# Proof for secure stream cipher implies secure PRG

I am self studying "A Graduate Course in Applied Cryptography" by Boneh-Shoup. I am not sure if my proof for the following problem in the book is correct. The problem asks to prove that if a stream cipher is semantically secure, then the underlying PRG is secure. Please let me know if my attempt works. If my solution is incorrect, I would appreciate a hint for how to approach the problem.

Let $$G$$ be the underlying PRG of the stream cipher $$\mathcal{E}$$ and let $$\mathcal{B}$$ be an adversary of G. We construct an adversary $$\mathcal{A}$$ attacking the semantic security of the corresponding stream cipher and we relate $$\mathcal{A}$$'s advantage to $$\mathcal{B}$$'s advantage.

As in the semantic security game, $$\mathcal{A}$$ must send messages $$m_0, m_1$$ to the stream cipher challenger. $$\mathcal{A}$$ chooses $$m_0$$ to be a string of zeros and samples $$m_1$$ at uniform random from the message space.

The challenger responds choosing $$b$$ at random from $$\{0,1\}$$, $$s$$ at random from the PRG seed space and computing $$G(s)$$. He proceeds by sending $$G(s) \oplus m_b$$ to $$\mathcal{A}$$.

Now $$\mathcal{A}$$ invokes $$\mathcal{B}$$ by playing the role of challenger to $$\mathcal{B}$$ in the PRG security game. He forwards $$G(s) \oplus m_b$$ to $$\mathcal{B}$$ and outputs whatever $$\mathcal{B}$$'s response is.

Let experiment zero be the case when $$m_b$$ is the string of zeros (ie b = 0). Let $$W_0$$ be the event where $$\mathcal{B}$$ outputs $$1$$ in experiment zero.

Let experiment one be the case when $$b = 1$$.Let $$W_1$$ be the event where $$\mathcal{B}$$ outputs $$1$$ in experiment one.

Note that $$W_0$$ is precisely the event where $$\mathcal{A}$$ outputs one in experiment zero and $$W_0$$ is precisely the event where $$\mathcal{A}$$ outputs one in experiment one. So we need to calculate $$|Pr[W_0] - Pr[W_1]|.$$ Since $$m_1$$ is randomly generated, the distribution of $$m_1 \oplus G(s)$$ is uniform random. By construction, the distribution of $$m_0 \oplus G(s)$$ is the same as the distribution of the PRG. So this quantity is precisely $$\mathcal{B}$$'s advantage.

Therefore for every PRG adversary $$\mathcal{B}$$ there exists a semantic security adversary $$\mathcal{A}$$ with $$PRGAdv(B,G) = SSAdv(A, \mathcal{E}).$$ But since the stream cipher is secure, we know $$SSAdv(A, \mathcal{E})$$ is negligible which tells us the PRG is secure.

Note that $$W_0$$ is precisely the event where $$\mathcal{A}$$ outputs one in experiment zero and $$W_0$$ [sic] is precisely the event where $$\mathcal{A}$$ outputs one in experiment one.
I think the second random variable here should be $$W_1$$, not $$W_0$$.
The challenger responds choosing $$b$$ at random from $$\{0,1\}$$, $$s$$ at random from the PRG seed space and computing $$G(s)$$.
This phrasing makes it seem like the encryption challenger chooses a random key/seed and bit upon receiving the encryption query consisting of two chosen messages. Usually in security games related to encryption, the challenger chooses a random key and bit once at startup, and then uses these values across every $$(m_0, m_1)$$ encryption query. For one-time semantic security (i.e. only needing to encrypt a single message per key), which is the relevant security definition here, this distinction doesn't matter; there is only one $$(m_0, m_1)$$ encryption query that the challenger responds to. It does matter for multiple-message semantic security (i.e. potentially more than one message encrypted per key), as the challenger must respond to potentially many encryption queries $$(m_0, m_1)_0, (m_0, m_1)_1, \ldots$$ using the same key and bit.