\documentclass[letterpaper,11pt]{article}
\input{latexdefs}

\begin{document}
\makeheader{Attacks and Reductions in Cryptography}

\noindent In this short note, we give several examples of proofs involving
PRGs and PRFs.

\paragraph{PRG security.} Let's begin by reviewing the PRG security game:
\begin{framed}
\noindent The PRG security game is played between an adversary $\calA$ and a challenger.
Let $G \colon \zo^\lambda \to \zo^n$ be a candidate PRG. The game is parameterized
by a bit $b \in \zo$:
\begin{enumerate}[noitemsep]
\item If $b = 0$, the challenger samples a seed $s \getsr \zo^\lambda$ and computes
$t \gets G(s)$. If $b = 1$, the challenger samples a random string $t \getsr \zo^n$.

\item The challenger gives $t$ to $\calA$.

\item At the end of the game, $\calA$ outputs a bit $b' \in \zo$.
\end{enumerate}
\vspace{-1em}
\end{framed}

\noindent For an adversary $\calA$, we define its PRG distinguishing
advantage $\PRGAdv[\calA, G]$ to be the quantity
\[ \PRGAdv[\calA, G] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]}. \]
Finally, we say that a a PRG $G$ is secure if for all efficient adversaries $\calA$,
\[ \PRGAdv[\calA, G] = \negl(\lambda). \]
We will often refer to this game (also called an ``experiment'')  where $b = 0$ as
$\ms{PRGExp}_0[\calA, G]$ and the game where $b = 1$ as
$\ms{PRGExp}_1[\calA, G]$. In this case, we can also
write
\[ \PRGAdv[\calA, G] = \abs{\Pr\left[\text{$\calA$ outputs $1$ 
                                in $\ms{PRGExp}_0[\calA, G]$}\right] - 
                            \Pr\left[\text{$\calA$ outputs $1$ 
                                in $\ms{PRGExp}_1[\calA, G]$}\right]}. \]

\begin{example}[An Insecure PRG]
  Suppose $G \colon \zo^\lambda \to \zo^n$ is a secure PRG and define
  $G' \colon \zo^{\lambda} \to \zo^{n + \lambda}$ to be
  $G'(s) = G(s) \| s$. We show that $G'$ is not a secure PRG.
\end{example}
\begin{proof}
  We construct an adversary $\calA$ for $G'$ as follows:
  \begin{framed} \vspace{-1em}
  \begin{enumerate}[noitemsep]
    \item On input $t \in \zo^{n + \lambda}$, $\calA$ parses the input
    as $t = t_1 \| t_2$ where $t_1 \in \zo^n$ and $t_2 \in \zo^\lambda$.

    \item Output $1$ if $G(t_2) = t_1$ and $0$ otherwise.
  \end{enumerate} \vspace{-1em}
  \end{framed}
  \noindent By construction, algorithm $\calA$ is efficient (i.e.,
  runs in polynomial time). We compute $\calA$'s distinguishing advantage:
  \begin{itemize}
    \item Suppose $b = 0$. In this case, $t \gets G'(s)$ where $s \getsr \zo^\lambda$.
    By construction of $G'$, $t = t_1 \| t_2$ where $G(t_2) = t_1$. In this case,
    the adversary outputs $1$ with probability $1$.

    \item Suppose $b = 1$. In this case, $t \getsr \zo^{n + \lambda}$.
    In particular, $t_1$ and $t_2$ are independently uniform,
    so $\Pr[t_1 = G'(t_2)] = 1/2^n$.
  \end{itemize}
  The distinguishing advantage of $\calA$ is then
  \[ \PRGAdv[\calA, G'] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = 1 - 2^{-n}, \]
  which is non-negligible.
\end{proof}


\begin{example}[A Secure PRG]
  Suppose $G \colon \zo^\lambda \to \zo^n$ is a secure PRG and define the
  function $G' \colon \zo^\lambda \to \zo^n$ to be the function
  $G'(s) = G(s) \oplus 1^n$. Namely, $G'$ simply flips the output bits of $G$.
  We show that if $G$ is secure, then $G'$ is also secure.
\end{example}
\begin{proof}
  When proving statements of this form, we will prove the contrapositive:
  \begin{framed}
  \centering
  \emph{If $G'$ is not a secure PRG, then $G$ is not a secure PRG.}
  \end{framed}
  \noindent To prove the contrapositive, we begin by assuming that $G'$ is not a secure PRG.
  This means that there exists an efficient adversary $\calA$ that breaks the
  security of $G'$ with non-negligible advantage $\varepsilon$ (i.e.,
  $\PRGAdv[\calA, G'] = \varepsilon$). We use $\calA$ to construct an efficient
  adversary $\calB$ that breaks the security of $G$:\footnote{In the following description,
  we provide some clarifying remarks in {\color{green!60!black} green}. These remarks
  are unnecessary in a formal proof.}
  \begin{framed} \vspace{-1.5em}
  \begin{enumerate}[noitemsep]
    \item At the beginning of the game, algorithm $\calB$ receives a challenge
    $t \getsr \zo^n$ from the challenger. {\color{green!60!black} We are constructing
    an adversary for the PRG security game for $G$. This game begins with the challenger
    sending a challenge $t \in \zo^n$ to the adversary where either $t \gets G(s)$
    or $t \getsr \zo^n$.}

    \item Algorithm $\calB$ starts running algorithm $\calA$.
    {\color{green!60!black} Essentially, we are constructing a reduction here. Our goal
    is to reduce the problem of distinguishing $G$ to the problem of distinguishing
    $G'$. To do this, we will rely on our adversary $\calA$ for distinguishing $G'$.}

    \item Algorithm $\calB$ sends $t \oplus 1^n$ to $\calA$ and outputs whatever
    $\calA$ outputs. {\color{green!60!black} Algorithm $\calA$ is an adversary for $G'$, so
    it expects a single input $t \in \zo^n$ where either $t \gets G'(s)$ or $t \getsr \zo^n$.
    Note that this is the only setting for which we have guarantees on the behavior of $\calA$.
    The behavior of algorithm $\calA$ on a string drawn from some other distribution is
    {\em undefined}. As part of our analysis, we need to argue that $\calB$ correctly
    {\em simulates} the view of $\calA$ in the PRG distinguishing game against $G'$.}
  \end{enumerate} \vspace{-1.5em}
  \end{framed}
  \noindent First, if $\calA$ is efficient, then $\calB$ is also efficient (by construction). It
  suffices to compute the distinguishing advantage of algorithm $\calB$. We consider
  two cases:
  \begin{itemize}
    \item Suppose $b = 0$. Then, $\calB$ receives a string $t \gets G(s)$
    where $s \getsr \zo^\lambda$. In this case, $t \oplus 1^n$ is precisely the value
    of $G'(s)$. Namely, $\calB$ has simulated $\ms{PRGExp}_0[\calA, G']$ for $\calA$.
    Since $\calA$ is a distinguisher for $G'$, this means that
    \[ \Pr\left[\calB \text{ outputs } 1 \mid b = 0\right] = 
       \Pr\left[\text{$\calA$ outputs $1$ in $\ms{PRGExp}_0[\calA, G']$}\right]. \]

    \item Suppose $b = 1$. Then, $\calB$ receives a random string $t \getsr \zo^n$.
    Since $t$ is uniformly random over $\zo^n$, the string $t \oplus 1^n$ is also uniformly
    random over $\zo^n$. This means that $\calB$ has simulated $\ms{PRGExp}_1[\calA, G']$
    for $\calA$. This means that
    \[ \Pr\left[\calB \text{ outputs } 1 \mid b = 1\right] =
       \Pr\left[\text{$\calA$ outputs $1$ in $\ms{PRGExp}_1[\calA, G']$}\right]. \]
  \end{itemize}
  We conclude now that the distinguishing advantage of $\calB$ is exactly
  \begin{align*}
    \PRGAdv[\calB, G] &= 
      \abs{\Pr\left[\calB \text{ outputs } 1 \mid b = 0\right] -
        \Pr\left[\calB \text{ outputs } 1 \mid b = 1\right]} \\
      &= \abs{\Pr\left[\text{$\calA$ outputs $1$ in $\ms{PRGExp}_0[\calA, G']$}\right] -
              \Pr\left[\text{$\calA$ outputs $1$ in $\ms{PRGExp}_1[\calA, G']$}\right]} \\
      &= \PRGAdv[\calA, G'] = \varepsilon,
  \end{align*}
  which is non-negligible by assumption.
\end{proof}

\paragraph{PRF security game.} Next, we
review the definition of a secure PRF. Let $F \colon \calK \times \calX \to \calY$ be
a function with key-space $\calK$, domain $\calX$, and range $\calY$. The PRF
security game is defined as follows:

\begin{framed}
\noindent The PRF security game is played between an adversary $\calA$ and a challenger.
Let $F \colon \calK \times \calX \to \calY$ be a candidate PRF. The game is
parameterized by a bit $b \in \zo$:
\begin{enumerate}[noitemsep]
\item If $b = 0$, then the challenger samples a key $k \getsr \calK$ and
sets $f \gets F(k, \cdot)$. If $b = 1$, the challenger samples a uniformly
random function $f \getsr \mr{Funs}[\calX, \calY]$.

\item The adversary chooses $x \in \calX$ and sends $x$ to the challenger.

\item The challenger replies with $f(x)$.

\item The adversary can continue to make queries to the adversary (repeating steps 2 and 3).
At the end of the game, adversary outputs a bit $b' \in \zo$.
\end{enumerate}
\end{framed}

\noindent For an adversary $\calA$, we define the PRF distinguishing
advantage $\PRFAdv[\calA, F]$ to be the quantity
\[ \PRFAdv[\calA, F] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]}. \]
We say that a PRF $F$ is secure if for all efficient adversaries $\calA$,
\[ \PRFAdv[\calA, F] = \negl(\lambda), \]
where $\lambda$ is a security parameter (typically, the keys of the PRF are $\poly(\lambda$)
bits long: $\log \abs{\calK} = \poly(\lambda)$).
Similar to the case with PRGs, we will often refer to the game (or ``experiment'') where
$b = 0$ as $\ms{PRFExp}_0[\calA, F]$ and the game where
$b = 1$ as $\ms{PRFExp}_1[\calA, F]$. In this case,
we can write
\[ \PRFAdv[\calA, F] = \abs{\Pr\left[\text{$\calA$ outputs $1$ 
                              in $\ms{PRFExp}_0[\calA, F]$}\right] - 
                            \Pr\left[\text{$\calA$ outputs $1$ 
                              in $\ms{PRFExp}_1[\calA, F]$}\right]}. \]

\begin{example}[An Insecure PRF]
Suppose $F \colon \zo^n \times \zo^n \to \zo^n$ is a secure PRF and define
$F' \colon \zo^n \times \zo^n \to \zo^n$ to be $F'(k,x) = F(k,x) \oplus F(k,x \oplus 1^n)$.
We claim that $F'$ is not a secure PRF.
\end{example}
\begin{proof}
We construct an adversary $\calA$ for $F'$ as follows:

\begin{framed} \vspace{-1em}
\begin{enumerate}[noitemsep]
\item Submit the query $x_1 = 0^n$ to the challenger. The challenger replies with
a value $y_1$.
\item Submit the query $x_2 = 1^n$ to the challenger. The challenger replies with
a value $y_2$.
\item Output $1$ if $y_1 = y_2$ and $0$ otherwise.
\end{enumerate} \vspace{-1em}
\end{framed}
\noindent By construction, $\calA$ is efficient (i.e., runs in polynomial time). We compute
$\calA$'s distinguishing advantage:
\begin{itemize}
  \item Suppose $b = 0$. In this case, the challenger samples $k \getsr \zo^n$
  and replies with
  \begin{align*}
    y_1 &= F'(k, x_1) = F(k, x_1) \oplus F(k, x_1 \oplus 1^n) = F(k, 0^n) \oplus F(k, 1^n) \\
    y_2 &= F'(k, x_2) = F(k, x_2) \oplus F(k, x_2 \oplus 1^n) = F(k, 1^n) \oplus F(k, 0^n).
  \end{align*}
  In this case $y_1 = y_2$, and $\calA$ outputs $1$ with probability $1$.

  \item Suppose $b = 1$. In this case, the challenger samples
  $f \getsr \ms{Funs}[\zo^n, \zo^n]$ and replies with $y_1 = f(x_1)$ and $y_2 = f(x_2)$.
  Since $x_1 \ne x_2$, $y_1$ and $y_2$ are independent and uniformly random.
  Thus, $\Pr[y_1 = y_2] = 1/2^n$.
\end{itemize}
The distinguishing advantage of $\calA$ is then
\[ \PRFAdv[\calA, F'] = \abs{\Pr[b' = 1 \mid b = 0] - \Pr[b' = 1 \mid b = 1]} = 1 - 2^{-n}, \]
which is non-negligible.
\end{proof}

\begin{example}[A Secure PRF]
Suppose $F \colon \calK \times \calX \to \zo^n$ is a secure PRF. Then, the function
$F' \colon \calK^2 \times \calX \to \zo^n$ where
$F'((k_1,k_2),x) = F(k_1,x) \oplus F(k_2,x)$ is also a secure PRF.
\end{example}
\begin{proof}
Similar to the case with PRGs, we will prove the contrapositive:
\begin{framed}
\centering
\emph{If $F'$ is not a secure PRF, then $F$ is not a secure PRF.}
\end{framed}
\noindent To prove the contrapositive, we begin by assuming that $F'$ is not a secure PRF.
This means that there exists an efficient adversary $\calA$ that breaks the security of
$F'$ with non-negligible advantage $\varepsilon$ (i.e.,
$\PRFAdv[\calA, F'] = \varepsilon$). We use $\calA$ to construct an adversary
$\calB$ that breaks the security of $F$:
\begin{framed} \vspace{-1em}
\begin{enumerate}[noitemsep]
\item Choose a key $k_2 \getsr \calK$.
\item Start running the adversary $\calA$ for $F'$.
\begin{enumerate}
\item Whenever $\calA$ makes a query $x_i \in \calX$,
  forward the query to the challenger to obtain
a value $y_i \in \zo^n$. Give $y_i \oplus F(k_2, x_i)$ to $\calA$.
\end{enumerate}
\item Output whatever $\calA$ outputs.
\end{enumerate} \vspace{-1em}
\end{framed}
\noindent Observe that the number of queries $\calB$ makes is the same as the number of queries
that $\calA$ makes. Thus, if $\calA$ is efficient, then $\calB$ is also efficient.
It suffices to compute the distinguishing advantage of algorithm $\calB$.
We consider two cases:
\begin{itemize}
  \item Suppose $b = 0$. In this case, the challenger in $\ms{PRFExp}_0[\calB, F]$
  samples a key $k \getsr \calK$ and replies with $y_i \gets F(k, x_i)$ on each query.
  Algorithm $\calB$ in turns replies to $\calA$ with the value
  \[ y_i \oplus F(k_2, x_i) = F(k, x_i) \oplus F(k_2, x_i) = F'((k, k_2), x_i). \]
  Since $k$ and $k_2$ are both sampled uniformly and independently from $\calK$,
  algorithm $\calB$
  answers all of $\calA$'s queries according to the specification of
  $\ms{PRFExp}_0[\calA, F']$. Thus,
  \[ \Pr\left[\calB \text{ outputs } 1 \mid b = 0\right] = 
     \Pr\left[\text{$\calA$ outputs $1$ in $\ms{PRFExp}_0[\calA, F']$}\right]. \]

  \item Suppose $b = 1$. In this case, the challenger in $\ms{PRFExp}_1[\calB, F]$
  samples $f \getsr \ms{Funs}[\calX, \zo^n]$ and replies with
  $y_i \gets f(x_i)$ on each query. Algorithm $\calB$ in turn replies to $\calA$
  with the value $y_i \oplus F(k_2, x_i) = f(x_i) \oplus F(k_2, x_i)$. Since $k_2$
  is independent of $f$, and $f$ is a random function,
  the value of $f(x_i) \oplus F(k_2, x_i)$ is uniform and independently
  random over $\zo^n$. Thus, algorithm $\calB$ answers all of $\calA$'s queries according
  to the specification of $\ms{PRFExp}_1[\calA, F']$, and so
  \[ \Pr\left[\calB \text{ outputs } 1 \mid b = 1\right] = 
     \Pr\left[\text{$\calA$ outputs $1$ in $\ms{PRFExp}_1[\calA, F']$}\right]. \]
\end{itemize}
By definition, the distinguishing advantage of $\calB$ is then
\[ \PRFAdv[\calB, F] = \abs{\Pr\left[\text{$\calB$ outputs $1 \mid b = 0$}\right] - 
                            \Pr\left[\text{$\calB$ outputs $1 \mid b = 1$}\right]}
                     = \PRFAdv[\calA, F'] = \varepsilon, \]
which is non-negligible by assumption.
\end{proof}

\end{document}
