I'm currently reading this paper [PDF]. On page 4, I bumped into these notations :

\begin{equation} \text { Experiment } \operatorname{Exp}_{\mathcal{F} \mathcal{E}, A}^{\text {ind-mode }}(k) \text { : } \end{equation}

\begin{equation} A_{1}^{\mathrm{KDer}\left(s k_{i}\right)}(p k) \end{equation}

I tried searching online and resolved most of the other notations involved, like the $ \stackrel{\\\$}{\leftarrow}$, but no one provided a link to a source for resolving similar problems. I couldn't resolve any of these. This is the definition where these notations belong to. For more information you can refer to the paper itself.

\begin{array}{l} \text { Experiment } \operatorname{Exp}_{\mathcal{F} \mathcal{E}, A}^{\text {ind-mode }}(k): \\ b \stackrel{\\\$}{\leftarrow}\{0,1\} \\ (p k, s k) \\\$ \operatorname{Setup}\left(1^{k}\right) \\ \left(m_{0}, m_{1}, s t\right) \stackrel{\\\$}{\leftarrow} A_{1}^{\mathrm{KDer}(s k, \cdot)}(p k) \\ c \leftarrow{E n c}\left(p k, m_{b}\right) \\ b^{\prime} \stackrel{\\\$}{\leftarrow} A_{2}^{\mathcal{O}(s k, \cdot)}(p k, c, s t) \\ \text { If } b=b^{\prime} \text { return } 1 \text { else return } 0 \end{array}

  • $\begingroup$ No. I was referring to the subscript and superscript notation in $A$ and $Exp$ $\endgroup$
    – tur11ng
    Oct 7, 2021 at 20:40

1 Answer 1


$\textrm{Exp}^{\textrm{ind-mode}}_{\mathcal{FE},A}$ is just the name given to the interaction. The "exponent" $\textrm{ind-mode}$ is part of that name. There is not really a standard, universal way of giving names to these kinds of games. But usually the author has to specify: what game is it? what scheme is being attacked? what is the attacker? and maybe other parameters too. Since there is a lot of information to include, we often use both subscripts and superscripts to include it.

$A^{\textrm{KDer}(sk,\cdot)}(pk)$ is referring to an adversary program $A$. The adversary is given $pk$ as its input. It is also given oracle access to $\textrm{KDer}(sk,\cdot)$. Oracle access means: at any time, $A$ can ask a question $x$ and receive the answer $\textrm{KDer}(sk,x)$. It can ask many such questions. Writing an oracle as a superscript is very standard in cryptography and other areas of computer science (especially computational complexity).

From what I can tell, the convention of writing an oracle as a superscript is from as far back as a 1954 paper by Kleene & Post.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.