- h)$, where $a = g^\alpha$, $b = g^\beta$ and $h$ is some string in $\{0,
- 1\}^k$; and let $h^* = H(g^\beta, g^{\alpha\beta})$. $A$ must decide
- whether $h = h^*$. Clearly, if $A$ never queries $H$ at $(g^\beta,
- g^{\alpha\beta})$ then its advantage is zero, since it has no information
- about $h^*$.
+ h^*)$, where $a = g^\alpha$ and $b = g^\beta$; and let $h^* =
+ H(g^{\alpha\beta})$. $A$ must decide whether $h = h^*$. Clearly, if $A$
+ never queries $H$ at $(g^\beta, g^{\alpha\beta})$ then its advantage is
+ zero, since it has no information about $h^*$.