In your "The security of the scheme " the calculation of $L_i$ will still need the $t$th point right? Therefore, $s$ should depend on not just $v_t$ but $x_t$ as well.

K should be k in your explaination @fkraiem

@AlexanderCska $$Pr[C=c|M=m'] = Pr[K=m'\oplus c]$$ given $M = m'$ to get $C=c$ we must use $K=m'\oplus c$ as $m'\oplus m' \oplus c = c$ now since we generate a random n bit key we will get a particular key with probability $\frac{1}{2^n}$

To extend a bit upon your answer, in case of RSA we choose a number N s.t. N=pq (p and q being prime), hence 𝜙N = (p-1)(q-1). Pohlig-Hellman is RSA with q=1, hence, 𝜙N = 𝜙p = (p-1). What makes RSA strong is our inability to calculate 𝜙 N easily even if you know N, which isnt the case in Pohlig-Hellman.

breaks the continuity of the conversation but ok :)

I agree with you @poncho, I cannot edit my comment but I mistakingly commented that q=2 whereas it is q=1.