Final 11

CS255: Cryptography and Computer Security Winter 2011
Final Exam
Instructions:
− Answer all five questions.
− The exam is open book and open notes. Wireless devices are not allowed.
− Students are bound by the Stanford honor code.
− You have two hours.
Problem 1. Questions from all over.
a. Can a symmetric cipher that uses deterministic encryption (with no nonce) be semantically
secure under a chosen plaintext attack? If so, explain why. If not, describe a chosen
plaintext attack.
b. When building a CBC-MAC from AES one has to properly handle messages whose length
is not a multiple of 16 bytes. Describe one method to do so that results in a secure
MAC.
c. Suppose Alice bought a certificate from certificate authority X. Alice intends to use the
certificate to issue signatures in her name (e.g. to sign code that Alice develops). If X is
malicious, can it forge Alice’s signature on rogue malware? More precisely, can X fool a
verifier into believing that a certain rogue malware was written by Alice? If so explain
how, if not explain why not. You may assume the verifier has not seen signatures from
Alice before.
d. Describe a concrete attack that is prevented by challenge-response authentication, but is
not prevented by authentication based on one-time passwords. Please be specific when
describing how an attacker defeats the one-time password scheme.
Problem 2. Let F be a secure PRF defined over (K, X , {0, 1}n ). Which of the following is a
secure PRF? Justify your answer.
a. F1 ( (k1 , k2 ), x) := F (k1 , x) ⊕ F (k2 , x).

b. F2 ( (k1 , k2 ), x) := F (k1 , x) ∧ F (k2 , x). Here u ∧ v is the bit-wise and of u and v.
c. F3 (k, x) := F (k, x)|1...4 .(for y ∈ {0, 1}n , y|1...4 are the 4 least significant bits of y)
(
F (k1 , x) if F (k2 , x) = 0, and
d. n = 128 and F4 ( (k1 , k2 ), x) :=
F (k2 , x) otherwise
e. Same as part (d), but with n = 1.
f. Treat {0, 1}n as the integers {0, . . . , 2n − 1} with multiplication modulo 2n . Let n = 128
and define F5 ( (k1 , k2 ), x) := F (k1 , x) · F (k2 , x).
1
Problem 3. In this question we look at concrete security of CBC and counter modes.
a. Let F be a secure PRF defined over (K, {0, 1}32 , Y), namely F has domain is {0, 1}32 .
Suppose we construct a symmetric cipher from this F using randomized counter mode.
We plan to use this cipher to encrypt two movies with the same key, where each movie
contains 232 blocks of F . Will the cipher provide semantic security under a chosen
plaintext attack in these settings (i.e. where the attacker sees the encryption of two
messages of his choice, each 232 blocks long)? If so, explain why. If not, describe a
chosen plaintext attack that breaks semantic security.
Note: if you describe a chosen plaintext attack, the attacker should query for the
encryption of one message of his choice and then use that to solve a semantic security
challenge. In total the attacker is given two ciphertexts.
b. Let π be a secure PRP defined over (K, {0, 1}64 ). Suppose we construct a symmetric
cipher from this π using randomized CBC mode (CBC mode with a random IV). As
before, we plan to use this cipher to encrypt two movies with the same key, where each
movie contains 232 blocks of π. Will the cipher provide semantic security under a chosen
plaintext attack in these settings (i.e. where the attacker sees the encryption of two
messages of his choice, each 232 blocks long)? If so, explain why. If not, describe a
chosen plaintext attack that breaks semantic security using the note from part (a).
Hint: consider the effect of the birthday paradox.
Problem 4. One-time signatures from discrete-log. Let G be a cyclic group of prime order q with
generator g. Consider the following signature system for signing messages m in Zq :
R
KeyGen: choose x, y ← Zq , set h := g x and u := g y .
output sk := (x, y) and pk := (g, h, u) ∈ G3 .
Sign(sk, m): output s such that u = g m hs .
Verify(pk, m, s): output ‘1’ if u = g m hs and ‘0’ otherwise.
a. Explain how the signing algorithm works. That is, show how to find s using sk.
b. Show that the signature scheme is weakly one-time secure assuming the discrete-log prob-
lem in G is hard. That is, suppose there is an adversary A that asks for a signature on
a message m ∈ Zq and in response is given the public key pk and a signature s on m.
The adversary then outputs a signature forgery (m∗ , s∗ ) where m 6= m∗ . Show how to
use A to compute discrete-log in G. This will prove that the signature is secure as long
as the adversary sees at most one signature.
Hint: Your goal is to construct an algorithm B that given a random h ∈ G outputs an
x ∈ Zq such that h = g x . Your algorithm B runs adversary A and receives a message
m from A. Show how B can generate a public key pk = (g, h, u) so that it has a
signature s for m. Your algorithm B then sends pk and s to A and receives from A a
signature forgery (m∗ , s∗ ). Show how to use the signatures on m∗ and m to compute
the discrete-log of h base g.
c. Show that this signature scheme is not 2-time secure. Given the signature on two distinct
messages m0 , m1 ∈ Zq show how to forge a signature for any other message m ∈ Zq .
d. Explain how you would extend this signature scheme to sign arbitrary long messages rather
than just messages in Zq .
2
Problem 5. In class we showed a collision resistant hash function from the discrete-log problem.
Here let’s do the same, but from the RSA problem. Let n be a random RSA modulus, e a
prime relatively prime to ϕ(n), and u random in Z∗n . Show that the function
Hn,u,e : Z∗n × {0, . . . , e − 1} → Z∗n defined by Hn,u,e (x, y) := xe uy ∈ Zn
is collision resistant assuming that taking e’th roots modulo n is hard.

Suppose A is an algorithm that takes n, u as input and outputs a collision for Hn,u,e (·, ·).
Your goal is to construct an algorithm B for computing e’th roots modulo n.
a. Your algorithm B takes random n, u as input and should output u1/e . First, show how to
use A to construct a ∈ Zn and b ∈ Z such that ae = ub and 0 6= |b| < e.
b. Clearly a1/b is an e’th root of u (since (a1/b )e = u), but unfortunately for B, it cannot
compute roots in Zn . Nevertheless, show how B can compute a1/b . This will complete
your description of algorithm B and prove that a collision finder can be used to compute
e’th roots in Z∗n .
Hint: since e is prime and 0 6= |b| < e we know that b and e are relatively prime. Hence,
there are integers s, t so that bs + et = 1. Use a, u, s, t to find the e’th root of u.
c. Show that if we extend the domain of the function to Z∗n × {0, . . . , e} then the function is
no longer collision resistant.

Final 11

Uploaded by

Copyright:

Available Formats

Final 11

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Final 11

Uploaded by

Copyright:

Available Formats

CS255: Cryptography and Computer Security Winter 2011

Problem 1. Questions from all over.

a. F1 ( (k1 , k2 ), x) := F (k1 , x) ⊕ F (k2 , x).

Hn,u,e : Z∗n × {0, . . . , e − 1} → Z∗n defined by Hn,u,e (x, y) := xe uy ∈ Zn

is collision resistant assuming that taking e’th roots modulo n is hard.

You might also like