Section PRF_DRBG.
Variable Key D : Set.
(* The range of the PRF is a bit vector of length eta. *)
Variable eta : nat.
Hypothesis D_EqDec : EqDec D.
Variable RndKey : Comp Key.
(* f is an adaptively-secure PRF. *)
Variable f : Key -> D -> Bvector eta.
(* For this construction, we need an injection from the range of the PRF to the domain.  This allows us to use the previous PRF output to compute the next one. *)
Variable injD : Bvector eta -> D.
Hypothesis injD_correct :
forall r1 r2, (injD r1) = (injD r2) -> r1 = r2.
(* The length (in PRF output blocks) of the DRBG output is l.  This value must be positive. *)
Variable l : nat.
Hypothesis l_pos : l  > 0.
(* Because the DRBG is constructed using feedback from the previous iteration, we need an initial value.  We assume an arbitrary bit vector and then inject it into the domain of the PRF.  This arrangement was chosen for simplicity, and it could easily be modified or generalized. *)
Variable r_init : Bvector eta.
Definition v_init := injD r_init.
(* The computation used to obtain uniform random values in the range of the DRBG.  This computation is used only in the security definition. *)
Definition RndOut := compMap _ (fun _ => {0, 1}^eta) (forNats l).
(* We model the DRBG using a function that uses the previous output value (injected into the domain) as the current input value of the PRF. *)
Fixpoint PRF_DRBG_f (v : D)(n : nat)(k : Key) :=
match n with
| O => nil
| S n' =>
r <- (f k v);
r :: (PRF_DRBG_f (injD r) n' k)
end.
Definition PRF_DRBG (k : Key) :=
PRF_DRBG_f v_init l k.
(* The adversary against the DRBG. *)
Variable A : list (Bvector eta) -> Comp bool.
Hypothesis A_wf : forall c, well_formed_comp (A c).
(* Step 1: inline definitions and simplify. *)
Definition PRF_DRBG_G1 :=
s <-$ RndKey ;
A (PRF_DRBG_f v_init l s).
reflexivity.
Qed.
(* Step 2: use the PRF as an oracle.  This will allow us to apply the security definition and replace it in the next step.*)
Fixpoint PRF_DRBG_f_G2 (v : D)(n : nat) :
OracleComp D (Bvector eta) (list (Bvector eta)) :=
match n with
| O => $ ret nil
| S n' =>
r <--$ (OC_Query _ v);
ls' <--$ (PRF_DRBG_f_G2 (injD r) n');
$ ret (r :: ls')
end.
(* The constructed adversary against the PRF. (takes something of type D -> Bvector eta, tries to guess whether it's RF or PRF) the adversary can know the initial v, but not the K   *)
Definition PRF_A : OracleComp D (Bvector eta) bool :=
ls <--$ PRF_DRBG_f_G2 v_init l;
$ A ls.
(* return type Comp (bool * list (D * Bvector eta)) <-- tracks the state, and it's not even done explicitly (e.g. by oracleMap) *)
Check A.                        (* A : list (Bvector eta) -> Comp bool *)
(* TODO A isn't an OracleComp here but for mine it should probably be an oracle b/c of the hidden K,V state *)
induction n; intuition; simpl in *;
fcf_well_formed.
Qed.
unfold PRF_A; fcf_well_formed.
apply PRF_DRBG_f_G2_wf.
Qed.
Definition PRF_DRBG_G2 :=
s <-$ RndKey ;
[b, _] <-$2 PRF_A unit _ (f_oracle f _ s) tt;
ret b.
(* In an intermediate step, put the construction in the form of a (deterministic) computation.  Then we can more easily change it to an oracle interaction in the following step. *)
Fixpoint PRF_DRBG_f_G1_1 (v : D)(n : nat)(k : Key) :=
match n with
| O => ret nil
| S n' =>
r <-$ ret (f k v);
ls <-$ (PRF_DRBG_f_G1_1 (injD r) n' k);
ret (r :: ls)
end.
Definition PRF_DRBG_G1_1 :=
s <-$ RndKey ;
ls <-$ PRF_DRBG_f_G1_1 v_init l s;
A ls.
induction n; intuition; simpl in *.
(* comp_spec eq is registered as a setoid, so intuition will discharge simple goals. *)
fcf_reflexivity.
fcf_simp.
(* rewrite IHn. *)
fcf_transitivity.
(* TODO how would I do this manually again? *)
fcf_skip_eq.                (* this pulls in IHn, note it turns into PRF_DRBG_f *)
fcf_reflexivity.
fcf_simp.
fcf_reflexivity.
Qed.
unfold PRF_DRBG_G1, PRF_DRBG_G1_1.
fcf_skip.
fcf_to_prhl_eq.
fcf_symmetry.
fcf_transitivity.
fcf_with PRF_DRBG_f_G1_1_eq_ret fcf_skip_eq. (* fcf_skip_eq with the comp_spec fact *)
fcf_reflexivity.
fcf_simp.
fcf_reflexivity.
Qed.
(* throw away snd tuple elem, also f oracle *)
induction n; intuition; simpl in *.
fcf_simp.
fcf_spec_ret.
fcf_skip.
unfold f_oracle.           (* * *)
(* we are left with a unification variable for the specification, we can supply a value for it by specializing the appropriate theorem. *)
eapply (comp_spec_ret _ _ (fun x1 x2 => x1 = fst x2)).
trivial.
(* rest of proof *)
simpl in *.
intuition.
subst.
fcf_skip.                  (* uses induction hypothesis *)
fcf_simp.
fcf_spec_ret.
Qed.
(* equality for rational numbers is a setoid, so we can rewrite with it. *)
rewrite PRF_DRBG_G1_1_equiv.
unfold  PRF_DRBG_G1_1,  PRF_DRBG_G2.
unfold PRF_A.
simpl.
fcf_skip.
fcf_inline_first.
fcf_to_prhl_eq.
(* unfold PRF_DRBG_f_G2. *)
(* it showed the first two lines were equivalent, then skipped them *)
(* rewrite PRF_DRBG_f_G1_1_G2_equiv. *)
fcf_with PRF_DRBG_f_G1_1_G2_equiv fcf_skip.
fcf_simp.
simpl.
fcf_inline_first.
fcf_ident_expand_l.
fcf_skip.
fcf_simp.
fcf_reflexivity.
Qed.
Print Ltac fcf_skip.
Print Ltac dist_skip.
Print Ltac prog_skip.
(* Step 3: replace the PRF with a random function *)
Definition PRF_DRBG_G3 :=
[b, _] <-$2 PRF_A _ _ (randomFunc ({0,1}^eta) _) nil;
ret b.
Print PRF_DRBG_G2.
Check (randomFunc ({0,1}^eta)).
Print randomFunc.
Print PRF_A.
Check PRF_A.
Check (PRF_A _ _ (randomFunc ({0,1}^eta) _) nil).
(* PRF_Advantage RndKey ({ 0 , 1 }^eta) f D_EqDec (Bvector_EqDec eta) PRF_A *)
(* Step 4 : Replace the random function with random values.  This is the same as long as there are no duplicates in the list of random function inputs. *)
Definition PRF_DRBG_G4 :=
[b, _] <-$2 PRF_A _ _ (fun _ _ => x <-$ {0, 1}^eta; ret (x, tt)) tt;
ret b.
(* Step 3.1: Preserve duplicate inputs using an oracle that keeps track of all the queries. *)
Definition randomFunc_withDups ls x :=
y <-$
(match (arrayLookup _ ls x) with
| Some y => ret y
| None => {0,1}^eta
end);
ret (y, (x, y) :: ls).
Definition PRF_DRBG_G3_1 :=
[b, _] <-$2 PRF_A _ _ (randomFunc_withDups) nil;
ret b.
intuition.
unfold randomFunc, randomFunc_withDups.
rewrite H.
case_eq (arrayLookup D_EqDec x2 a); intuition.
fcf_simp.
fcf_spec_ret.
simpl.
case_eq (eqb a0 a); intuition.
rewrite eqb_leibniz in H1.
subst.
rewrite H.
trivial.
fcf_skip.
fcf_spec_ret.
simpl.
rewrite H.
trivial.
Qed.
unfold PRF_DRBG_G3, PRF_DRBG_G3_1.
fcf_to_prhl_eq.
fcf_skip.
eapply (fcf_oracle_eq (fun x1 x2 => forall a, arrayLookup _ x1 a = arrayLookup _ x2 a)); intuition.
apply randomFunc_withDups_spec; intuition.
fcf_simp.
simpl in H1; intuition; subst.
fcf_reflexivity.
Qed.
(* Expose the bad event to the game. *)
Definition PRF_DRBG_G3_2 : Comp (bool * bool) :=
[b, ls] <-$2 PRF_A _ _ (randomFunc_withDups) nil;
ret (b, hasDups _ (fst (split ls))).
Check PRF_A. (* : OracleComp D (Bvector eta) bool *)
Check randomFunc_withDups.
(* to get the state, you have to 2-tuple-comp-deconstruct an OracleComp in something that is NOT an OracleComp (maybe?) AND give it the two type parameters, an oracle, and a start state *)
(* ls : list (D * Bvector eta) <-- whether the list of INPUTS of the RF has dups  *)
unfold PRF_DRBG_G3_1, PRF_DRBG_G3_2.
simpl.
fcf_inline_first.
fcf_skip.
fcf_simp.
fcf_inline_first.
fcf_skip.
fcf_simp.
simpl.
fcf_reflexivity.
Qed.
(* Obtain a new random value for all inputs.  This game is only equal to the previous game when there are no duplicates in the inputs. *)
Definition PRF_DRBG_G3_3 :=
[b, ls] <-$2 PRF_A _ _  (fun ls a => x <-$ {0, 1}^eta; ret (x, (a, x)::ls)) nil;
ret (b, hasDups _ (fst (split ls))).
(* proved equivalent to this *)
(*   Definition PRF_DRBG_G4 := [b, _] <-$2 PRF_A _ _ (fun _ _ => x <-$ {0, 1}^eta; ret (x, tt)) tt; ret b. *)
Check (PRF_A _ _ (fun _ _ => x <-$ {0, 1}^eta; ret (x, tt)) tt).
(* also unit *)
Print PRF_A.
Print PRF_DRBG_f_G2.
(* ------- identical until bad section *)
(* they are equal when this function is applied to one of the results? both of them? or the function is true on the both of them? *)
(* also this isn't computational? *)
(*    let adv1 := fst y1 in *)
(*    let adv2 := fst y2 in *)
(*    let cache1 := snd y1 in *)
(*    let cache2 := snd y2 in *)
(*    let inputs1 := fst (split cache1) in *)
(*    let inputs2 := fst (split cache2) in *)
(*    (* the inputs should be the same anyway *) *)
(*    hasDups _ inputs1 = *)
(*    hasDups _ inputs2 /\ *)
(*    (hasDups _ inputs1 = false -> *)
(*     cache1 = cache2 /\ adv1 = adv2)) *)
(*    (* randomFunc_withDups has no dups in its inputs -> its inputs and outputs are exactly the same as the one for random inputs and outputs & adversary cannot distinguish them. *) *)
(* TODO how was this proved? *)
(* same probability of bad *)
(* no bad -> identical output distributions *)
rewrite ratDistance_comm.
(* turns inequality to two equaliites *)
fcf_fundamental_lemma.      (* * TODO *)
(* TODO ask adam how he proved this (did he use "coins"?) *)
(* what are the assumptions we need to prove? *)
(* so these two games AREN'T identical until bad in the sense that there's no "code is the same before bad" and "after bad we can do whatever" *)
symmetry.
(* probability that they return bad is the same *)
apply PRF_DRBG_G3_2_3_badness_same.
intuition.
symmetry.
(* ? *)
Print evalDist.
Print Distribution.
Locate evalDist.
(* "distribution of the value of interest is the same in c_1 and c_2 when the bad event does not happen" -- how to prove this? esp b/c the two games aren't in exactly the "identical until bad" form *)
apply PRF_DRBG_G3_2_3_eq_until_bad.
Qed.
(* ------- end identical until bad section *)
unfold PRF_DRBG_G3_3, PRF_DRBG_G4.
simpl.
fcf_inline_first.
fcf_to_prhl_eq.
fcf_skip.
eapply (fcf_oracle_eq (fun x1 x2 => True)); intuition.
fcf_skip.
fcf_spec_ret.
simpl in H1.
intuition; subst.
fcf_simp.
fcf_inline_first.
simpl.
fcf_skip.
simpl; fcf_simp.
fcf_reflexivity.
Qed.
(* Now we need to compute the probability of the "bad" event.  First we will simplify the game defining this event.*)
(* The state of the random function is no longer necessary.  We can simplify things by changing the oracle interaction into a standard (recursive) computation. *)
Fixpoint PRF_DRBG_f_bad (v : D)(n : nat) : Comp (list D) :=
match n with
| O =>  ret nil
| S n' =>
r <-$ {0,1}^eta;
(* this is just a list of n random inputs starting with v; f is removed *)
ls' <-$ (PRF_DRBG_f_bad (injD r) n');
ret (v :: ls')
end.
Print PRF_DRBG_f.
Check PRF_DRBG_f_bad.
Definition PRF_DRBG_G3_bad_1 :=
ls <-$ PRF_DRBG_f_bad v_init l;
ret (hasDups _ ls).

(* The relational specification on the new computation that produces the bad event.  We prove that the list of values produced by this computation is a permutation of the list produced by the oracle interaction in game 3.  Perhaps this could be an equality of we adjust the model, but a permutation works fine for our purposes, since the only thing that matters is the presence/absence of duplicates in the list. *)
(* not sure why ls is needed, why not []? needed for induction? *)
(* don't we have to reason about injD in the latter? *)
Theorem PRF_DRBG_f_bad_spec :
forall n v (ls : list (D * Bvector eta)), (* ls is the initial oracle state *)
comp_spec (fun (x1 : list (Bvector eta) * list (D * Bvector eta)) (x2 : list D) =>
Permutation (fst (split (snd x1))) ((fst (split ls)) ++ x2))
((PRF_DRBG_f_G2 v n) _ _
(fun (ls : list (D * Bvector eta)) (a : D) =>
x <-$ { 0 , 1 }^eta; ret (x, (a, x) :: ls))
ls)
(PRF_DRBG_f_bad v n).