Game Hopping in Lean

2026-08-06

AI Summary

This work addresses the lack of a composable, verifiable framework for mechanized cryptographic proofs that integrates with general-purpose mathematical libraries. It introduces HOPSCOTCH, the first game-hopping proof framework deeply integrated with Lean 4’s Mathlib, which models security definitions as indistinguishability between stateful probabilistic oracles via shallow embedding and employs state abstraction to enable flexible oracle transformations. The framework formalizes the structure of game-hopping reasoning, automates the derivation of computational soundness theorems, and successfully verifies the IND-CCA security of Encrypt-then-MAC, the security of ElGamal under the DDH assumption, the reduction from one-time secrecy to public-key IND-CPA, and the first mechanized proof of a non-constant-depth GGM pseudorandom function construction.

Abstract

We present HOPSCOTCH, a Lean 4 framework for mechanizing computationally sound, game-based cryptographic proofs. Security definitions are expressed as indistinguishability between stateful probabilistic oracles, and proofs follow the standard game-hopping paradigm. HOPSCOTCH uses a shallow embedding: oracles and reductions are ordinary Lean definitions, enabling direct integration with the full Lean ecosystem, including general mathematical theories from Mathlib, such as finite-group theory. A game-hopping proof in HOPSCOTCH is represented as an explicit formal object whose constructors correspond to the standard steps of a game-hopping argument, making proofs easier to construct, automate, and inspect. We prove a general computational soundness theorem that interprets these proof objects by constructing reductions against the assumptions they use and deriving a concrete bound on the advantage of any distinguisher. Observational equivalence between oracles is established using a state-abstraction methodology: a simple yet powerful approach that supports transformations such as adding or forgetting state and replacing eager sampling with lazy sampling. We illustrate the framework with formalized proofs of the IND-CCA security of encrypt-then-MAC, the security of ElGamal encryption from DDH, the implication from one-time secrecy to public-key IND-CPA security, and the GGM pseudorandom-function construction. To the best of our knowledge, the last is the first mechanized proof of GGM for non-constant depth.

Problem

• game-based proofs
• computational soundness
• formal verification
• cryptographic security
• mechanized reasoning

Innovation

• game-hopping
• shallow embedding
• computational soundness
• state abstraction
• mechanized cryptography