proposition: Theorem security_based_on_mac LA A: ValidPackage LA [interface #val #[eavesdrop]: 'word × 'word → 'word × 'word ; #val #[decrypt]: 'word × 'word → 'option 'word ] A_export A -> fdisjoint LA ( TAG_locs_tt :|: TAG_locs_ff :|: CPA_EVAL_locs :|: CCA_EVAL_locs :|: CCA_EVAL_TAG_locs :|: CCA_EVAL_HYB_locs ) -> Advantage CCA_EVAL A <= mac_epsilon (A ∘ CCA_EVAL_TAG_pkg_tt) + cpa_epsilon (A ∘ CCA_EVAL_HYB_pkg) + mac_epsilon (A ∘ CCA_EVAL_TAG_pkg_ff).
proof: Proof. move=> vA H. rewrite Advantage_E Advantage_sym. ssprove triangle (CCA_EVAL true) [:: CCA_EVAL_TAG_pkg_tt ∘ TAG true ; CCA_EVAL_TAG_pkg_tt ∘ TAG false ; CCA_EVAL_HYB_pkg ∘ CPA_EVAL true ; CCA_EVAL_HYB_pkg ∘ CPA_EVAL false ; CCA_EVAL_TAG_pkg_ff ∘ TAG false ; CCA_EVAL_TAG_pkg_ff ∘ TAG true ] (CCA_EVAL false) A as ineq. apply: le_trans. 1: by apply: ineq. rewrite !fdisjointUr in H. move: H => /andP [/andP [/andP [/andP [/andP [H1 H2] H3] H4] H5] H6]. move: {ineq H1 H2 H3 H4 H5 H6} (H1, H2, H3, H4, H5, H6) => H. rewrite CCA_EVAL_equiv_true ?fdisjointUr ?H // GRing.add0r. rewrite CCA_EVAL_HYB_equiv_true ?fdisjointUr ?H // GRing.addr0. rewrite CCA_EVAL_HYB_equiv_false ?fdisjointUr ?H // GRing.addr0. rewrite CCA_EVAL_equiv_false ?fdisjointUr ?H // GRing.addr0. rewrite /mac_epsilon /cpa_epsilon !Advantage_E -!Advantage_link. by rewrite (Advantage_sym (TAG true)) (Advantage_sym (CPA_EVAL true)). Qed.
imports: Relational(OrderEnrichedCategory GenericRulesSimple) mathcomp(all_ssreflect all_algebra reals distr realsum ssrnat ssreflect ssrfun ssrbool ssrnum eqtype choice seq) Mon(SPropBase) Crypt(Axioms ChoiceAsOrd SubDistr Couplings UniformDistrLemmas FreeProbProg Theta_dens RulesStateProb pkg_core_definition choice_type pkg_composition pkg_rhl Package Prelude) extructures(ord fset fmap) Equations(Equations)