I recently read the article Nonce-Based Symmetric Encryption by Rogaway, where he presents two different notions of indistinguishability, which he calls ind$ and ind, respectively. Here's the definitions of these to notions:
First, let $A^g$ be an algorithm with access to an oracle $g$, and let $\Pi = (\mathcal{E},\mathcal{D})$ be an encryption scheme with key space $\mathrm{Key}$.
Ind\$ is then defined as follows: $$ \mathbf{Adv}_{\Pi}^{\mathrm{ind$}} = \mathrm{Pr}[K \xleftarrow{$} \mathrm{Key} : A ^{\mathcal{E}_K(\cdot)} \Rightarrow 1] - \mathrm{Pr}[A ^{\mathcal{$}(\cdot)} \Rightarrow 1],$$
where $ \$(\cdot)$ is a random oracle, returning random bits equal to the block size of $\mathcal{E}$. In other words: ind$ asks an adversary to distinguish between messages encrypted by the real encryption scheme and random bits.
Ind is defined as: $$ \mathbf{Adv}_{\Pi}^{\mathrm{ind}} = \mathrm{Pr}[K \xleftarrow{$} \mathrm{Key} : A ^{\mathcal{E}_K(\cdot)} \Rightarrow 1] - \mathrm{Pr}[K \xleftarrow{$} \mathrm{Key} : A ^{\mathcal{E}_K(0^{|\cdot|})} \Rightarrow 1].$$
That is, ind asks an adversary, when quarrying the input message $M$ to the oracles, to distinguish between the real encryption of $M$, and the encryption of $0^{|M|}$.
He then claims that
"It is easy to verify that the ind$-notion of security implies the ind-notion, and by a tight reduction".
My question:
Intuitively, the implication seems easy enough: If $\Pi$ is ind\$-secure, then encryption of $0^{|M|}$ will be indistinguishable from random, so we just get the "ind\$-game". However, how would you go about showing the tightness of the reduction? Usually I'm used to doing this by a reduction like so: assume you have an ind-adversary that breaks the ind-security, how can you turn this into an (effective) adversary against the ind\$-security of $\Pi$? But I don't really see how an adversary against ind can be turned into an (effective) adversary against ind\$.
