Games

Fall 2026 · University of Illinois Urbana–Champaign

Longer than a demo. A demo shows you one idea in a few minutes; a game asks you to carry a whole proof yourself, and takes fifteen to twenty. Each one runs entirely in your browser — nothing is installed, nothing is uploaded, and reloading starts over. Both have sound, and both have a mute control. Every choice is keyboard reachable, and every game carries the formal statement of what you just proved, so nothing here replaces the textbook — it rehearses it.

Pseudorandomness

Week 2 · KL 3.1–3.3, Theorem 3.18. Two different games about the same theorem: that a pseudorandom generator already gives you an eavesdropper-secure encryption scheme. Play either one — or both, since they attack the proof from opposite ends.

• The Distinguisher's Table

  You are not fighting the adversary; you are the distinguisher. The challenger deals you a string w that came from one of two sources and will not say which, and your only asset is Ā, an eavesdropper under contract who beats Enc(k, m) = G(k) ⊕ m with advantage ε. Turn Ā's talent into an answer about w.

  The reduction is the combat system. You assemble D over four turns; two of the wrong answers cannot be built at all and say why — the challenger never issues the seed, and searching w for G's image works perfectly and costs 2ⁿ — while three of them build a machine that runs and quietly fails, so you deal a few rounds, watch the evidence meter refuse to move, and get sent back to the forge. Then the rounds: every hand tilts a meter between the two hypotheses, BREAK unlocks the call at 20 : 1 odds, and Boost spends BP to deal ten, a hundred or a thousand hands at once.

  Four tables, at ε = 0.25, 0.08, 0.02 and 2⁻⁶⁴. The first three are won; the fourth cannot be, and recognising that is the point — the hands you need grow like 1/ε², and at 2⁻⁶⁴ that is outside every polynomial. Which is exactly what negligible means.

  • Assemble D
  • Deal, Boost, Break
  • Call the source
  • Four tables
  • The theorem

  PRG ⟹ EAV security · playing the distinguisher Week 2, Tue 9.1 · KL 3.3, Theorem 3.18 ≈ 15 minutes distinguishers-table.html

• Reduction Quest

  The same theorem from the other side. A reductionist cannot out-fight anything; the whole power is using the adversary as a component. So this game refuses to let you attack him: you assume he exists, seat him inside a distinguisher you assemble yourself, and aim that machine at G.

  In the Forge you seat six instructions into D in order, choosing from eleven cards; the five traps are the mistakes that actually get made — ignoring the challenge string and generating your own G(k), telling the adversary the coin, outputting b′ instead of [b′ = b]. In the boss fight you argue the two worlds, and the gap between the two probability bars is ε. The in-game Codex carries the formal statements — the PRG definition, PrivK^eav, the pseudocode for D, the two probabilities, and a page on where reductions go wrong.

  • The Forge
  • Eleven cards, five traps
  • The two worlds
  • Codex

  PRG ⟹ EAV security · building the reduction Week 2 · KL 3.1–3.3 ≈ 20 minutes reduction-quest.html