 Cryptographic distinguishing advantage

Cryptographic distinguishing advantage measures how differently a specified test behaves on two distributions or experiments. For a binary-output distinguisher $D$ and distributions $X,Y$, one common definition isA cryptographic security game must state its convention and the allowed computation and observations. Provable security uses such quantitative bounds together with the resources required by a security reduction.^[ref]

An original two-world example explains a common normalization difference. Let $X$ be a bit equal to one with probability $3/4$, and $Y$ a bit equal to one with probability $1/4$. The test $D(x)=x$ has ${\Delta }_D=1/2$. If a challenger selects the world with equal prior probability and the observer guesses X on output one and Y on output zero, its success probability is $3/4$. Its advantage above random guessing is $1/4$, half the probability-gap convention.

In general, orienting the decision rule toward the larger probability givesThus a statement of advantage $0.02$ can mean either a probability gap of $0.02$ or a success probability $0.52$, depending on the convention. The numerical security claim is incomplete until that choice is specified.

If every event test is allowed, the largest probability gap is total variation distance. Restricting the distinguisher to an efficient algorithm yields a computational notion: distributions can differ substantially statistically while being difficult for a resource-bounded observer to distinguish. Computational indistinguishability describes the asymptotic version indexed by a cryptographic security parameter.

For any fixed $D$, adding and subtracting its intermediate acceptance probability givesFor example, bounds $0.003$ and $0.004$ on two successive changes give an overall bound $0.007$. This simple triangle inequality explains how a sequence of controlled experiment changes can support a security argument. The distributions, permitted observers and resource costs must remain the ones justified at each step.