Reading through the book Introduction to Modern Cryptography by Katz/Lindell, I'm having some trouble understanding this part.
(It's on p.178 in 2e, chapter 5.5)
What I'm struggling with are:
- How the assumption that A only outputs values previously queried does not harm generality?
- Why is the probability that A succeeds is upper-bounded by the probability that $H(x_i)=H(x_j)$ for some distinct $i$ and $j$.
As they mentioned that is clear, I bet this would not require such long explanation, but as a newbie to cryptography, I'm confused. Can someone please help me with this? Thank you in advance.