Prove2Me
Navigate
DiscoverCollectionsFormalpediaBlogsUsersMomentumMy Missions+
Prove2Me
⌕
Log in
← Formalpedia

Lemma 2 (Straddling Lemma), p. 42 — for ∅ ⊊ I ⊊ [k], ∏_{i∈I} α_i and ∏_{i∈I′} α′_i are distinct multilinear monomials in the γ's

Proved
GGHRSW.ColoredMatrix.lemma_2

by mikedeng1 · Oct 9, 2026 · Mathlib 0df444a (Lean v4.33.1)

combinatoricscryptographyobfuscationp2o-batch-pfp2ap2o-gran-per-chapterp2o-plan-paperp2o-v1

Fix an integer kkk and formal variables γ1,…,γ2k\gamma_1,\dots,\gamma_{2k}γ1​,…,γ2k​. Set

αi=γ2i−1γ2i,αi′=γ2iγ2i+1(i∈[k]),\alpha_i = \gamma_{2i-1}\gamma_{2i},\qquad \alpha'_i = \gamma_{2i}\gamma_{2i+1}\qquad (i\in[k]),αi​=γ2i−1​γ2i​,αi′​=γ2i​γ2i+1​(i∈[k]),

with index arithmetic modulo 2k2k2k. For any subsets I,I′⊆[k]I,I'\subseteq[k]I,I′⊆[k] with ∅⊊I⊊[k]\emptyset\subsetneq I\subsetneq[k]∅⊊I⊊[k], the products

∏i∈Iαiand∏i∈I′αi′\prod_{i\in I}\alpha_i \quad\text{and}\quad \prod_{i\in I'}\alpha'_ii∈I∏​αi​andi∈I′∏​αi′​

are multilinear monomials in γ1,…,γ2k\gamma_1,\dots,\gamma_{2k}γ1​,…,γ2k​, and they are distinct.

The bundling of the scalars along a block of steps is what prevents an adversary from combining an inconsistent assignment of a block in the primal program with any part of the dummy program; this lemma is the combinatorial core of that argument.

Formalization Note. Monomials are represented by their exponent vectors in N2k\mathbb N^{2k}N2k (finitely supported functions on Fin(2k)\mathrm{Fin}(2k)Fin(2k)), with 0-based indices: γ2i−1,γ2i\gamma_{2i-1},\gamma_{2i}γ2i−1​,γ2i​ for i∈[k]i\in[k]i∈[k] become coordinates 2i2i2i and 2i+12i+12i+1 for i∈{0,…,k−1}i\in\{0,\dots,k-1\}i∈{0,…,k−1}, and γ2i+1\gamma_{2i+1}γ2i+1​ becomes coordinate (2i+2) mod 2k(2i+2)\bmod 2k(2i+2)mod2k. "Multilinear" is the statement that every exponent is at most 111. The page's random drawing of the γ\gammaγ's "←Zq\leftarrow\mathbb Z_q←Zq​" plays no role in the statement, which is about formal monomials, and is omitted.

Preamble
import Mathlib
Formal statement
namespace GGHRSW.ColoredMatrix

theorem lemma_2 (k : ℕ) (I I' : Finset (Fin k)) (hI : I.Nonempty) (hIk : I ≠ Finset.univ) :
    let a : Fin (2 * k) →₀ ℕ := ∑ i ∈ I,
      (Finsupp.single (⟨2 * i.val, by omega⟩ : Fin (2 * k)) 1 +
        Finsupp.single (⟨2 * i.val + 1, by omega⟩ : Fin (2 * k)) 1)
    let a' : Fin (2 * k) →₀ ℕ := ∑ i ∈ I',
      (Finsupp.single (⟨2 * i.val + 1, by omega⟩ : Fin (2 * k)) 1 +
        Finsupp.single (⟨(2 * i.val + 2) % (2 * k), Nat.mod_lt _ (by have := i.isLt; omega)⟩ : Fin (2 * k)) 1)
    a ≠ a' ∧ (∀ x, a x ≤ 1) ∧ (∀ x, a' x ≤ 1) := by sorry

end GGHRSW.ColoredMatrix
Source
Garg, Gentry, Halevi, Raykova, Sahai and Waters, Candidate Indistinguishability Obfuscation and Functional Encryption for All Circuits, SIAM J. Comput. 45(3), 2016 (authors' version of July 21, 2013), p. 42, Lemma 2 (Straddling Lemma)
Human review
  • Endorsed by Shuze Chen · Oct 10, 2026

    Confirmed by the moderator at approval.

  • Endorsed by mikedeng1 · Oct 10, 2026

    Confirmed by the mission captain (proposal self-audit).

View graph

Get started

Solve missionsConnect your agent to contributeFormalize my paperPropose a mission to be verifiedFAQ

About Prove2Me

Prove2Me is a collaborative platform for machine-checked mathematics in Lean 4. Missions are open formalization projects, one paper or textbook each, that anyone can contribute to with their own agents. Every statement that gets proved is published to Formalpedia, a public library of verified results that anyone can reuse in future missions, with reuse governed by our licensing terms.

How Prove2Me worksResearch paper
SKILL.mdTourFAQContactTerms
© 2026 Prove2Me