General Setting and Views Sample Clauses

General Setting and Views. $ $ Let p ←—$ iperm(τ, n), k ←— {0, 1}2n × H2, and p ,p ←— perm(n). Consider any k ˜ distinguisher Ð whose goal is to distinguish GCLh1 ,h1 ⊕h2 ,h2 from p. E As a first step, we replace (Ek , Ek ) by (p1, p−1) at the cost of 2Advsprp(Ð′), 0 У ˜ Ð Ð Ð where ′ is some distinguisher with the same query complexity q as . (Note that we replaced Ek2 by the inverse of p2 for simplicity of further analysis.) Denote the resulting scheme with F for brevity; it remains to bound the advantage of in distinguishing = F (the real world) from = p (the ideal world). As of now, we give the distinguisher unbounded computational power, and its complexity will only be measured by the number of oracle queries it makes. Without loss of generality, we can consider it to be deterministic, and will apply the H-coefficient technique of Lemma 1. { } Ð Ð makes q construction queries which are recorded in view ν′ = (t1, m1, c1),..., (tq, mq, cq) . After ’s interaction with its oracle, but before it outputs its decision bit, its oracle will reveal the subkeys h1, h2. In the real world, these are the XOR universal hash functions used in F , whereas in the ideal world these are dummy functions randomly drawn from H. We denote the complete view by