Games

Fall 2026 · University of Illinois Urbana–Champaign

Longer than a demo. A demo shows you one idea in a few minutes; a game asks you to carry a whole proof yourself, and takes fifteen to twenty. Each one runs entirely in your browser — nothing is installed, nothing is uploaded, and reloading starts over. Both have sound, and both have a mute control. Every choice is keyboard reachable, and every game carries the formal statement of what you just proved, so nothing here replaces the textbook — it rehearses it.

Pseudorandomness

Week 2 · KL 3.1–3.3, Theorem 3.18. Two different games about the same theorem: that a pseudorandom generator already gives you an eavesdropper-secure encryption scheme. Play either one — or both, since they attack the proof from opposite ends.

• The Distinguisher's Table

  You are not fighting the adversary; you are the distinguisher. The challenger deals you a string w that came from one of two sources and will not say which, and your only asset is Ā, an eavesdropper under contract who beats Enc(k, m) = G(k) ⊕ m with advantage ε. Turn Ā's talent into an answer about w.

  The reduction is the combat system. You assemble D over four turns; two of the wrong answers cannot be built at all and say why — the challenger never issues the seed, and searching w for G's image works perfectly and costs 2ⁿ — while three of them build a machine that runs and quietly fails, so you deal a few rounds, watch the evidence meter refuse to move, and get sent back to the forge. Then the rounds: every hand tilts a meter between the two hypotheses, BREAK unlocks the call at 20 : 1 odds, and Boost spends BP to deal ten, a hundred or a thousand hands at once.

  Four tables, at ε = 0.25, 0.08, 0.02 and 2⁻⁶⁴. The first three are won; the fourth cannot be, and recognising that is the point — the hands you need grow like 1/ε², and at 2⁻⁶⁴ that is outside every polynomial. Which is exactly what negligible means.

  • Assemble D
  • Deal, Boost, Break
  • Call the source
  • Four tables
  • The theorem

  PRG ⟹ EAV security · playing the distinguisher Week 2, Tue 9.1 · KL 3.3, Theorem 3.18 ≈ 15 minutes distinguishers-table.html

• Reduction Quest

  The same theorem from the other side. A reductionist cannot out-fight anything; the whole power is using the adversary as a component. So this game refuses to let you attack him: you assume he exists, seat him inside a distinguisher you assemble yourself, and aim that machine at G.

  In the Forge you seat six instructions into D in order, choosing from eleven cards; the five traps are the mistakes that actually get made — ignoring the challenge string and generating your own G(k), telling the adversary the coin, outputting b′ instead of [b′ = b]. In the boss fight you argue the two worlds, and the gap between the two probability bars is ε. The in-game Codex carries the formal statements — the PRG definition, PrivK^eav, the pseudocode for D, the two probabilities, and a page on where reductions go wrong.

  • The Forge
  • Eleven cards, five traps
  • The two worlds
  • Codex

  PRG ⟹ EAV security · building the reduction Week 2 · KL 3.1–3.3 ≈ 20 minutes reduction-quest.html

• Ladder of Nagara

  A sequel to Reduction Quest, a year later in the same village; it stands alone. The seal held for one letter, and the council has been sending four a season under the same key — which the proof you wrote last year says exactly nothing about. It opens by showing you a seal where the answer is genuinely no: two letters through a deterministic press, and the adversary wins with probability one, not ¹⁄₂ + ε.

  The obstacle is arithmetic. Adversarius names two bundles differing in all four slots; the one-message challenger deals exactly one ciphertext, so whatever bundle your machine builds, its two worlds differ in one slot. You lay a ladder of hybrids between the ends — each rung a bundle one letter above the last, with the illegal rungs (two slots at once, a letter from neither bundle, the jump straight to the top) offered alongside — then forge A′ from eleven cards. One of the five traps was the correct card in the first game: there D flipped its own coin and scored the adversary, here the challenger holds the coin and A′ can only relay him. The Seal-house — the encryption oracle — is what makes any of it buildable, and the game is blunt that without it the theorem is false.

  • The old press
  • The Seal-house
  • Build the ladder
  • Forge A′
  • Codex

  CPA security for multiple encryptions · the hybrid argument Week 2 · KL 3.4 ≈ 20 minutes ladder-of-nagara.html

Message authentication

Message authentication codes · KL 4.1–4.4. Unforgeability from the attacker's chair: you are handed the tags of a few messages and must produce a valid tag for one you were never given. Every gate is a different broken construction, and each is checked against a real (simulated) PRF — so only a genuine forgery opens it.

• Sealed Valley

  A serene, Monument-Valley-style climb where the puzzle mechanic is the forgery. You play the adversary in the MAC unforgeability game: a stone tablet lists the (message, MAC) pairs you already hold, and a sealed gate opens only for a message that is not on that tablet yet carries a tag the verifier accepts. Build the forged message on the pillars, assemble its tag from the scrolls you were given, and submit it — the seal runs the real check, rejecting any message you were already handed (a tag on a known message is no forgery) and any tag that does not verify.

  Five gates, one per classic attack on a naïve MAC: reordering when tags ignore position, truncation when nothing binds the length, splicing when blocks of one message are not tied together, the randomized-IV CBC-MAC forgery where the attacker also chooses the transmitted IV, and the appended-length CBC-MAC forgery where the public length block is re-injected as data. Clear a gate and it states plainly why the forgery worked and the fix that kills it — bind the index, bind the length, add per-message randomness, fix IV = 0, and prepend the length for a prefix-free encoding.

  • Given (message, MAC)
  • Forge & submit
  • Five gates
  • Why it works
  • The fix

  MAC unforgeability · forging the tag yourself Message authentication codes · KL 4.1–4.4 ≈ 15 minutes sealed-valley.html