Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Sometimes, we use $1$ to represent "succeed". In CPA, if the adversary guesses $b'=b$ outputs $1$. But I am confusing about the meanings of the following $1$.
Does $1$ mean succeed or output the same thing？
If we write $$\Pr[\mathcal A(g,g^a,g^b,g^{ab})=1]-\Pr[\mathcal A(g,g^a,g^b,g^c)=1]\le\operatorname{negl}(n)$$ without an absolute value, meaning that the (distinguisher) algorithm $\mathcal A$ is not good enough to breach security, it is implicit that $\mathcal A$ outputs $1$ more likely when it has recognized something special. That something special is the condition that should be near impossible to recognize for security to hold. In the context, that special thing ideally is: for input $(g,g^a,g^b,g^c)$, the condition $g^c=g^{ab}$ holds. But an algorithm that does not exactly recognize that condition is still a valid distinguisher (breaking security) if it manages to make the overall condition false.
It is often written $$\big|\,\Pr[\mathcal A(g,g^a,g^b,g^{ab})=1]-\Pr[\mathcal A(g,g^a,g^b,g^c)=1]\,\big|\le\operatorname{negl}(n)$$ and, thanks to the absolute value, it becomes immaterial if the special condition tends to make $\mathcal A$ output of $1$ or $0$, because $$\big|\,(1-p)-(1-p')\,\big|\ =\ \big|\,p-p'\,\big|$$ Now, the only thing that matters is that the output of $\mathcal A$ has a significantly different mean over the inputs of the form $(g,g^a,g^b,g^{ab})$ than it has over the inputs of the form $(g,g^a,g^b,g^{ab})$.
