[
[
['139','add','hl'],
['148','add','hl'],
['154','add','hl'],
['136','add','hl'],
['12','remove','slide-up'],
['2','add','slide-down']
],
[
['140','add','hl'],
['140','remove','slide-left'],
['15','add','hl'],
['15','remove','hidden'],
['18','add','hl'],
['18','remove','hidden'],
['8','remove','indent-1'],
['20','add','hl'],
['20','remove','hidden'],
['137','add','hl'],
['137','remove','slide-left'],
['4','add','hidden'],
['139','remove','hl'],
['139','add','slide-right'],
['8','add','indent-2'],
['148','remove','hl'],
['148','add','slide-left'],
['154','remove','hl'],
['154','add','slide-left'],
['136','remove','hl'],
['136','add','slide-right']
],
[
['140','remove','hl'],
['15','remove','hl'],
['18','remove','hl'],
['20','remove','hl'],
['137','remove','hl'],
['5','add','hl'],
['142','add','hl'],
['24','remove','slide-up'],
['12','add','slide-down']
],
[
['139','add','hl'],
['139','remove','slide-right'],
['143','add','hl'],
['143','remove','slide-left'],
['144-slide','remove','slide-left'],
['5','remove','hl'],
['5','add','hidden'],
['142','remove','hl'],
['142','add','slide-right']
],
[
['139','remove','hl'],
['143','remove','hl']
],
[
['144-flip','add','flipped'],
['24','add','slide-down']
],
[
['143','add','hl']
],
[
['61','add','hl'],
['61','remove','hidden'],
['62','remove','indent-2'],
['62','add','hl'],
['62','remove','hidden'],
['145','add','hl'],
['145','remove','slide-right'],
['62','add','indent-3'],
['143','remove','hl'],
['143','add','slide-left'],
['144-slide','add','slide-left']
],
[
['61','remove','hl'],
['62','remove','hl'],
['145','remove','hl'],
['15','add','hl'],
['6','add','hl'],
['147','add','hl'],
['78','remove','slide-up']
],
[
['74','add','hl'],
['74','remove','hidden'],
['75','remove','indent-2'],
['75','add','hl'],
['75','remove','hidden'],
['148','add','hl'],
['148','remove','slide-left'],
['15','remove','hl'],
['15','add','hidden'],
['6','remove','hl'],
['6','add','hidden'],
['75','add','indent-3'],
['147','remove','hl'],
['147','add','slide-right']
],
[
['74','remove','hl'],
['75','remove','hl'],
['148','remove','hl'],
['61','add','hl'],
['90','remove','slide-up'],
['78','add','slide-down']
],
[
['62','remove','indent-3'],
['61','remove','hl'],
['61','add','hidden'],
['62','add','indent-2']
],
[
['62','add','hl'],
['149','add','hl'],
['101','remove','slide-up'],
['90','add','slide-down']
],
[
['150','add','hl'],
['150','remove','slide-left'],
['62','remove','hl'],
['62','add','hidden'],
['149','remove','hl'],
['149','add','slide-right']
],
[
['150','remove','hl'],
['151','add','hl'],
['113','remove','slide-up'],
['101','add','slide-down']
],
[
['152','add','hl'],
['152','remove','slide-left'],
['108','add','hl'],
['108','remove','hidden'],
['151','remove','hl'],
['151','add','slide-right']
],
[
['152','remove','hl'],
['108','remove','hl'],
['74','add','hl'],
['124','remove','slide-up'],
['113','add','slide-down']
],
[
['75','remove','indent-3'],
['74','remove','hl'],
['74','add','hidden'],
['75','add','indent-2']
],
[
['8','add','hl'],
['108','add','hl'],
['75','add','hl'],
['153','add','hl'],
['133','remove','slide-up'],
['124','add','slide-down']
],
[
['128','remove','hidden'],
['149','add','hl'],
['149','remove','slide-right'],
['142','add','hl'],
['142','remove','slide-right'],
['143','add','hl'],
['143','remove','slide-left'],
['151','add','hl'],
['151','remove','slide-right'],
['154','add','hl'],
['154','remove','slide-left'],
['8','remove','hl'],
['8','add','hidden'],
['108','remove','hl'],
['108','add','hidden'],
['75','remove','hl'],
['75','add','hidden'],
['153','remove','hl'],
['153','add','slide-right']
],
[
['149','remove','hl'],
['142','remove','hl'],
['143','remove','hl'],
['151','remove','hl'],
['154','remove','hl']
]
]
The starting point is $\lib{prf-real}^H$:
We first separate $\key_1$ from $\key_2$, since they will be treated separately during the proof. We can also add a dictionary $\prftable^*[\cdot]$ to cache past answers of $\prfquery_H(\cdot)$ so that they are not recomputed twice.
We can apply the PRF security of $F$ in a three-hop maneuver, replacing $F(\key_1,\cdot)$ with a lazy random dictionary, which we name $\prftable_1[\cdot]$.
\FORMATTINGHACK{\needspace{3\baselineskip}\noindent}We can again apply the PRF security of $F$, this time replacing all calls to $F(\key_2,\cdot)$ with a lazy random dictionary. This is a new dictionary, which we call $\prftable_2$. The repetitive three-hop maneuver is not shown.
The ``if $\prftable_1[X]$ undefined'' condition is always true, because $\prftable_1[X]$ and $\prftable^*[X]$ are always assigned during the same call to $\prfquery_H(X)$, and we only reach this if-statement if $\prftable^*[X]$ is undefined. Thus, this if-statement's body can be made unconditional.
Now $\prftable_1[\cdot]$ is not needed, so it can be eliminated.
Uniformly sampled $Y$-values are indistinguishable from values sampled without replacement. The three-hop maneuver involving \lemmaref{comp.lem.birthday-lib} is omitted.
In this hybrid, the $Y$-values are guaranteed to not repeat. Thus, the inner if-statement is \emph{always} taken, and its body can be made unconditional.
Now the overall effect of the if-statement's body is to assign a uniformly sampled value to $\prftable^*[X]$. The same logic can be written more directly, without $Y$, $\mathcal{Y}$, or $\prftable_2[\cdot]$. The result of these simplification is $\lib{prf-rand}^H$, which completes the proof.
$\lib{prf-real}^H$
$\key_1 $
$\| \key_2 \gets \bits^{2\secpar}$
${}\gets \bits^\secpar$
$\key_2 \gets \bits^\secpar$
$\lib{prf-rand}^H$
if $\prftable^*[X]$ undefined:
if $\prftable_1[X]$ undefined:
$\prftable_1[X] \gets \bits^\secpar$
$Y $
${}:= {}$
$F(\key_1, X)$
$\prfquery_F(X)$
$\prftable_1[X]$
${}\gets \bits^\secpar$
$$
${} \setminus \mathcal{Y}$
$\mathcal{Y} := \mathcal{Y} \cup \{Y\}$
if $\prftable_2[Y]$ undefined:
$\prftable_2[Y] \gets \bits^\secpar$
$\prftable^*[X] $
${}:= {}$
$F(\key_2,Y)$
$\prftable_2[Y]$
${}\gets \bits^\secpar$
return
$F(\key_2, Y)$
$\prftable^*[X]$
$\link$
$\lib{prf-real}^F$
$\key \gets \bits^\secpar$
return $F(\key, X)$
$\lib{prf-rand}^F$
if $\prftable[X]$ undefined:
$\prftable[X] \gets \bits^\secpar$
return $\prftable[X]$