Cloud-computing security, Spring 2013 Homework Assignment 3 Due: 9:10, May 10, 2013 1. Assume a public-key encryption scheme for single-bit messages. Show that, given pk and a ciphertext c computed via c ← Encpk (m), it is possible for an unbounded adversary to determine m with probability 1. This shows in particular that perfectly-secret public-key encryption is impossible. 2. Say a deterministic public-key encryption scheme is used to encrypt a message m that is known to lie in a small set of N possible values. Show how it is possible to determine m in time linear in N . 3. Let p = 11, q = 23, and e = 3. Encrypt the binary message m = 0111001 using the textbook RSA with respect to the key pk = hN = pq, ei. Then decrypt the ciphertext. You can either write a software program to help you carry out the computation or use a calculator to accomplish the task. 4. Imagine that a company wants to use the same modulus N for each of its employees for the textbook RSA. Since it is not desirable for messages encrypted to one employee to be read by any other employee, the company issues different (ei , di ) to each employee. That is, the public key of the ith employee is pki = hN, ei i and their private key is sk = hN, di i, where ei · di = 1 mod φ(N ) for all i. Show that this approach is insecure in the sense that it allows any employee to read messages encrypted to all other employees. 5. Here we show a scenario indicating that sharing a modulus is really a bad idea. Say the same message m is encrypted and sent to two different (known) employees with public keys (N, e1 ) and (N, e2 ) (e1 6= e2 ). Assume further than gcd(e1 , e2 ) = 1. Then an eavesdropper sees the two ciphertexts c1 = me1 mod N and c2 = me2 mod N . Show that this allows the eavesdropper to decrypt m without knowing any private keys.

1