\xcalways\section{Integrated public-key encryption schemes}\x
The formulation here is original work by the author. I've tried to
-generalize the work by (among others), Shoup, and Abdalla, Bellare and
-Rogaway. The final proof is from a Usenet article prompted by David
-Hopwood, but based on the DHAES proof by ABR.
+generalize the work by (among others), Shoup \cite{Shoup:2001:PIS}, and
+Abdalla, Bellare and Rogaway \cite{Abdalla:2001:DHIES}. The final proof is
+from a Usenet article prompted by David Hopwood, but based on the DHIES proof
+in \cite{Abdalla:2001:DHIES}.
\xcalways\subsection{Introduction and definitions}\x
\[ \Pr[S] =
\frac{\Adv{ohd}{\Xid{\mathcal{K}}{OWF}^{\mathcal{T}, H}}(A)}{2} +
\frac{1}{2}. \]%
- Let $F$ be the event that $A$ queries $H$ at $x^*$. Then by Shoup's Lemma
- (lemma~\ref{lem:shoup}, page~\pageref{lem:shoup}),
+ Let $F$ be the event that $A$ queries $H$ at $x^*$. Then by
+ Lemma~\ref{lem:shoup} (slide~\pageref{lem:shoup}),
\[ \left|\Pr[S] - \frac{1}{2}\right| \le \Pr[F]. \]
Now consider this adversary $I$, attempting to invert the one-way function.