// Hashed Decisional Diffie-Hellman assumption.

// Counter-based single-challenge version: Challenge() may be called at most

// once (subsequent calls return None). Same Initialize/Hash/Challenge

// interface as HashedDDHMultiChal so a hybrid argument can lift this to

// HashedDDHMultiChal.

// Left: (pk, g^r, H(pk^r)) Right: (pk, g^r, random)

Game Left(Group G, Int n, Function<GroupElem<G>, BitString<n>> H) {

GroupElem<G> pk;

GroupElem<G> gr_saved;

BitString<n> val_saved;

Int count;

GroupElem<G> Initialize() {

ModInt<G.order> a <- ModInt<G.order>;

pk = G.generator ^ a;

ModInt<G.order> r <- ModInt<G.order>;

gr_saved = G.generator ^ r;

val_saved = H(pk ^ r);

count = 0;

return pk;

}

BitString<n> Hash(GroupElem<G> x) {

return H(x);

}

[GroupElem<G>, BitString<n>]? Challenge() {

[GroupElem<G>, BitString<n>]? result = None;

count = count + 1;

if (count == 1) {

result = [gr_saved, val_saved];

}

return result;

}

}

Game Right(Group G, Int n, Function<GroupElem<G>, BitString<n>> H) {

GroupElem<G> pk;

GroupElem<G> gr_saved;

BitString<n> val_saved;

Int count;

GroupElem<G> Initialize() {

ModInt<G.order> a <- ModInt<G.order>;

pk = G.generator ^ a;

ModInt<G.order> r <- ModInt<G.order>;

gr_saved = G.generator ^ r;

val_saved <- BitString<n>;

count = 0;

return pk;

}

BitString<n> Hash(GroupElem<G> x) {

return H(x);

}

[GroupElem<G>, BitString<n>]? Challenge() {

[GroupElem<G>, BitString<n>]? result = None;

count = count + 1;

if (count == 1) {

result = [gr_saved, val_saved];

}

return result;

}

}

export as HashedDDH;