VCVio

The handler writes only the cells declared by demoWrites.

Binding ≤ keyed-CR (standard model): for any binding adversary A against the hash-based commitment scheme H.toCommitment, the binding advantage is bounded by the keyed-CR advantage of H against the natural reduction adversary bindingAdv_toCRAdv A. A binding-game win has m₁ ≠ m₂ together with both openings verifying: `H k (m₁, s₁) = c = H k (...

ROM Collision Resistance birthday bound: for any t-query ROM-CR adversary A over a hash range Y, the advantage is bounded by (t+2) * (t+1) / (2 * |Y|) (a vacuous bound when |Y| = 0). The two extra queries account for the experiment's verification queries, which share the adversary's cache.

T-transform decryption makes at most one hash-oracle query under unit-cost instrumentation.

Concrete form of the hardness implication CDH ⇒ DLog: if a DLog adversary succeeds with probability p, the induced CDH adversary succeeds with probability at least p^2.

In the random DDH game, the CDH-to-DDH reduction only matches the target with the uniform baseline probability. The bijectivity assumption identifies scalar samples with uniformly sampled group elements in the subgroup generated by g.

The eager random oracle, averaged over a uniformly sampled seed, matches the fresh independent-query semantics of evalDist. This is because the pre-sampled seed values are i.i.d. uniform, exactly matching fresh oracle queries. This is the analog of seededOracle.evalDist_liftComp_generateSeed_bind_simulateQ_run' but for eagerRandomOracle (which falls...

When the computation is within its query bound, enforcement is transparent: the output distribution is identical to running without enforcement.