Hybrid Sequence:
The starting point is $\lib{pk-1cpa-real}$.
Since $\ctxt_1 = g^r$ and $\pk^r$ (used to compute $\ctxt_2$) do not depend on the choice of $\ptxt$, they can be sampled at the beginning of time.
At the beginning of time, the library samples $g^{\sk}$, $g^r$, and $\pk^r = g^{\sk \cdot r}$. The DDH assumption says that values distributed in this way are pseudorandom. The three-hop maneuver is not shown.
We can move the selection of $\ctxt_1$ and $U$ back into $\cpaoneenc$. These values are sampled uniformly.
Now $U$ is distributed uniformly in $\G$, so $\ctxt_2$ is a OTP ciphertext (in a OTP variant that uses the group operation in place of \xor; see \exerciseref{provsec.ex.group-otp}). Thus, $\ctxt_2$ is distributed uniformly, independent of $\ptxt$. After making this change, the result is $\lib{pk-1cpa-rand}$.
$\lib{pk-1cpa-real}$
$\sk \gets \Z_\nmod$
$\pk := g^{\sk}$
$\cpaonepk$( ):
return $\pk$
$\cpaoneenc$($\ptxt$):
if $\ctxt^*$ undefined:
$r \gets \Z_\nmod$
$\ctxt_1 $
${}:= g^r$
${}\gets \G$
$\ctxt_2 $
${}:= \ptxt \cdot {}$
$\pk^r$
$U$
${}\gets \G$
$\ctxt^* := (\ctxt_1, \ctxt_2)$
return $\ctxt^*$