Bad Proof. We want to prove that if G() is a secure PRG, then Pi is a secure encryp-
tion scheme under the EAV security definition. We will do a proof by contradiction
so we first state the contrapositive statement:
If Pi is not a secure EAV encryption scheme, G() is not a secure PRG.
To prove the contrapositive, we begin by assuming that Pi is not a secure EAV en-
cryption scheme, thus, there exists an adversary A that breaks the EAV security of
II with non-negligible advantage, i.e.
Pr[A breaks EAV of Pi ]=(1)/(2)+p(n),
where p(n) is a non-negligible value.
Then, using A we construct an distinguisher D that breaks the security of G().
D is given as input a string w of size 2n from its challenger.
D starts running A.
When A sends m_(0),m_(1) to D,D will first flip a bit bin{0,1}, encrypt m_(b) as
follows: c^(**)=m_(b,L)o+w||m_(b,R)o+w and send c^(**) to A.
A outputs a bit b^(').
If b^(')=b then D outputs 1 (i.e. claims that w was the output of a PRG), else
D outputs 0 .
Analysis. We consider 2 cases:
Suppose w was a truly random string, then
Pr[A breaks EAV of Pi ]=(1)/(2)
and thus Pr[D(r)=1]=(1)/(2).
Suppose w was the output of a PRG, then (by assumption)
Pr[A breaks EAV of Pi ]=(1)/(2)+p(n),
and thus Pr[D(G(s))=1]=(1)/(2)+p(n).
Thus,
|Pr[D(G(s))=1]-Pr[D(r)=1]|=|(1)/(2)+p(n)-(1)/(2)|=p(n)
and since p(n) is a non-negligible value, D is a good distinguisher for G(), i.e. broke
the security of the PRG G().
Bad Proof. We want to prove that if GO is a secure PRG, then II is a secure encryp tion scheme under the EAV security definition. We will do a proof by contradiction so we first state the contrapositive statement:
If II is not a secure EAV encryption scheme, GO is not a secure PRG.
To prove the contrapositive, we begin by assuming that II is not a secure EAV en cryption scheme, thus, there exists an adversary A that breaks the EAV security of II with non-negligible advantage, i.e.
Pr[A breaks EAV of II] = + p(n), where p(n) is a non-negligible value. Then, using A we construct an distinguisher D that breaks the security of GQ
1. D is given as input a string w of size 2n from its challenger.
2. D starts running A.
3. When A sends mo,mi to D, D will first flip a bit b e {0,1}, encrypt mo as follows: c* = mb,L w|mb,R w and send c* to A.
4. A outputs a bit b.
5. If b' = b then D outputs 1 (i.e. claims that w was the output of a PRG), else D outputs 0.
Analysis. We consider 2 cases: . Suppose w was a truly random string, then
Pr[A breaks EAV of II] =
and thus Pr[D(r) = 1] = 2
Suppose w was the output of a PRG, then (by assumption)
and thus Pr[D(G(s))=1]=+p(n)
Thus,
|Pr[D(G(s))=1]-Pr[D(r)=1]|=|+pn)-|=p(n
and since p(n) is a non-negligible value, D is a good distinguisher for GO, i.e. broke the security of the PRG GO).
