Section hF.
Variable b k c : nat.
Variable h : Bvector c -> Bvector b -> Bvector c.
Variable F : Bvector k -> list (Bvector b) -> Bvector b.
Definition hF key m :=
[k_Out, k_In] <-2 splitVector c k key;
h k_Out (F k_In m).
Variable A : OracleComp (list (Bvector b)) (Bvector c) bool.
Hypothesis A_wf : well_formed_oc A.
(* Step 0: inline and simplify *)
Definition G0 :=
k_in <-$ {0, 1}^k;
k_out <-$ {0, 1}^c;
[b, _] <-$2 A _ _ (fun (_ : unit) m => ret (h k_out (F k_in m), tt)) tt;
ret b.
(* Step 1: replace h with a random function *)
Definition G1 :=
k_in <-$ {0, 1}^k;
[b, _] <-$2 A _ _
(fun (s : list (Bvector b * Bvector c)) m =>
randomFunc ({0, 1}^c) _ s (F k_in m)) nil;
ret b.
(* Step 2: from cAU, identical random function inputs imply identical messages.  So this is equivalent to a random function with the domain of messages. *)
Definition G2 :=
[b, _] <-$2 A _ _
(fun (s : list (list (Bvector b) * Bvector c)) m =>
randomFunc ({0, 1}^c) _ s m) nil;
ret b.
Definition G0_1 :=
[k_out, k_in] <-$2 (
key <-$ {0, 1}^(c + k);
ret splitVector c k key);
[b, _] <-$2 A _ _ (fun (_ : unit) m => ret (h k_out (F k_in m), tt)) tt;
ret b.
unfold PRF_G_A, G0_1.
inline_first.
comp_skip.
unfold f_oracle, hF.
remember (splitVector c k x) as z.
comp_simp.
reflexivity.
Qed.
unfold G0_1, G0.
eapply eqRat_trans.
eapply evalDist_seq_eq.
eapply Rnd_split_equiv.
intros.
eapply eqRat_refl.
inline_first.
comp_swap_r.
comp_skip.
inline_first.
comp_skip.
Qed.
rewrite G0_1_equiv.
apply G0_1_G0_equiv.
Qed.
Definition hF_oracle k_in (s : unit) m : OracleComp (Bvector b) (Bvector c) (Bvector c * unit) :=
r <--$ OC_Query _ (F k_in m);
$ ret (r, tt).
(* Need to use OC_Run here because hF_oracle calls F before querying the oracle. *)
Definition PRF_h_A : OracleComp (Bvector b) (Bvector c) bool :=
k_in <--$$ {0, 1}^k;
[r, _] <--$2 OC_Run _ _ _ A (hF_oracle k_in) tt;
$ ret r.
Definition G1_1 :=
k_out <-$ { 0 , 1 }^c;
[b, _] <-$2 PRF_h_A _ _ (f_oracle h _ k_out) tt;
ret b.
Definition G1_2 :=
[b, _] <-$2 PRF_h_A _ _ (randomFunc ({0, 1}^c) _) nil;
ret b.
Local Opaque evalDist.

Theorem G0_G1_1_equiv :
Pr[G0] == Pr[G1_1].