[
[
['169','add','hl'],
['166','add','hl'],
['163','add','hl'],
['160','add','hl'],
['157','add','hl'],
['154','add','hl'],
['25','remove','slide-up'],
['2','add','slide-down']
],
[
['170','add','hl'],
['170','remove','slide-left'],
['167','add','hl'],
['167','remove','slide-left'],
['164','add','hl'],
['164','remove','slide-left'],
['161','add','hl'],
['161','remove','slide-left'],
['158','add','hl'],
['158','remove','slide-left'],
['155','add','hl'],
['155','remove','slide-left'],
['4','add','hidden'],
['169','remove','hl'],
['169','add','slide-right'],
['166','remove','hl'],
['166','add','slide-right'],
['163','remove','hl'],
['163','add','slide-right'],
['160','remove','hl'],
['160','add','slide-right'],
['157','remove','hl'],
['157','add','slide-right'],
['154','remove','hl'],
['154','add','slide-right']
],
[
['170','remove','hl'],
['167','remove','hl'],
['164','remove','hl'],
['161','remove','hl'],
['158','remove','hl'],
['155','remove','hl'],
['6','add','hl'],
['7','add','hl'],
['172','add','hl'],
['176','add','hl'],
['47','remove','slide-up'],
['25','add','slide-down']
],
[
['50','add','hl'],
['50','remove','hidden'],
['51','add','hl'],
['51','remove','hidden'],
['52','add','hl'],
['52','remove','hidden'],
['173','add','hl'],
['173','remove','slide-left'],
['60','add','hl'],
['60','remove','hidden'],
['68','add','hl'],
['68','remove','hidden'],
['6','remove','hl'],
['6','add','hidden'],
['7','remove','hl'],
['7','add','hidden'],
['172','remove','hl'],
['172','add','slide-right'],
['176','remove','hl'],
['176','add','slide-left']
],
[
['50','remove','hl'],
['51','remove','hl'],
['52','remove','hl'],
['173','remove','hl'],
['60','remove','hl'],
['68','remove','hl'],
['186','add','hl'],
['179','add','hl'],
['60','add','hl'],
['183','add','hl'],
['177','add','hl'],
['175','add','hl'],
['72','remove','slide-up'],
['47','add','slide-down']
],
[
['82','add','hl'],
['82','remove','hidden'],
['180','add','hl'],
['180','remove','slide-left'],
['90','add','hl'],
['90','remove','hidden'],
['178','add','hl'],
['178','remove','slide-left'],
['176','add','hl'],
['176','remove','slide-left'],
['186','remove','hl'],
['186','add','slide-left'],
['179','remove','hl'],
['179','add','slide-right'],
['60','remove','hl'],
['60','add','hidden'],
['183','remove','hl'],
['183','add','slide-left'],
['177','remove','hl'],
['177','add','slide-right'],
['175','remove','hl'],
['175','add','slide-right']
],
[
['82','remove','hl'],
['180','remove','hl'],
['90','remove','hl'],
['178','remove','hl'],
['176','remove','hl'],
['185','add','hl'],
['182','add','hl'],
['98','remove','slide-up'],
['72','add','slide-down']
],
[
['186','add','hl'],
['186','remove','slide-left'],
['109','add','hl'],
['109','remove','hidden'],
['183','add','hl'],
['183','remove','slide-left'],
['118','add','hl'],
['118','remove','hidden'],
['185','remove','hl'],
['185','add','slide-right'],
['182','remove','hl'],
['182','add','slide-right']
],
[
['186','remove','hl'],
['109','remove','hl'],
['183','remove','hl'],
['118','remove','hl'],
['173','add','hl'],
['126','remove','slide-up'],
['98','add','slide-down']
],
[
['187','add','hl'],
['187','remove','slide-left'],
['173','remove','hl'],
['173','add','slide-right']
],
[
['187','remove','hl']
]
]
\FORMATTINGHACK{\pagebreak}The starting point of the hybrid proof is $\lib{crhf-real+ic}$.
Instead of sampling outputs of $\ic^\pm$ without replacement, we can sample them with replacement. The change is indistinguishable, using the now-standard birthday reasoning. As a result of the change, the sets $\mathcal{A}[\key]$ and $\mathcal{B}[\key]$ are no longer needed and can be removed.
Whenever $\ic^\pm$ is called, we can compute the associated $H$-output and store it. Then $\crhfcmp$ can refer directly to these stored values.
Instead of sampling ideal cipher output and then computing $H[\key\|A]$, we can sample $H[\key\|A]$ first and solve for the ideal cipher output. Care is needed in $\ic^-$ because we need to sample $H[\key\|A]$ before knowing what $A$ is.\FORMATTINGHACK{\pagebreak}
Now all values assigned to $H[\cdot]$ are sampled uniformly. We can instead sample them without replacement, with negligible effect on the calling program.
Now all values assigned to $H[\cdot]$ are \emph{distinct,} and therefore $H[X\|Y] == H[X'\|Y']$ if and only if $X\|Y = X'\|Y'$.
$\lib{crhf-real+ic}$
$Z := \ic^+(X,Y) \oplus Y$
$Z' := \ic^+(X',Y') \oplus Y'$
call $\ic^+(X,Y)$
call $\ic^+(X',Y')$
return
$Z == Z'$
$H[X\|Y] == H[X'\|Y']$
$X\|Y == X'\|Y'$
if $\prftable^+[\key,A]$ undefined:
$H[\key\|A] \gets \bits^\secpar$
$$
${} \setminus \mathcal{H}$
$\mathcal{H} := \mathcal{H} \cup \{ H[\key\|A] \}$
$B $
${}\gets \bits^\secpar$
${} \setminus \mathcal{B}[\key]$
$$
${}:= A \oplus H[\key\|A]$
$\prftable^+[\key,A] := B$
$; \mathcal{A}[\key] := \mathcal{A}[\key] \cup \{ A \}$
$$
$\prftable^-[\key,B] := A$
$; \mathcal{B}[\key] := \mathcal{B}[\key] \cup \{ B \}$
$$
$H[\key\|A] := A \oplus B$
return $\prftable^+[\key,A]$
if $\prftable^-[\key,B]$ undefined:
$H \gets \bits^\secpar$
$$
${} \setminus \mathcal{H}$
$\mathcal{H} := \mathcal{H} \cup \{ H \}$
$A $
${}\gets \bits^\secpar$
${} \setminus \mathcal{A}[\key]$
$$
${}:= B \oplus H$
$\prftable^+[\key,A] := B$
$; \mathcal{A}[\key] := \mathcal{A}[\key] \cup \{ A \}$
$$
$\prftable^-[\key,B] := A$
$; \mathcal{B}[\key] := \mathcal{B}[\key] \cup \{ B \}$
$$
return $\prftable^-[\key,B]$