Section PRF_DRBG.
Variable Key D : Set.
(* The range of the PRF is a bit vector of length eta. *)
Variable eta : nat.
Hypothesis D_EqDec : EqDec D.
Variable RndKey : Comp Key.
(* f is an adaptively-secure PRF. *)
Variable f : Key -> D -> Bvector eta.
(* For this construction, we need an injection from the range of the PRF to the domain.  This allows us to use the previous PRF output to compute the next one. *)
Variable injD : Bvector eta -> D.
Hypothesis injD_correct :
forall r1 r2, (injD r1) = (injD r2) -> r1 = r2.
(* The length (in PRF output blocks) of the DRBG output is l.  This value must be positive. *)
Variable l : nat.
Hypothesis l_pos : l  > 0.
(* Because the DRBG is constructed using feedback from the previous iteration, we need an initial value.  We assume an arbitrary bit vector and then inject it into the domain of the PRF.  This arrangement was chosen for simplicity, and it could easily be modified or generalized. *)
Variable r_init : Bvector eta.
Definition v_init := injD r_init.
(* The computation used to obtain uniform random values in the range of the DRBG.  This computation is used only in the security definition. *)
Definition RndOut := compMap _ (fun _ => {0, 1}^eta) (forNats l).
(* We model the DRBG using a function that uses the previous output value (injected into the domain) as the current input value of the PRF. *)
Fixpoint PRF_DRBG_f (v : D)(n : nat)(k : Key) :=
match n with
| O => nil
| S n' =>
r <- (f k v);
r :: (PRF_DRBG_f (injD r) n' k)
end.
Definition PRF_DRBG (k : Key) :=
PRF_DRBG_f v_init l k.
(* The adversary against the DRBG. *)
Variable A : list (Bvector eta) -> Comp bool.
Hypothesis A_wf : forall c, well_formed_comp (A c).
(* Step 1: inline definitions and simplify. *)
Definition PRF_DRBG_G1 :=
s <-$ RndKey ;
A (PRF_DRBG_f v_init l s).

(* This game is equivalent to the first game in the DRBG security definition. *)
Theorem PRF_DRBG_G1_equiv :
Pr[DRBG_G0 RndKey PRF_DRBG A] == Pr[PRF_DRBG_G1].