@article {15123,
	title = {Handling expected polynomial-time strategies in simulation-based security proofs},
	journal = {Journal of Cryptology},
	volume = {21},
	year = {2008},
	month = {2008///},
	pages = {303 - 349},
	abstract = {The standard class of adversaries considered in cryptography is that of strict polynomial-time probabilistic machines. However, expected polynomial-time machines are often also considered. For example, there are many zero-knowledge protocols for which the only known simulation techniques run in expected (and not strict) polynomial time. In addition, it has been shown that expected polynomial-time simulation is essential for achieving constant-round black-box zero-knowledge protocols. This reliance on expected polynomial-time simulation introduces a number of conceptual and technical difficulties. In this paper, we develop techniques for dealing with expected polynomial-time adversaries in simulation-based security proofs.},
	doi = {10.1007/s00145-007-9004-8},
	author = {Katz, Jonathan and Lindell,Y.}
}
