[
[
['4','add','hl'],
['7','add','hl'],
['13','add','hl'],
['14','add','hl'],
['22','remove','slide-up'],
['2','add','slide-down']
],
[
['32','add','hl'],
['32','remove','hidden'],
['33','add','hl'],
['33','remove','hidden'],
['34','add','hl'],
['34','remove','hidden'],
['35','add','hl'],
['35','remove','hidden'],
['16','remove','indent-1'],
['17','remove','indent-1'],
['4','remove','hl'],
['4','add','hidden'],
['7','remove','hl'],
['7','add','hidden'],
['13','remove','hl'],
['13','add','hidden'],
['14','remove','hl'],
['14','add','hidden'],
['16','add','indent-2'],
['17','add','indent-2']
],
[
['32','remove','hl'],
['33','remove','hl'],
['34','remove','hl'],
['35','remove','hl'],
['5','add','hl'],
['6','add','hl'],
['163','add','hl'],
['173','add','hl'],
['152','add','hl'],
['158','add','hl'],
['170','add','hl'],
['149','add','hl'],
['42','remove','slide-up'],
['22','add','slide-down']
],
[
['46','add','hl'],
['46','remove','hidden'],
['47','add','hl'],
['47','remove','hidden'],
['153','add','hl'],
['153','remove','slide-left'],
['56','add','hl'],
['56','remove','hidden'],
['57','add','hl'],
['57','remove','hidden'],
['150','add','hl'],
['150','remove','slide-left'],
['5','remove','hl'],
['5','add','hidden'],
['6','remove','hl'],
['6','add','hidden'],
['163','remove','hl'],
['163','add','slide-left'],
['173','remove','hl'],
['173','add','slide-left'],
['152','remove','hl'],
['152','add','slide-right'],
['158','remove','hl'],
['158','add','slide-left'],
['170','remove','hl'],
['170','add','slide-left'],
['149','remove','hl'],
['149','add','slide-right']
],
[
['46','remove','hl'],
['47','remove','hl'],
['153','remove','hl'],
['56','remove','hl'],
['57','remove','hl'],
['150','remove','hl'],
['162','add','hl'],
['47','add','hl'],
['159','add','hl'],
['157','add','hl'],
['57','add','hl'],
['154','add','hl'],
['64','remove','slide-up'],
['42','add','slide-down']
],
[
['163','add','hl'],
['163','remove','slide-left'],
['160','add','hl'],
['160','remove','slide-left'],
['158','add','hl'],
['158','remove','slide-left'],
['155','add','hl'],
['155','remove','slide-left'],
['162','remove','hl'],
['162','add','slide-right'],
['47','remove','hl'],
['47','add','hidden'],
['159','remove','hl'],
['159','add','slide-right'],
['157','remove','hl'],
['157','add','slide-right'],
['57','remove','hl'],
['57','add','hidden'],
['154','remove','hl'],
['154','add','slide-right']
],
[
['163','remove','hl'],
['160','remove','hl'],
['158','remove','hl'],
['155','remove','hl'],
['166','add','hl'],
['11','add','hl'],
['164','add','hl'],
['17','add','hl'],
['84','remove','slide-up'],
['64','add','slide-down']
],
[
['89','add','hl'],
['89','remove','hidden'],
['167','add','hl'],
['167','remove','slide-left'],
['98','add','hl'],
['98','remove','hidden'],
['165','add','hl'],
['165','remove','slide-left'],
['166','remove','hl'],
['166','add','slide-right'],
['11','remove','hl'],
['11','add','hidden'],
['164','remove','hl'],
['164','add','slide-right'],
['17','remove','hl'],
['17','add','hidden']
],
[
['89','remove','hl'],
['167','remove','hl'],
['98','remove','hl'],
['165','remove','hl'],
['172','add','hl'],
['153','add','hl'],
['169','add','hl'],
['150','add','hl'],
['104','remove','slide-up'],
['84','add','slide-down']
],
[
['173','add','hl'],
['173','remove','slide-left'],
['171','add','hl'],
['171','remove','slide-left'],
['111','add','hl'],
['111','remove','hidden'],
['170','add','hl'],
['170','remove','slide-left'],
['168','add','hl'],
['168','remove','slide-left'],
['121','add','hl'],
['121','remove','hidden'],
['172','remove','hl'],
['172','add','slide-right'],
['153','remove','hl'],
['153','add','slide-right'],
['169','remove','hl'],
['169','add','slide-right'],
['150','remove','hl'],
['150','add','slide-right']
],
[
['173','remove','hl'],
['171','remove','hl'],
['111','remove','hl'],
['170','remove','hl'],
['168','remove','hl'],
['121','remove','hl'],
['175','add','hl'],
['126','remove','slide-up'],
['104','add','slide-down']
],
[
['145','add','hl'],
['145','remove','hidden'],
['176','add','hl'],
['176','remove','slide-left'],
['175','remove','hl'],
['175','add','slide-right']
],
[
['145','remove','hl'],
['176','remove','hl']
]
]
The starting point is a block of code that evaluates CBC-MAC on inputs $X$ and $X'$ and tests for a collision.
When $X$ and $X'$ are identical in the first $i$ blocks, then CBC-MAC will compute the same $Y_i$ value for both. The library can notice this and avoid calling $F$ twice in this case. No other calls to $F$ are expected to repeat.
Apply the security of the PRF, replacing $F$ with a lazy random dictionary. The standard three-hop maneuver is omitted.
Assume that each probe to the random dictionary has never been made before and trigger a bad event when that assumption is violated. We will need to argue later that this bad event has negligible probability.
Instead of sampling $\prftable[B_i]$ and then using it to compute $B_{i+1}$, we can sample $B_{i+1}$ and use it to compute $\prftable[B_i]$. The three-hop maneuver involving \claimref{provsec.clm.generalized-otp} is omitted.
The library never reads actual values from $\prftable[\cdot]$; instead, it only checks whether a value is defined in $\prftable[\cdot]$. The same functionality can be achieved with a simple set $\mathcal{B}$, and we can do away with $\prftable[\cdot]$.
Finally, modify the program to ignore everything that came before and simply return $\myfalse.$ The program's output changes only in case of a collision ($X \ne X'$ but $Y_\ell = Y'_{\ell'}$) so we indicate this case as a bad event.
$\key \gets \bits^\secpar$
$B_1 := X_1$
for $i = 1$ to $\ell$:
if
$\prftable[B_i]$
undefined:
defined: $\badvar := \mytrue$
$B_i \in \mathcal{B}$: $\badvar := \mytrue$
$\prftable[B_i] \gets \bits^\secpar$
$B_{i+1} \gets \bits^\secpar$
$Y_i := {}$
$F(\key, B_i)$
$\prftable[B_i]$
$$
$ $
${}\gets \bits^\secpar$
${}:= B_{i+1} \oplus X_{i+1}$
$B_{i+1} \oplus X_{i+1}$
$B_{i+1} := Y_i \oplus X_{i+1}$
$\mathcal{B} := \mathcal{B} \cup \{ B_i \}$
$B'_1 := X'_1$
for $i = 1$ to $\ell'$:
if $X'_1 \| \cdots \| X'_i == X_1 \| \cdots \| X_i$:
$Y'_i := Y_i$
$B'_{i+1} := Y'_i \oplus X'_{i+1}$
else:
if
$\prftable[B'_i]$
undefined:
defined: $\badvar := \mytrue$
$B'_i \in \mathcal{B}$: $\badvar := \mytrue$
$\prftable[B'_i] \gets \bits^\secpar$
$B'_{i+1} \gets \bits^\secpar$
$Y'_i := {}$
$F(\key, B'_i)$
$\prftable[B'_i]$
$$
$ $
${}\gets \bits^\secpar$
${}:= B'_{i+1} \oplus X'_{i+1}$
$B'_{i+1} \oplus X'_{i+1}$
$B'_{i+1} := Y'_i \oplus X'_{i+1}$
$\mathcal{B} := \mathcal{B} \cup \{ B'_i \}$
if $Y_\ell == Y'_{\ell'}$: $\badvar := \mytrue$
return
$Y_\ell == Y'_{\ell'}$
$\myfalse$