Research proof index

The handler writes only the cells declared by demoWrites.

Binding ≤ keyed-CR (standard model): for any binding adversary A against the hash-based commitment scheme H.toCommitment, the binding advantage is bounded by the keyed-CR advantage of H against the natural reduction adversary bindingAdv_toCRAdv A. A binding-game win has m₁ ≠ m₂ together with both openings verifying: `H k (m₁, s₁) = c = H k (...

ROM Collision Resistance birthday bound: for any t-query ROM-CR adversary A over a hash range Y, the advantage is bounded by (t+2) * (t+1) / (2 * |Y|) (a vacuous bound when |Y| = 0). The two extra queries account for the experiment's verification queries, which share the adversary's cache.

T-transform decryption makes at most one hash-oracle query under unit-cost instrumentation.

Concrete form of the hardness implication CDH ⇒ DLog: if a DLog adversary succeeds with probability p, the induced CDH adversary succeeds with probability at least p^2.

In the random DDH game, the CDH-to-DDH reduction only matches the target with the uniform baseline probability. The bijectivity assumption identifies scalar samples with uniformly sampled group elements in the subgroup generated by g.