Section Dual_EC_DRBG.
Context`{FCG : FiniteCyclicGroup}.
Hypothesis eqd_GroupElement : EqDec GroupElement.
Definition P := g.
Variable x : GroupElement -> nat.
Variable from_x : nat -> GroupElement.
Definition DRBG(P Q : GroupElement)(t : nat) : (GroupElement * GroupElement ) :=
let s :=  x (P ^ t) in
(P ^ s, Q ^ t).
Variable A : (GroupElement * GroupElement * GroupElement) -> Comp bool.
Definition DRBG_GA Q :=
seed <-$ RndNat order;
[s1, v1] <-2 DRBG P Q seed;
b <-$ A (Q, s1, v1);
ret b.
Definition DRBG_GB Q :=
x2 <-$ RndNat order;
x3 <-$ RndNat order;
b <-$ A (Q, (P^x2), (P^x3));
ret b.
Definition DRBG_P (f : GroupElement -> Comp bool) :=
x <-$ RndNat order;
Q <- P ^ x;
f Q.
Definition G2 Q :=
seed <-$ RndNat order;
[s1, v1] <-2 (seed, Q ^ seed);
b <-$ A (Q, (P ^ s1), v1);
ret b.
Definition xLogAdvantage := | Pr[DRBG_P DRBG_GA] - Pr[DRBG_P G2] |.
Definition DRBG_Advantage := | Pr[DRBG_P DRBG_GA] - Pr[DRBG_P DRBG_GB] |.
unfold DDH_Advantage.
unfold DRBG_P, DRBG_GB, G2, DDH0, DDH1.
unfold P.
eapply ratDistance_eqRat_compat.
comp_skip.
comp_skip.
rewrite groupExp_mult.
reflexivity.
reflexivity.
Qed.

Theorem DRBG_P_secure :  | Pr[DRBG_P DRBG_GA] - Pr[DRBG_P DRBG_GB] | <= xLogAdvantage + @DDH_Advantage _ groupOp ident inverse _ g order A.