Security games · Adjacent hybrids · Hard-core predicates
Run hidden-bit games over real primitives, account for each AES hybrid hop, and turn a stipulated inner-product predictor into an independently verified bounded preimage list.
THE IDEA
In this lab's guessing-game exhibits, a challenger hides one random bit and the adversary tries to name it. Those exhibits report normalized guessing advantage, 2p − 1. The target-collision exhibit is instead a search game with no hidden coin, so it reports the adversary's raw win probability p. In either kind of game, one named strategy's losses do not establish security.
BOUNDARIES
Real browser cryptography inside faithfully sampled games. Not production crypto; session keys stay in memory and the interface deliberately exposes internals for teaching.
AES CBC/CTR/GCM and RSA OAEP/PSS use WebCrypto. AES-ECB, ristretto255 ElGamal, secp256k1 ECDSA, and Ed25519 use audited Noble packages. In the hidden-bit guessing exhibits, the challenger bit always comes from crypto.getRandomValues; the target-collision search game has no challenger bit.
The switching game's PRP and PRF are mathematical ideal oracles, sampled lazily. The GGM tree instead uses real AES and a deliberately broken comparison generator, with its seed visible for teaching. Trial counts are capped at 5,000; a sample is not a proof.
No proof assistant or symbolic analysis; see Protocol Checker. No CCA1, NM-CPA, visitor-authored code, TLS or Signal claims, or deployed-system verdicts.
KEM notions stay outside this game board; see KEM Trap for ML-KEM. No result label uses the word “secure”; it reports an attack or no advantage from named adversaries.
| Definition | Extra power | Why it is not an exhibit here |
|---|---|---|
| CCA1 | Decrypt before, not after, the challenge | CCA2 makes the sharper oracle boundary visible. |
| NM-CPA | Forbids useful ciphertext relations | The ElGamal CCA act shows malleability without claiming the full equivalence story. |
| KEM security | Challenges an encapsulated key | That interface belongs in the linked KEM lab. |
Goldwasser–Micali (1984) · Rackoff–Simon (1991) · Goldreich–Levin (1989) · Bellare–Desai–Pointcheval–Rogaway (1998) · Goldwasser–Micali–Rivest (1988) · Bellare–Rogaway (2006) · Shoup (2004) · FIPS 197 · RFC 6979 · RFC 8032.