bf Step-3} in either of the two sessions starts. This is because our security proof considers each fixed prefix, which is the state right after the end of {\bf Step-2} (and before the start of {\bf Step-3}). 
\item
The right {\bf WIPoK-2} should not be interleaved with the left {\bf WIPoK-1}. This is because $\mathcal{G}_i$ rewinds the left {\bf WIPoK-1}; Meanwhile, we need to rewind the right {\bf WIPoK-2} to extract $\tilde{m}$. We do not want these two parts to rewind each other recursively.  
\item
The left {\bf Step-3} should happen before the right {\bf WIPoK-2}. This is because in machine $\hat{\mathcal{K}}_i$, brute-forcing is performed for the left {\bf Step-3}; At the same time, we need to rely on the WI property of the right {\bf WIPoK-2} to argue the similarity among all the $\hat{\mathcal{K}}_i$'s for different $i \in [\tilde{t}]$ (i.e., \Cref{eq:tech-overview:Ki-K1}).
\end{enumerate}
To prove non-malleability in the asynchronous setting, our strategy is to introduce more gadgets into the protocol that enforce the above three conditions. As long as these conditions are satisfied, we can then rely on essentially the same proof of non-malleability as in the synchronous case. 

For example, to enforce the third condition above, we can add an extractable commitment $\ensuremath{\mathsf{ExtCom}}\xspace$ between {\bf Step-3} and {\bf WIPoK-1}, where $C$ commits to $m$ again (and additionally proves in {\bf WIPoK-2} that he did it as required). Then, in the MIM execution, if the left {\bf Step-3} happens after (the first message of) the right {\bf WIPoK-2}, then the right $\ensuremath{\mathsf{ExtCom}}\xspace$ must happen before the  left {\bf Step-3}. In this case, we can extract $\tilde{m}$ from the right $\ensuremath{\mathsf{ExtCom}}\xspace$ to finish the proof of non-malleability, instead of performing the same proof as in \Cref{sec:tech-overview:small-tag:one-sided}. We will use similar ideas to enforce  all the conditions mentioned above.

Of course, in the real proof, we need to do the above argument for the two slot-version described above in the {\bf Removing the One-Sided Restriction} part. Moreover, whenever we add one more gadget, cautions are needed to resolve new problems that it may cause by interacting with the ``already-introduced'' gadgets in some undesirable way. We will elaborate on this in \Cref{sec:small-tag:async:classical}, where we also provide a more-detailed overview (in \Cref{sec:small-tag:classical:async:high-level}).

\para{Tag Amplification.} After the above two steps, we have already obtained a small-tag, asynchronous post-quantum non-malleable commitment $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$. As mentioned earlier, now we can apply the \cite{BLS21} tag amplifier.
Here is one more caveat---The tag amplifier requires $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$ to additionally satisfy a condition called {\em robust extractability}, which means that the extractability holds even if the cheating committer interacts with an external bounded-round machine that cannot be rewound. We show that our $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$ already satisfies it, thanks to the added instances of $\ensuremath{\mathsf{ExtCom}}\xspace$ (which was introduced to handle asynchronous schedules originally).
Thus, we can apply their tag amplifier to our $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$ protocol to obtain the final full-fledged post-quantum non-malleable commitment scheme. 















\subsection{Organization}
After presenting necessary notations and preliminaries in \Cref{sec:prelim}, we show in \Cref{sec:small-tag-one-sided-sync-classical} the small-tag, one-sided, synchronous non-malleable commitment $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ in the classical setting. 

Then, we remove the one-sided restriction in \Cref{sec:small-tag:classical:sync}, yielding the small-tag, synchronous non-malleable commitment $\langle C, R \rangle^{\mathsf{sync}}_{\mathsf{tg}}$ (still in the classical setting).

Next, we show in \Cref{sec:small-tag:async:classical} how to handle asynchronous schedules {\em in the classical setting}. This leads to the small-tag, synchronous non-malleable commitment $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg}}$. As mentioned earlier, the way we handle asynchronous schedules is quantum-friendly. We could have done this part directly for {\em the quantum version of} $\langle C, R \rangle^{\mathsf{sync}}_{\mathsf{tg}}$; But we find that it conveys our ideas better to first show the techniques in the classical setting, because it can avoid confusing the reader with quantum phenomena that are orthogonal to the discussion of asynchronous schedules. Once one understands our techniques for asynchronous schedules in the classical setting, it is easy to see why it extends to the post-quantum setting.

In \Cref{sec:extract_and_simulate}, we show a post-quantum extract-and-simulate lemma, which plays an important role later when we quantize our classical proof of non-malleability.



Finally, we describe in \Cref{sec:full:pq:nmcom} the full-fledged post-quantum non-malleable commitment. To do that, we first show in \Cref{summary:pq:sec:small-tag-one-sided-sync-pq} how to quantize the non-malleable proof of $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$. This gives its post-quantum analog $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$ (i.e., a small-tag, one-sided, synchronous, post-quantum non-malleable commitment).
Next, we describe in \Cref{sec:full:pq:nmcom:async} how to remove the one-sided and synchronous restrictions from $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg,PQ}}$, to obtain the protocol $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$; This step mimics the techniques we used in the classical setting converting $\langle C, R \rangle^{\mathsf{OneSided}}_{\mathsf{tg}}$ to $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg}}$. Finally, in 
\Cref{sec:full:pq:nmcom:tag-amp}, we obtain the final full-fledged post-quantum non-malleable commitment by applying the \cite{BLS21}
tag amplifier to $\langle C, R \rangle^{\mathsf{async}}_{\mathsf{tg,PQ}}$.

We show the application of our post-quantum commitments to post-quantum MPC in \Cref{sec:app-to-MPC}.



\subsection{Proving Non-Malleability \red{(Old Stuff)}}
\label{one-sided:non-malleability:proof:classical}

\begin{theorem}\label{thm:one-sided:non-malleability}
The commitment scheme $\langle C, R \rangle$ in \Cref{prot:one-sided:classical} is a one-sided non-malleable commitment scheme secure against synchronous PPT adversaries.
\end{theorem}	

To prove \Cref{thm:one-sided:non-malleability}, let us first define the game that captures the man-in-the-middle execution corresponding to $\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)$ with the $\langle C, R \rangle$ defined in \Cref{prot:one-sided:classical}.

\para{Game $H^{\mathcal{M}}(\lambda,m,z)$:\label{gameH:description}} (Illustrated in \Cref{figure:one-sided:H}.) This is the man-in-the-middle execution of the commit stage of the $\langle C, R \rangle$ defined in \Cref{prot:one-sided:classical}, where the left committer commits to $m$ and $\mathcal{M}$'s non-uniform advice is $z$. The output of this game is defined as the view of $\mathcal{M}$ resulted from this execution, which we denote as $\ensuremath{\mathsf{View}}\xspace_H$. \xiao{It seems more convenient to define the output of game to be the output of $\mathcal{M}$, instead of its view.}

\para{Notation.} For any $\ensuremath{\mathsf{View}}\xspace_H$ output by $H^{\mathcal{M}}(\lambda,m,z)$, we say that $\ensuremath{\mathsf{View}}\xspace_H$ is an {\em accepting} view if the honest receiver $R$ in the right session accepts at the end of the commit stage. \xiao{(here, it seems we can assume w.l.o.g.\ that we can tell if $\ensuremath{\mathsf{View}}\xspace_H$ is accepting or not efficiently.)} We use $\tilde{m}(\ensuremath{\mathsf{View}}\xspace_H)$ to denote the value committed by $\mathcal{M}$: if $\ensuremath{\mathsf{View}}\xspace_H$ is accepting, $\tilde{m}(\ensuremath{\mathsf{View}}\xspace_H) \coloneqq \bot$; otherwise, $\tilde{m}(\ensuremath{\mathsf{View}}\xspace_H)$ is defined to be the value (statistically) bounded in \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the right execution (i.e., the right-side Naor's commitment). In particular, it holds that:
\begin{equation}\label{eq:classical:mim-H}
\big\{\mathsf{mim}^\mathcal{M}_{\langle C, R \rangle}(\lambda, m, z)\big\} \ensuremath{\stackrel{\text{i.d.}}{=\mathrel{\mkern-3mu}=}}\xspace \big\{\big(\ensuremath{\mathsf{View}}\xspace_H, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_H)\big):\ensuremath{\mathsf{View}}\xspace_H \gets H^{\mathcal{M}}(\lambda,m,z) \big\},
\end{equation}
where both ensembles are index by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m \in \ensuremath{\{0,1\}}\xspace^\lambda$, and $z \in \ensuremath{\{0,1\}}\xspace^*$. \xiao{Need to modify the length of the message to $\ell(\lambda)$.}

Therefore, to prove that \Cref{prot:one-sided:classical} satisfies \Cref{def:NMCom:classical}, it suffices to show the following:
\begin{equation}
\label{eq:classical:H:m-0:m-1}
\big\{\big(\ensuremath{\mathsf{View}}\xspace^0_H, \tilde{m}(\ensuremath{\mathsf{View}}\xspace^0_H)\big):\ensuremath{\mathsf{View}}\xspace^0_H \gets H^{\mathcal{M}}(\lambda,m_0,z) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{\big(\ensuremath{\mathsf{View}}\xspace^1_H, \tilde{m}(\ensuremath{\mathsf{View}}\xspace^1_H)\big):\ensuremath{\mathsf{View}}\xspace^1_H \gets H^{\mathcal{M}}(\lambda,m_1,z) \big\},
\end{equation}
where both ensembles are index by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^\lambda$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.

\para{Proof by Contradiction.} Our high-level strategy is proof by contradiction. We assume for contradiction that there are a PPT machine $\mathcal{D}$ and a function $\epsilon(\lambda) = 1/\mathsf{poly}(\lambda)$ such that for infinitely many $\lambda \in \ensuremath{\mathbb{N}}\xspace$,
\begin{equation}\label[Inequality]{eq:one-sided:proof:contra-assump}
\bigg|\Pr[\mathcal{D}\big(1^\lambda, \ensuremath{\mathsf{View}}\xspace^0_H, \tilde{m}(\ensuremath{\mathsf{View}}\xspace^0_H)\big)] - \Pr[\mathcal{D}\big(1^\lambda,\ensuremath{\mathsf{View}}\xspace^1_H, \tilde{m}(\ensuremath{\mathsf{View}}\xspace^1_H)\big)] \bigg|\ge 3 \cdot \epsilon(\lambda),
\end{equation}
where the first probability is taken over the random procedure $\ensuremath{\mathsf{View}}\xspace^0_H \gets H^{\mathcal{M}}(\lambda,m_0,z)$ and the second probability is taken over the random procedure $\ensuremath{\mathsf{View}}\xspace^1_H \gets H^{\mathcal{M}}(\lambda,m_1,z)$.

We then show the following lemma:
\begin{lemma}\label{lem:one-sided:proof:core}
For the above $\epsilon(\lambda)$,
there exits a hybrid $G$ such that for any PPT $\mathcal{M}$, the following holds
\begin{enumerate}
\item\label[Property]{item:lem:one-sided:proof:core:1}
$\big\{(\ensuremath{\mathsf{View}}\xspace_0, \msf{Val}_0):(\ensuremath{\mathsf{View}}\xspace_0, \msf{Val}_0) \gets G^{\mathcal{M}}(\lambda,m_0,z) \big\} \ensuremath{\stackrel{\text{c}}{\approx}}\xspace \big\{(\ensuremath{\mathsf{View}}\xspace_1, \msf{Val}_1):(\ensuremath{\mathsf{View}}\xspace_1, \msf{Val}_1) \gets G^{\mathcal{M}}(\lambda,m_1,z) \big\}$, where both ensembles are index by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m_0, m_1 \in \ensuremath{\{0,1\}}\xspace^\lambda$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
\item\label[Property]{item:lem:one-sided:proof:core:2}
$\big\{(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val}):(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z) \big\} \ensuremath{\stackrel{\text{s}}{\approx}}\xspace_{\epsilon(\lambda)} \big\{\big(\ensuremath{\mathsf{View}}\xspace_H, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_H)\big):\ensuremath{\mathsf{View}}\xspace_H \gets H^{\mathcal{M}}(\lambda,m,z) \big\}$,  where both ensembles are index by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m \in \ensuremath{\{0,1\}}\xspace^\lambda$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
\end{enumerate}
\end{lemma}
It is easy to see that if \Cref{lem:one-sided:proof:core} is true, it will contradict our assumption in \Cref{eq:one-sided:proof:contra-assump}. Thus, it will finish the proof of non-malleability. Indeed, this lemma is the most technically involved part. We prove it in \Cref{sec:one-sided:core-lemma:proof}.



\subsection{Proof of \Cref{lem:one-sided:proof:core} \red{(Old Stuff)}}
\label{sec:one-sided:core-lemma:proof}

We first describe the hybrid $G$ mentioned in \Cref{lem:one-sided:proof:core}, and then prove that it has the desired properties. Note that $G$ depends on $\epsilon$, though we does not make $\epsilon$ an explicit input parameter for $G$. In \Cref{item:hyb:G:runK} below, We will need an extra parameter $\epsilon'$ which is defined as $\epsilon'(\lambda) \coloneqq \frac{\epsilon(\lambda)}{t^2}$. The reason for this setup will become clear later in the proof. For now, we want to remark that this notation is not really necessary---We can always write $\frac{\epsilon(\lambda)}{t^2}$ (and with potential simplifications) whenever we need $\epsilon'(\lambda)$. We choose to define $\epsilon'(\lambda)$ as a separate parameter because it helps make our presentation conceptually cleaner.

Also, the hybrid $G$ will invoke a machine $\mathcal{K}$ as a sub-procedure, which will be defined and constructed in \Cref{lem:extractorK}.

\begin{AlgorithmBox}[label={hybrid:G}]{Hybrid \textnormal{$G^{\mathcal{M}}(\lambda,m,z)$}} 
\red{Once I finish the quantum version, I'll modify this algorithm slightly. There is no need to run the ``main-thread'' for the first time. We can simply obtain the prefix $\tau$, and start running $\mathcal{K}$ directly. This is more consistent with the quantum version.} This hybrid proceeds as follows:
\begin{enumerate}
\item
Execute $\ensuremath{\mathsf{View}}\xspace_H \gets H^{\mathcal{M}}(\lambda,m,z)$. 
\item
Set $\ensuremath{\mathsf{View}}\xspace_G \coloneqq \ensuremath{\mathsf{View}}\xspace_H$. 
\item
If $\ensuremath{\mathsf{View}}\xspace_G$ is {\em not} an accepting view \red{(here, it seems we can assume w.l.o.g.\ that we can tell if $\ensuremath{\mathsf{View}}\xspace_H$ is accepting or not efficiently.)}, set $\msf{Val} \coloneqq \bot$ and then jump directly to \Cref{item:hyb:G:final}; Otherwise (i.e., $\ensuremath{\mathsf{View}}\xspace_G$ is an accepting view), go to the next step (i.e., \Cref{item:hyb:G:runK}).
\item \label[Step]{item:hyb:G:runK}
Let $\tau(\ensuremath{\mathsf{View}}\xspace_G)$ denote the prefix of the view $\ensuremath{\mathsf{View}}\xspace_G$ that corresponds to \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the man-in-the-middle execution. Namely, it contains all the information of the execution right before the beginning of \Cref{item:one-sided:step:OWFs}. Therefore, a PPT procedure can resume $\tau(\ensuremath{\mathsf{View}}\xspace_G)$ to finish the main-in-the-middle execution corresponding to $\ensuremath{\mathsf{View}}\xspace_G$.

$G^{\mathcal{M}}(\lambda,m,z)$ then loops the following procedure for $\frac{\tilde{t}}{\epsilon'(\lambda)} \cdot \lambda$ times, where $\epsilon'(\lambda) \coloneqq \frac{\epsilon(\lambda)}{t^2}$:
\begin{itemize}
\item
Execute $\msf{Val}_{\mathcal{K}} \gets \mathcal{K}\big(\tau(\ensuremath{\mathsf{View}}\xspace_G)\big)$, where $\mathcal{K}$ is defined in \Cref{lem:extractorK}.  If $\msf{Val}_{\mathcal{K}} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G)$ \red{(This is not efficient in general. But we are using Naor's $\mathsf{Com}$, which has is efficiently testable. Need to explain this explicitly. Put it in another way, what $\mathcal{K}$ extracted is not only the message, but also the decommitment information.)}, set $\msf{Val} \coloneqq \msf{Val}_{\mathcal{K}}$ and jump to \Cref{item:hyb:G:final}; otherwise, go to the next loop.
\end{itemize}
\item
Set $\msf{Val} \coloneqq \bot$.
\item \label[Step]{item:hyb:G:final}
Output $(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val})$.
\end{enumerate}
\end{AlgorithmBox}

Before talking about the extractor $\mathcal{K}$, let us first define a variable that captures the probability that the man-in-the-middle yields an accepting view conditioned on a given prefix $\tau$.
\begin{definition}[Accepting Probability from Prefix $\tau$]\label{def:p-tau:1}
For any prefix $\tau$ corresponding to the first two steps of the man-in-the-middle execution (see also \Cref{item:hyb:G:runK} of \Cref{hybrid:G}), let $p_\tau$ denote the probability that continuing from this particular prefix $\tau$, the man-in-the-middle execution will yield an accepting view.
\end{definition}

\begin{lemma}[Extractor $\mathcal{K}$]\label{lem:extractorK}
There exists a machine $\mathcal{K}$ that takes as input a prefix $\tau$ corresponding to \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the man-in-the-middle execution, and tries to output $\tilde{m}(\tau)$, which is defined to be the value committed in the right Naor's commitment in $\tau$. Machine $\mathcal{K}$ satisfies the following requirements:
\begin{enumerate}
\item\label[Property]{item:extractorK:efficiency}
On any input $\tau$, $\mathcal{K}(\tau)$ runs in expected polynomial time on the security parameter $\lambda$ (contained implicitly in $\tau$).
\item\label[Property]{item:extractorK:extractability}
Let $\epsilon(\lambda) = \frac{1}{\mathsf{poly}(\lambda)}$ and $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{t^2}$. For any $\tau$, if $p_\tau\ge \epsilon(\lambda)$ (where $p_\tau$ is defined in \Cref{def:p-tau:1}), then 
$$\Pr[\msf{Val} = \tilde{m}(\tau) :\msf{Val} \gets \mathcal{K}(\tau)] \ge \epsilon'(\lambda)/\tilde{t}.$$
\xiao{Need to modify this part: what $\mathcal{K}$ extracted is not only the message, but also the decommitment information. See the red text in \Cref{item:hyb:G:runK}.}
\end{enumerate}
\end{lemma}
The proof of \Cref{lem:extractorK} is the most involved part for the current proof of \Cref{lem:one-sided:proof:core}. We will do that in \Cref{sec:lem:extractorK:proof}. For now, let us first use \Cref{lem:extractorK} to finish the current proof of \Cref{lem:one-sided:proof:core}, assuming that the former is correct.


\para{Proving \Cref{item:lem:one-sided:proof:core:1} in \Cref{lem:one-sided:proof:core}.\label{para:lem:one-sided:proof:core:1}} Observe that hybrid $G^{\mathcal{M}}(\lambda,m,z)$ is an efficient machine \xiao{This argument is not accurate. $G$ is not efficient yet. See the red text in \Cref{item:hyb:G:runK}.} (this makes use of \Cref{item:extractorK:efficiency} in \Cref{lem:extractorK}). Moreover, it does not rewind \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the man-in-the-middle execution. Therefore, \Cref{item:lem:one-sided:proof:core:1} in \Cref{lem:one-sided:proof:core} follows immediately from the computationally hiding property of the left Naor's commitment (i.e., \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} in the left execution).

Now, to finish the proof of \Cref{lem:one-sided:proof:core}, we only need to prove \Cref{item:lem:one-sided:proof:core:2}.


\para{Proving \Cref{item:lem:one-sided:proof:core:2} in \Cref{lem:one-sided:proof:core}.\label{para:lem:one-sided:proof:core:2}} We first observe that, by the definition of $G^{\mathcal{M}}(\lambda,m,z)$, the following holds 
$$\big\{\big(\ensuremath{\mathsf{View}}\xspace_{H}, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{H})\big):\ensuremath{\mathsf{View}}\xspace_{H} \gets H^{\mathcal{M}}(\lambda,m,z) \big\} \ensuremath{\stackrel{\text{i.d.}}{=\mathrel{\mkern-3mu}=}}\xspace \big\{\big(\ensuremath{\mathsf{View}}\xspace_G, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})\big):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z) \big\},$$
where both ensembles are index by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m \in \ensuremath{\{0,1\}}\xspace^\lambda$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.
Thus, to establish \Cref{item:lem:one-sided:proof:core:2} in \Cref{lem:one-sided:proof:core}, it suffices to show
\begin{equation}\label[Expression]{eq:one-sided:proof:statsitcally-close:goal}
\big\{\big(\ensuremath{\mathsf{View}}\xspace_G, \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})\big):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)  \big\}\ensuremath{\stackrel{\text{s}}{\approx}}\xspace_\epsilon \big\{(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)  \big\},
\end{equation}
where both ensembles are index by $\lambda \in \ensuremath{\mathbb{N}}\xspace$, $m \in \ensuremath{\{0,1\}}\xspace^\lambda$, and $z \in \ensuremath{\{0,1\}}\xspace^*$.

To establish \Cref{eq:one-sided:proof:statsitcally-close:goal}, it suffices to show
\begin{equation}\label[Inequality]{eq:one-sided:proof:statsitcally-close:inequality}
\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}):(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)] \le \epsilon(\lambda) + \mathsf{negl}(\lambda).
\end{equation}
To do that, let us first define two events w.r.t.\ the random procedure $(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)$:
\begin{itemize}
\item
$E_{\mathsf{acc}}$: the event that $\ensuremath{\mathsf{View}}\xspace_G$ is an accepting view.
\item
$E_{\le \epsilon}$: the even that $p_{\tau(\ensuremath{\mathsf{View}}\xspace_G)} \le \epsilon(\lambda)$.
\end{itemize}
We first show that the the probability for $(E_{\mathsf{acc}} \wedge E_{\le \epsilon})$ is upper-bounded by $\epsilon(\lambda)$. 

\begin{MyClaim} 
It holds that
$\Pr[E_{\mathsf{acc}} \wedge E_{\le \epsilon}:(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)]  \le \epsilon(\lambda)$.
\end{MyClaim}
\begin{proof}
This is an immediate result following from the definitions of these two events. In more details,
\begin{equation}\label[Inequality]{eq:bounding-E1E2}
\Pr[E_{\mathsf{acc}} \wedge E_{\le \epsilon}] 
= \Pr[E_{\mathsf{acc}} ~|~ E_{\le \epsilon}] \cdot \Pr[E_{\le \epsilon}] 
 \le \Pr[E_{\mathsf{acc}} ~|~ E_{\le \epsilon}] \cdot 1 = \epsilon(\lambda) \cdot 1,	
\end{equation}
where all the probabilities are taken over the random procedure $(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)$.
\end{proof}

Next, we upper-bound the LHS of \Cref{eq:one-sided:proof:statsitcally-close:inequality} by $\Pr[\msf{Val} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G)~|~E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}]$:

\begin{MyClaim}\label{bound:Val-ne-m}
It holds that	
$$\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})] \le \epsilon(\lambda) + \Pr[\msf{Val} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G)~|~E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}],$$ where both the probabilities are taken w.r.t.\ the random procedure $(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)$.
\end{MyClaim}
\begin{proof}
All the probabilities below are taken w.r.t.\ the random procedure $(\ensuremath{\mathsf{View}}\xspace_G, \mathsf{Val}) \gets G^{\mathcal{M}}(\lambda,m,z)$. We thus omit it from the subscript.
\begin{align*}
\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G})] 
& = \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_{\mathsf{acc}}] + \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge \neg E_{\mathsf{acc}}]	\\
& = \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_{\mathsf{acc}}] \numberthis \label{bound:Val-ne-m:step:1}	\\
& = \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_{\mathsf{acc}} \wedge E_{\le \epsilon}] +\Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}]	\\
& \le \epsilon(\lambda) +  \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) \wedge E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}] \numberthis \label[Inequality]{bound:Val-ne-m:step:2}\\
&\le \epsilon(\lambda) +  \Pr[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) ~|
~ E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}],
\end{align*}
where \Cref{bound:Val-ne-m:step:1} follows from the fact that if $\ensuremath{\mathsf{View}}\xspace_G$ is not accepting then $\msf{Val} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G) = \bot$, and \Cref{bound:Val-ne-m:step:2} follows from \Cref{eq:bounding-E1E2}.
\end{proof}
Recall that our goal is to establish \Cref{eq:one-sided:proof:statsitcally-close:inequality}. Because of \Cref{bound:Val-ne-m}, it is now sufficient to show 
\begin{equation}\label{bad:conditioned:E1-nE2}
\Pr_{(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val})\gets G^{\mathcal{M}}(\lambda,m,z)}[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) ~|
~ E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}] = \mathsf{negl}(\lambda).
\end{equation}
\begin{proof}[Proof of \Cref{bad:conditioned:E1-nE2}]
Given $E_{\mathsf{acc}}$ (i.e., $\ensuremath{\mathsf{View}}\xspace_G$ is accepting), we know that $G^{\mathcal{M}}(\lambda,m,z)$ must have entered \Cref{item:hyb:G:runK} to execute the machine $\mathcal{K}\big(\tau(\ensuremath{\mathsf{View}}\xspace_G)\big)$ for at most $\frac{\tilde{t}}{\epsilon'(\lambda)} \cdot \lambda$ times, with early termination only if the event $\msf{Val}_{\mathcal{K}} = \tilde{m}\big(\tau(\ensuremath{\mathsf{View}}\xspace_G)\big)$ happens (see \Cref{hybrid:G}).\footnote{Technically speaking, in \Cref{item:hyb:G:runK} of \Cref{hybrid:G}, $G$ loops until $\msf{Val}_{\mathcal{K}} = \tilde{m}(\ensuremath{\mathsf{View}}\xspace_G)$ happens. But it is obvious that $\tilde{m}\big(\tau(\ensuremath{\mathsf{View}}\xspace_G)\big) \equiv\tilde{m}(\ensuremath{\mathsf{View}}\xspace_G)$.}

Given $\neg E_{\le \epsilon}$ (i.e., $p_{\tau(\ensuremath{\mathsf{View}}\xspace_G)} > \epsilon(\lambda)$), it follows from \Cref{item:extractorK:extractability} in \Cref{lem:extractorK} that each time $\mathcal{K}$ is invoked on $\tau(\ensuremath{\mathsf{View}}\xspace_G)$, it holds that $\Pr[\msf{Val} = \tilde{m}\big(\tau(\ensuremath{\mathsf{View}}\xspace_G)\big) :\msf{Val} \gets \mathcal{K}\big(\tau(\ensuremath{\mathsf{View}}\xspace_G) \big)] \ge \epsilon'(\lambda)/\tilde{t}$.

Therefore, we have 
\begin{equation*}
\Pr_{(\ensuremath{\mathsf{View}}\xspace_G, \msf{Val})\gets G^{\mathcal{M}}(\lambda,m,z)}[\mathsf{Val}\ne \tilde{m}(\ensuremath{\mathsf{View}}\xspace_{G}) ~|
~ E_{\mathsf{acc}} \wedge \neg E_{\le \epsilon}] = (1 - \frac{\epsilon'(\lambda)}{\tilde{t}})^{\frac{\tilde{t}}{\epsilon'(\lambda)}\cdot \lambda} = 2^{-O(\lambda)} = \mathsf{negl}(\lambda).
\end{equation*}
This finishes the proof of \Cref{bad:conditioned:E1-nE2}.
\end{proof} 
This eventually finishes the proof of \Cref{item:lem:one-sided:proof:core:2} in \Cref{lem:one-sided:proof:core} (and thus \Cref{lem:one-sided:proof:core}). 


\subsection{Extractor $\mathcal{K}$ (Proof of \Cref{lem:extractorK})}
\label{sec:lem:extractorK:proof}

In this section, we prove \Cref{lem:extractorK}. We will construct the extractor $\mathcal{K}$ prescribed by \Cref{lem:extractorK}, and show that it enjoys the stipulated properties. We will build the extractor $\mathcal{K}$
gradually, starting by defining several intermediate machines.
The description of $\mathcal{K}$ will appear toward the end of this subsection (on \Cpageref{extractorK:description}). We found this arrangement most reader-friendly. Moreover, we illustrate all the intermediate machines in \Cref{figure:one-sided:games}.


\para{Machine $\mathcal{G}_{i}$ ($i \in [\tilde{t}]$):\label{machine:Gi}} (Illustrated in \Cref{figure:one-sided:Gi}.)
Recall the man-in-the-middle execution $H^{\mathcal{M}}(\lambda,m,z)$ defined on \Cpageref{gameH:description} (and depicted in \Cref{figure:one-sided:H}). We can re-interpret $H^{\mathcal{M}}(\lambda,m,z)$ as consisting of the following two steps:
\begin{enumerate}
\item
It first executes the \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the man-in-the-middle execution. Let $\tau$ denote the states and transcripts of all the parties $C$, $R$, and $\mathcal{M}$ at the end of \Cref{item:one-sided:step:committing}. Recall that  we refer to this $\tau$ as the prefix of the man-in-the-middle execution.
\item\label[Step]{item:H:re-interp:2}
It then resumes the execution from $\tau$ to finish the remaining steps as $H^{\mathcal{M}}(\lambda,m,z)$.
\end{enumerate}
We now define $\mathcal{G}_1(\tau)$ as the machine corresponding to the  \Cref{item:H:re-interp:2} above. That is, on input the prefix $\tau$, $\mathcal{G}_1(\tau)$ finishes the remaining part of the man-in-the-middle execution identically as $H^{\mathcal{M}}(\lambda,m,z)$. In particular, $\mathcal{G}_1(\tau)$ uses the witness $\tilde{x}_1$ to go through the right {\bf WIPoK-1} (the subscript ``1'' is meant to signal this fact), and at the end, $\mathcal{G}_1(\tau)$ output the view of $\mathcal{M}$ (same as $H^{\mathcal{M}}(\lambda,m,z)$).

Then, for any $i \in [\tilde{t}]\setminus \Set{1}$, we define $\mathcal{G}_{i}(\tau)$ as the machine that behaves identically to $\mathcal{G}_1(\tau)$, except that $\mathcal{G}_i(\tau)$ uses the witness $\tilde{x}_{i}$ in the right {\bf WIPoK-1}.

For a prefix $\tau$, let us (re-)define the probability that $\tau$ leads to an accepting execution. Recall that we actually already defined this term in \Cref{def:p-tau:1}. The following definition is equivalent to \Cref{def:p-tau:1}, but is formalized w.r.t.\ the machine $\mathcal{G}_1$. This version turns out to be more suitable for the rest of the proof.
\begin{definition}\label{def:p-tau:2}
For any $\tau$ that corresponds to \Cref{item:one-sided:step:Naor-rho,item:one-sided:step:committing} of the execution $H^{\mathcal{M}}(\lambda,m,z)$, we define
\begin{equation}\label{eq:def:p-tau}
p_\tau \coloneqq \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}: \ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}_1(\tau)].
\end{equation}
\end{definition}
We first claim that the accepting probabilities for $\mathcal{G}_i(\tau)$'s with different $i \in [\tilde{t}]$  are almost the same.
\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure01.pdf}
         }
         \caption{}
         \label{figure:one-sided:H}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure02.pdf}
         }
         \caption{}
         \label{figure:one-sided:Gi}
     \end{subfigure}
     \vskip\baselineskip
      \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure03.pdf}
         }
         \caption{}
         \label{figure:one-sided:G'i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure04.pdf}
         }
         \caption{}
         \label{figure:one-sided:G''i}
     \end{subfigure}
     \vskip\baselineskip
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure05.pdf}
         }
         \caption{}
         \label{figure:one-sided:Ki}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure06.pdf}
         }
         \caption{}
         \label{figure:one-sided:K}
     \end{subfigure}
     \caption{Different Hybrids/Machines \scriptsize{(Changes between adjacent machines are highlighted by red color)}}
     \label{figure:one-sided:games}
\end{figure}

\begin{MyClaim}\label{claim:bound:Gi}
$\forall i \in [\tilde{t}], ~\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
Note that the machine $\mathcal{G}_i(\tau)$ does not rewind the right {\bf WIPoK-1}, and for any $i \in [\tilde{t}] \setminus \Set{1}$, $\mathcal{G}_i(\tau)$ differs from $\mathcal{G}_1(\tau)$ only by the witness used in the right {\bf WIPoK-1}. Therefore, it follows from the WI property of the right {\bf WIPoK-1} that for any $i \in [\tilde{t}]$,
$$\big| \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}_i(\tau)] - \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}_1(\tau)]\big| \le \mathsf{negl}(\lambda).$$
Then, by the definition of $p_\tau$ (\Cref{eq:def:p-tau}), \Cref{claim:bound:Gi} follows.
\end{proof}

\para{Machine $\mathcal{G}'_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:G'i}.) On any input $\tau$, $\mathcal{G}'_i(\tau)$ behaves identically to $\mathcal{G}_i(\tau)$, except the following change. Instead of executing the left {\bf WIPoK-1} (i.e., \Cref{item:one-sided:step:WIPoK:1} in the left) honestly, $\mathcal{G}'_i$ invokes the emulation-extractor $\ensuremath{\mathcal{SE}}\xspace$ to emulate the left {\bf WIPoK-1} while extracting a value $(j, x_j)$ \xiao{need to make a new notation: the extracted value could be $\bot$}. Recall that the existence of $\ensuremath{\mathcal{SE}}\xspace$ is guaranteed by the PoK property of $\ensuremath{\mathsf{WIPoK}}\xspace$ (see \Cref{def:WEE}). If  $(j, x_j) \notin \ensuremath{\mathcal{R}}\xspace_{\ensuremath{\mathcal{L}}\xspace^t_f}(Y)$ \xiao{change the notation} (see \Cref{eq:one-sided:Lang:OWF})---namely, the extraction fails---$\mathcal{G}'_i(\tau)$ aborts; Otherwise, it continues to finish the execution identically as $\mathcal{G}_i(\tau)$. It is worth noting that although $\ensuremath{\mathcal{SE}}\xspace$ may extract a valid $(j, x_j)$ pair, $\mathcal{G}'_i(\tau)$ does {\em not} use it.  

\begin{MyClaim}\label{claim:bound:G'i}
$\forall i \in [\tilde{t}], ~\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}'_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows immediately from \Cref{claim:bound:Gi} and the witness-extended emulation property (as per \Cref{def:WEE}) of the left {\bf WIPoK-1}.
\end{proof}

\para{Machine $\mathcal{G}''_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:G''i}.) On any input $\tau$, $\mathcal{G}''_i(\tau)$ behaves identically to $\mathcal{G}'_i(\tau)$, except that $\mathcal{G}''_i(\tau)$ use the $(j, x_j)$ (extracted in $\mathcal{G}'_i(\tau)$) to finish the left {\bf WIPoK-2} (i.e., \Cref{item:one-sided:step:WIPoK:2} in the left execution).

\begin{MyClaim}\label{claim:bound:G''i}
$\forall i \in [\tilde{t}], ~\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace \gets \mathcal{G}''_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows immediately from \Cref{claim:bound:G'i} and the WI property of the left {\bf WIPoK-2}.
\end{proof}

\para{Machine $\mathcal{K}_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:Ki}.) On any input $\tau$, $\mathcal{K}_i(\tau)$ behaves identically to $\mathcal{G}''_i(\tau)$, except for the following difference. Machine $\mathcal{K}_i(\tau)$ uses the witness-extended emulator $\ensuremath{\mathcal{SE}}\xspace$ to finish the right {\bf WIPoK-2}, instead of playing the role of the honest receiver. Let $\msf{Val}$ denote the witness extracted by $\ensuremath{\mathcal{SE}}\xspace$. We use $\msf{Val} = \bot$ to denote the situation where $\msf{Val}$ is not a valid witness for the statement $\big(\tilde{\mathsf{com}}, (\tilde{y}_1, \ldots, \tilde{y}_{\tilde{t}})\big)$. (Recall that  $\big(\tilde{\mathsf{com}}, (\tilde{y}_1, \ldots, \tilde{y}_{\tilde{t}})\big)$ is supposed to be an instance in the language $\ensuremath{\mathcal{L}}\xspace_{\tilde{\rho}} \vee \ensuremath{\mathcal{L}}\xspace^{\tilde{t}}_{\tilde{f}}$.)
\begin{MyClaim}\label{claim:bound:Ki}
$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot :\msf{Val} \gets \mathcal{K}_i(\tau)] \ge p_\tau - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof}
This claim follows immediately from \Cref{claim:bound:G''i} and the witness-extended emulation property (as per \Cref{def:WEE}) of the right {\bf WIPoK-2}.
\end{proof}

Finally, we are ready to define the extractor $\mathcal{K}$. Intuitively, it can be considered as an average-case version of $\Set{\mathcal{K}_i}_{i\in[\tilde{t}]}$:

\para{Extractor $\mathcal{K}$:\label{extractorK:description}} (Illustrated in \Cref{figure:one-sided:K}.)  one any input $\tau$, $\mathcal{K}(\tau)$ samples uniformly at random an $i \ensuremath{\leftarrow}\xspace [\tilde{t}]$, executes $\mathcal{K}_i(\tau)$, and outputs whatever $\mathcal{K}_i(\tau)$ outputs.

\para{Proving \Cref{item:extractorK:efficiency} in \Cref{lem:extractorK}.} Recall that we need to show that $\mathcal{K}$ satisfies the two properties listed in \Cref{lem:extractorK}. First, observe that \Cref{item:extractorK:efficiency} follows simply from the description of $\mathcal{K}$---Indeed, each $\mathcal{K}_i(\tau)$ is the same as the real man-in-the-middle execution conditioned on the prefix $\tau$, except that $\tilde{x}_i$ is used in the right {\bf WIPoK-1} and the witness-extended emulator $\ensuremath{\mathcal{SE}}\xspace$ is used in the right {\bf WIPoK-2} and the left {\bf WIPoK-1}. Since  $\ensuremath{\mathcal{SE}}\xspace$ runs in expected PPT, so does $\mathcal{K}_i(\tau)$. Therefore, $\mathcal{K}(\tau)$ also runs in expected PPT.


\para{Proving \Cref{item:extractorK:extractability} in \Cref{lem:extractorK}.} Now, the only thing left is to prove \Cref{item:extractorK:extractability}.
Recall that \Cref{item:extractorK:extractability} requires that 
for any $\tau$, if $p_\tau \ge \epsilon(\lambda)$, then it holds that
\begin{equation}\label[Inequality]{eq:bound:averageK}
\Pr[\msf{Val} = \tilde{m}(\tau) :\msf{Val} \gets \mathcal{K}(\tau)] \ge \epsilon'(\lambda)/\tilde{t}.
\end{equation}
Also recall that $\mathcal{K}(\tau)$ is defined to execute the machine $\mathcal{K}_i(\tau)$  with  $i$ uniformly sampled from $[\tilde{t}]$. Therefore, \Cref{eq:bound:averageK} can be reduced to the following \Cref{lem:bound:Ki}. We will prove \Cref{lem:bound:Ki} in \Cref{sec:lem:bound:Ki:proof}, which will eventually finish the current proof of \Cref{lem:extractorK}.
\begin{lemma}\label{lem:bound:Ki}
Let $\epsilon(\lambda) = \frac{1}{\mathsf{poly}(\lambda)}$ and $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{t^2}$.
For any $\tau$, if $p_\tau \ge \epsilon(\lambda)$, then there exists an $i \in [\tilde{t}]$ such that 
$$\Pr[\msf{Val} = \tilde{m}(\tau) :\msf{Val} \gets \mathcal{K}_i(\tau)] \ge \epsilon'(\lambda).$$
\end{lemma}




\subsection{Proof of \Cref{lem:bound:Ki}}
\label{sec:lem:bound:Ki:proof}
We assume for contradiction that for some $\tau$ satisfying $p_\tau \ge \epsilon(\lambda)$, it holds that 
\begin{equation}\label[Inequality]{eq:proof:averageK:contra-assump}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{m}(\tau) :\msf{Val} \gets \mathcal{K}_i(\tau)] < \epsilon'(\lambda).
\end{equation}

\begin{MyClaim}\label{cliam:bound:Ki-xi}
Under the assumption in \Cref{eq:proof:averageK:contra-assump}, it holds that 
$$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}_i(\tau)] \ge p_\tau - \epsilon'(\lambda) - \mathsf{negl}(\lambda).$$
\end{MyClaim}
\begin{proof}
First, recall that the event $\msf{Val} \ne \bot$ (i.e., $\msf{Val}$ is a valid witness) can be partitioned into the following {\em disjoint} events: $\msf{Val} = \tilde{m}(\tau)$, $\msf{Val} = \tilde{x}_1$, \ldots, $\msf{Val} = \tilde{x}_{\tilde{t}}$. Therefore, we have 
\begin{equation}\label{eq:bound:Ki-xi:1}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} \ne \bot] = \Pr[\msf{Val} = \tilde{m}(\tau)] + \Pr[\msf{Val} = \tilde{x}_i] + \sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[\msf{Val} = \tilde{x}_j],
\end{equation}
where all the probabilities are taken over the random procedure $\msf{Val} \gets \mathcal{K}_i(\tau)$.


Then, the following holds
(all the probabilities below are taken w.r.t.\ the random procedure $\msf{Val} \gets \mathcal{K}_i(\tau)$):
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i] 
& = 
\Pr[\msf{Val} \ne \bot] - \Pr[\msf{Val} = \tilde{m}(\tau)] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[\msf{Val} = \tilde{x}_j] \bigg)  \label{eq:bound:Ki-xi:derive:1} \\
& \ge p_\tau - \mathsf{negl}(\lambda) - \Pr[\msf{Val} = \tilde{m}(\tau)] -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[\msf{Val} = \tilde{x}_j] \bigg)  \label[Inequality]{eq:bound:Ki-xi:derive:2}\\
& \ge p_\tau - \mathsf{negl}(\lambda) - \epsilon'(\lambda) -  \bigg(\sum_{j \in [\tilde{t}]\setminus \Set{i}} \Pr[\msf{Val} = \tilde{x}_j] \bigg) \label[Inequality]{eq:bound:Ki-xi:derive:3}
\end{align}
where \Cref{eq:bound:Ki-xi:derive:1} follows from \Cref{eq:bound:Ki-xi:1}, \Cref{eq:bound:Ki-xi:derive:2} follows from \Cref{claim:bound:Ki}, and \Cref{eq:bound:Ki-xi:derive:3} follows from \Cref{eq:proof:averageK:contra-assump}.


Now, to prove \Cref{cliam:bound:Ki-xi}, it suffices to show that 
\begin{equation}
\forall i \in [\tilde{t}],~\forall j \in [\tilde{t}]\setminus \Set{i}, ~\Pr[\msf{Val} = \tilde{x}_j:\msf{Val} \gets \mathcal{K}_i(\tau)] = \mathsf{negl}(\lambda).
\end{equation}
This can be reduced via standard techniques to the one-wayness of the OWF $\tilde{f}$ in \Cref{item:one-sided:step:OWFs} of the right execution. In more details, we assume for contradiction that there exit $i^*, j^* \in [\tilde{t}]$ such that $i^* \ne j^*$ and that the probability $\Pr[\msf{Val} = \tilde{x}_{j^*}: \msf{Val} \gets \mathcal{K}_{i^*}(\tau)]$ is non-negligible, where, by definition, $\tilde{x}_{j^*}$ is the preimage of $\tilde{y}_{j^*}$ under the right OWF $\tilde{f}$. Then, we can build an adversary $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ breaking one-wayness in the following way: $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ obtains the challenge $y^*$ from the external one-wayness challenger; it then runs the machine $\mathcal{K}_{i^*}(\tau)$ internally, for which $\ensuremath{\mathcal{A}}\xspace_\textsc{owf}$ uses $y^*$ in place of $\tilde{y}_{j^*}$ when executing \Cref{item:one-sided:step:OWFs} in the right. Note that the internal execution $\mathcal{K}_{i^*}(\tau)$ is identically to the stand-alone execution of $\mathcal{K}_{i^*}$, thus the extracted $\tilde{x}_{j^*}$ will be a valid preimage for $y^*$ ($= \tilde{y}_j^*$) with non-negligible probability, breaking one-wayness. 
\end{proof}


\para{Machine $\mathcal{K}'_i$ ($i \in [\tilde{t}]$):\label{machineK':description}} (Illustrated in \Cref{figure:one-sided:K'i}.) On an input $\tau$ that corresponds to the first 2 steps of the man-in-the-middle execution, $\mathcal{K}'_i(\tau)$ proceeds as follows:
\begin{enumerate}
\item
$\mathcal{K}'_i(\tau)$ first finish \Cref{item:one-sided:step:OWFs} of the man-in-the-middle execution in the same way as $\mathcal{K}_i(\tau)$. In particular, it will see in the left execution the values $Y = (y_1, \ldots, y_t)$ sent from $\mathcal{M}$; 
\item
$\mathcal{K}'_i(\tau)$ recovers $(x_1, \ldots, x_t)$ by brute-force: Namely, for each $y_i$, it inverts the OWF $f$ to find $x_i$ s.t.\ $f(x_i) = y_i$. It is possible that there exist some ``bad'' $y_i$'s that are not in the range of $f$. For such bad $i$'s, it sets $x_i = \bot$. If all the $x_i$'s are bad, $\mathcal{K}'_i(\tau)$ halts and outputs $\bot$;
\item \label[Step]{item:machineK':3}
If this step is reached, we know that $(x_1, \ldots, x_t)$ cannot be all $\bot$. $\mathcal{K}'_i(\tau)$ then picks a $x^*_j$ uniformly at random from the good (i.e.\ non-$\bot$) $x_i$'s.
\item
$\mathcal{K}'_i(\tau)$ continues to finish the execution in the same way as $\mathcal{K}_i(\tau)$, except that it uses $x^*_j$ as the witness when executing the left {\bf WIPoK-2}. 
\end{enumerate}
It is worth noting that the $(j, x_j)$ extracted (in $\mathcal{K}_i(\tau)$, inherited from $\mathcal{G}'_i(\tau)$) by the witness-extended emulator for the left {\bf WIPoK-1} is not used any more by $\mathcal{K}'_i(\tau)$. 

It is easy to see that if the $x^*_j$ picked by $\mathcal{K}'_i(\tau)$ is the equal to the $x_j$ extracted by $\mathcal{K}_i(\tau)$ from its left {\bf WIPoK-1}, then $\mathcal{K}'_i(\tau)$ and $\mathcal{K}_i(\tau)$ are identical\footnote{In this step, we rely on the injectiveness of the OWF $f$ in the right. That is, there is a unique preimage for each image. Thus, if both the $x^*_j$ (sampled by $\mathcal{K}'_i(\tau)$) and the extracted $x_j$ (in $\mathcal{K}_i(\tau)$) are a valid preimage for the same $y_j$, then $x^*_j$ must equal $x_j$.}. Since $\mathcal{K}'_i(\tau)$ samples $x^*_j$ uniformly, then $x^*_j = x_j$ with probability at least $1/t$. Therefore, the following must holds: 
\begin{equation}\label[Inequality]{eq:bound:K'i}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}'_i(\tau)] \ge \frac{1}{t}\cdot \Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}_i(\tau)].
\end{equation}

\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure07.pdf}
         }
         \caption{}
         \label{figure:one-sided:K'i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure08.pdf}
         }
         \caption{}
         \label{figure:one-sided:K''i}
     \end{subfigure}
     \caption{Machines $\mathcal{K}'_i(\tau)$ and $\mathcal{K}''_i(\tau)$ \scriptsize{(Changes between adjacent machines are highlighted by red color)}}
     \label{figure:one-sided:K'i-K''i}
\end{figure}

\para{Machine $\mathcal{K}''_i$ ($i\in [\tilde{t}]$):} (Illustrated in \Cref{figure:one-sided:K''i}.) On any input $\tau$,  $\mathcal{K}''_i(\tau)$ behaves identically to $\mathcal{K}'_i(\tau)$ except that it plays as the honest committer in the left {\bf WIPoK-1}, instead of running the witness-extended emulator. Recall that starting from $\mathcal{K}'_i$, the witness $(j, x_j)$ extracted by the witness-extended emulator for the left {\bf WIPoK-1} is not used any more. Thus, machine $\mathcal{K}''_i$ does not need to perform this witness-extended emulation.

By the witness-extended emulation property (as per \Cref{def:WEE}) of the left {\bf WIPoK-1}, it is easy to see that 
\begin{equation}\label[Inequality]{eq:relation:K'-K''}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_i(\tau)] \ge \Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}'_i(\tau)] -\mathsf{negl}(\lambda).
\end{equation}
Moreover, by the WI property of the right {\bf WIPoK-1}, the following must hold
\begin{equation}\label[Inequality]{eq:relation:K:WI}
\forall i \in [\tilde{t}], ~\big|\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_i(\tau)] - \Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_1(\tau)]\big|  \le \mathsf{negl}(\lambda).
\end{equation}

\begin{MyClaim}\label{claim:bound:K''1}
$\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_1(\tau)] \ge \frac{1}{t} \cdot \big(p_\tau - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda)$.
\end{MyClaim}
\begin{proof} 
This claim following from \Cref{cliam:bound:Ki-xi} and \Cref{eq:bound:K'i,eq:relation:K'-K'',eq:relation:K:WI}. Formally,
\begin{align}
\forall i \in [\tilde{t}], ~\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_1(\tau)] 
 & \ge \Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}''_i(\tau)]  - \mathsf{negl}(\lambda)
\label[Inequality]{claim:bound:K''1:proof:1}\\
 & \ge 
\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}'_i(\tau)]  - \mathsf{negl}(\lambda) 
\label[Inequality]{claim:bound:K''1:proof:2}\\
 & \ge 
\frac{1}{t}\cdot\Pr[\msf{Val} = \tilde{x}_i:\msf{Val} \gets \mathcal{K}_i(\tau)]  - \mathsf{negl}(\lambda) 
\label[Inequality]{claim:bound:K''1:proof:3}\\
& \ge 
\frac{1}{t} \cdot \big(p_\tau - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda), \label[Inequality]{claim:bound:K''1:proof:4}
\end{align}
where \Cref{claim:bound:K''1:proof:1} follows from \Cref{eq:relation:K:WI}, \Cref{claim:bound:K''1:proof:2} follows from \Cref{eq:relation:K'-K''}, \Cref{claim:bound:K''1:proof:3} follows from \Cref{eq:bound:K'i}, and \Cref{claim:bound:K''1:proof:4} follows from \Cref{cliam:bound:Ki-xi}.
\end{proof}

Now, we show the last claim which, together with \Cref{claim:bound:K''1}, will lead to the desired contradiction.
\begin{MyClaim}\label{claim:K'':non-abort}
$\Pr[\msf{Val} \ne \bot:\msf{Val} \gets \mathcal{K}''_1(\tau)] \le p_\tau + \mathsf{negl}(\lambda)$.
\end{MyClaim}

\para{Deriving the contradiction.} Before proving \Cref{claim:K'':non-abort}, we first show why \Cref{claim:bound:K''1,claim:K'':non-abort} are contradicting. In the following, all the probabilities are taken over the random procedure $\msf{Val} \gets \mathcal{K}''_1(\tau)$:
\begin{align*}
\Pr[\msf{Val} \ne \bot] 
& = \Pr[\msf{Val} = \tilde{m}(\tau) ~\vee~ \msf{Val} = \tilde{x}_1 ~\vee~ \ldots ~\vee~ \msf{Val} = \tilde{x}_{\tilde{t}}] \\
& \ge \Pr[\msf{Val} = \tilde{x}_1 ~\vee~ \ldots ~\vee~ \msf{Val} = \tilde{x}_{\tilde{t}}] = \sum_{i =1 }^{\tilde{t}} \Pr[\msf{Val} = \tilde{x}_i] \\
&\ge \tilde{t} \cdot \frac{1}{t} \cdot \big(p_\tau - \epsilon'(\lambda)\big) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:1}\\
& \ge (1+\frac{1}{t}) \cdot (p_\tau - \epsilon'(\lambda)) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:2}\\
& = p_\tau + \bigg(\frac{p_\tau}{t} - \epsilon'(\lambda) - \frac{\epsilon'(\lambda)}{t}\bigg) - \mathsf{negl}(\lambda)\\
& \ge p_\tau + \frac{t^2 - t -1}{t^3}\cdot \epsilon(\lambda) - \mathsf{negl}(\lambda) \numberthis \label[Inequality]{eq:bound:Ki:final-contradiction:3}\\
\end{align*}
where \Cref{eq:bound:Ki:final-contradiction:1} follows from \Cref{claim:bound:K''1}, \Cref{eq:bound:Ki:final-contradiction:2} follows from the assumption that $\tilde{t} \ge t+1$, and \Cref{eq:bound:Ki:final-contradiction:3} follows from the assumption that $p_\tau \ge \epsilon(\lambda)$ and our parameter setting $\epsilon'(\lambda) = \frac{\epsilon(\lambda)}{t^2}$.

Recall that $t$ is the tag taking value from $[2n]$ where $n$ is a polynomial of $\lambda$. Also recall that $\epsilon(\lambda)$ is an inverse polynomial on $\lambda$. Therefore, \Cref{eq:bound:Ki:final-contradiction:2} can be written as:
$$\Pr[\msf{Val} \ne \bot:\msf{Val} \gets \mathcal{K}''_1(\tau)] \ge p_\tau + \frac{1}{\mathsf{poly}(\lambda)} - \mathsf{negl}(\lambda),$$
which contradicts \Cref{claim:K'':non-abort}.

This eventually finishes the proof of \Cref{lem:bound:Ki} (modulo the proof of \Cref{claim:K'':non-abort} which we will show next).



\begin{proof}[Proof of {\Cref{claim:K'':non-abort}}]
We first define two extra machines $\mathcal{K}^{**}_1$ and $\mathcal{K}^*_1$. 

\para{Machine $\mathcal{K}^{**}_1$:} (Illustrated in \Cref{figure:one-sided:K**i}.) On any input $\tau$, $\mathcal{K}^{**}_1(\tau)$ behaves identically as $\mathcal{K}''_1(\tau)$ except that $\mathcal{K}^{**}_1(\tau)$ finishes the right {\bf WIPoK-2} using the honest receiver's algorithm, instead of using the witness-extended emulator. $\mathcal{K}^{**}_1(\tau)$ simply outputs the view of $\mathcal{M}$ during the execution. By the witness-extended emulation property (as per \Cref{def:WEE}), it holds that
\begin{equation}\label{eq:K''1-K**1}
\Pr[\msf{Val} \ne \bot :\msf{Val}\gets \mathcal{K}''_1(\tau)] = \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{**}_1(\tau)] \pm \mathsf{negl}(\lambda).
\end{equation}


\para{Machine $\mathcal{K}^{*}_1$:} (Illustrated in \Cref{figure:one-sided:K*i}.) On any input $\tau$, $\mathcal{K}^{*}_1(\tau)$ behaves identically as $\mathcal{K}^{**}_1(\tau)$ except for the witness used in the left {\bf WIPoK-2}: $\mathcal{K}^{*}_1(\tau)$ use the $(m, r)$ used to generated $\mathsf{com} = \mathsf{Com}_\rho(m;r)$ as the witness to finish the left {\bf WIPoK-2}. (Note that this witness pair $(m,r)$ must be contained in $\tau$---because $\tau$ is corresponding to the first steps of the man-in-the-middle execution, and the left execution is done by the honest committer.) It is worth noting that machine $\mathcal{K}^*_1$ is actually identical to the machine $\mathcal{G}_1$ we defined on \Cpageref{machine:Gi}. Therefore, it follows immediately that
\begin{equation}\label{eq:K*1-G1}
\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{*}_1(\tau)] = \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{G}_1(\tau)] = p_\tau, 
\end{equation}
where the last equivalence follows by definition (see \Cref{def:p-tau:2}).

\begin{figure}[!tb]
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure09.pdf}
         }
         \caption{}
         \label{figure:one-sided:K**i}
     \end{subfigure}
     \hspace{6.5pt}
     \begin{subfigure}[t]{0.47\textwidth}
         \centering
         \fbox{
         \includegraphics[width=\textwidth]{figures/figure10.pdf}
         }
         \caption{}
         \label{figure:one-sided:K*i}
     \end{subfigure}
     \caption{Machines $\mathcal{K}^{**}_1(\tau)$ and $\mathcal{K}^*_1(\tau)$ \scriptsize{(Changes between adjacent machines are highlighted by red color)}}
     \label{figure:one-sided:K**1-K*1}
\end{figure}

Next, let us recall the witness used by $\mathcal{K}^{**}_1$ for the left {\bf WIPoK-2}. By definition, machine $\mathcal{K}^{**}_1(\tau)$ performs brute-force to extract $(x_1, \ldots, x_t)$ from $\tau$,\footnote{This brute-forcing was there starting from $\mathcal{K}'_1$ (defined on \Cpageref{machineK':description}), and was inherited by $\mathcal{K}''_1$, $\mathcal{K}^{**}_1$, and eventually by $\mathcal{K}^{*}_1$.} and samples a random {\em good}\footnote{Recall from \Cref{item:machineK':3}
 of $\mathcal{K}'_i(\tau)$ (\Cpageref{machineK':description}) that ``good'' means that $x^*_j$ is a valid pre-image of $y_j$.} $x^*_j$ as the witness to go through the left {\bf WIPoK-2}. In summary, the only difference between $\mathcal{K}^{*}_1$ and $\mathcal{K}^{**}_1$ is the witness used in the left {\bf WIPoK-2}. Also, note that neither $\mathcal{K}^{*}_1$ nor $\mathcal{K}^{**}_1$ rewinds the {\bf WIPoK-2} because we already get rid of the witness-extended emulation starting from $\mathcal{K}^{**}_1$. Therefore, 
by the WI property of the left {\bf WIPoK-2}, it holds that
\begin{equation}\label{eq:K**1-K*1}
\Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{**}_1(\tau)] = \Pr[\ensuremath{\mathsf{View}}\xspace~\text{is accepting}:\ensuremath{\mathsf{View}}\xspace\gets \mathcal{K}^{*}_1(\tau)] \pm \mathsf{negl}(\lambda).
\end{equation}
Combining \Cref{eq:K''1-K**1,eq:K*1-G1,eq:K**1-K*1}, we have
$$\Pr[\msf{Val} \ne \bot :\msf{Val}\gets \mathcal{K}''_1(\tau)] = p_\tau \pm \mathsf{negl}(\lambda).$$
This in particular implies \Cref{claim:K'':non-abort}.
\end{proof}