updates

content/CSE442T/CSE442T_L16.md

@@ -13,7 +13,8 @@ Ouput $(r,m\oplus f_i(r))$
 
 $Dec_i(r,c):$ Output $c\oplus f_i(r)$
 
-Proof of security:
+<details>
+<summary>Proof of security</summary>
 
 Suppose $D$ distinguishes, for infinitly many $n$.
 
@@ -35,7 +36,7 @@ $(r_1,F(r_1)),\ldots, (r_q,F(r_q))$
 
 So $D$ distinguishing output of $r_1,\ldots, r_q$ of PRF from the RF, this contradicts with definition of PRF.
 
-QED
+</details>
 
 Noe we have 
 

content/CSE442T/CSE442T_L17.md

@@ -32,7 +32,8 @@ Proof of the validity of the decryption: Exercise.
 
 The encryption scheme is secure under this construction (Trapdoor permutation (TDP), Hardcore bit (HCB)).
 
-Proof:
+<details>
+<summary>Proof</summary>
 
 We proceed by contradiction. (Constructing contradiction with definition of hardcore bit.)
 
@@ -76,7 +77,7 @@ $$
 
 This contradicts the definition of hardcore bit.
 
-QED
+</details>
 
 ### Public key encryption scheme (multi-bit)
 
@@ -144,7 +145,8 @@ Output: $m$
 
 #### Security of El-Gamal encryption scheme
 
-Proof:
+<details>
+<summary>Proof</summary>
 
 If not secure, then there exists a distinguisher $\mathcal{D}$ that can distinguish the encryption of $m_1,m_2\in G_q$ with non-negligible probability $\mu(n)$.
 
@@ -155,5 +157,5 @@ $$
 
 And proceed by contradiction. This contradicts the DDH assumption.
 
-QED
+</details>
 

content/CSE442T/CSE442T_L20.md

@@ -26,7 +26,8 @@ Under the discrete log assumption, $H$ is a CRHF.
 - It is easy to compute
 - Compressing by 1 bit
 
-Proof:
+<details>
+<summary>Proof</summary>
 
 The hash function $h$ is a CRHF
 
@@ -72,7 +73,7 @@ So $\mathcal{B}$ can break the discrete log assumption with non-negligible proba
 
 So $h$ is a CRHF.
 
-QED
+</details>
 
 To compress by more, say $h_k:{0,1}^n\to \{0,1\}^{n-k},k\geq 1$, then we can use $h: \{0,1\}^{n+1}\to \{0,1\}^n$ multiple times.
 
@@ -106,7 +107,8 @@ One-time secure:
 
 Then ($Gen',Sign',Ver'$) is one-time secure.
 
-Ideas of Proof:
+<details>
+<summary>Ideas of Proof</summary>
 
 If the digital signature scheme ($Gen',Sign',Ver'$) is not one-time secure, then there exists an adversary $\mathcal{A}$ which can ask oracle for one signature on $m_1$ and receive $\sigma_1=Sign'_{sk'}(m_1)=Sign_{sk}(h_i(m_1))$.
 
@@ -119,7 +121,7 @@ Case 1: $h_i(m_1)=h_i(m_2)$, Then $\mathcal{A}$ finds a collision of $h$.
 
 Case 2: $h_i(m_1)\neq h_i(m_2)$, Then $\mathcal{A}$ produced valid signature on $h_i(m_2)$ after only seeing $Sign'_{sk'}(m_1)\neq Sign'_{sk'}(m_2)$. This contradicts the one-time secure of ($Gen,Sign,Ver$).
 
-QED
+</details>
 
 ### Many-time Secure Digital Signature