CS-NC-616: Foundations of Cryptography Problem Set II, Session 2015-16

1. Let G : {0, 1}n → {0, 1}`(n) be a PRG. Are the following constructions also a PRG: def

(a) G0 (k) = reverse(G(k)). def

(b) G0 (k) = G(k)||0. 2. Let Π = (Gen, Enc, Dec) be a COA-secure scheme. Determine whether the following modifications of Enc retain COA-security: def

(a) Enc0 k (m) = Enck (m)||k. def

(b) Enc0 k (m) = 0||Enck (m). 3. Consider a PRG G : {0, 1}∗ → {0, 1}∗ . Then prove whether the following construction is a PRG or not: G1 (s, t) = G(s)||t where |s| = |t|. 4. Consider a PRG G and define a function G0 (s) to be the output of G truncated to n bits (where |s| = n). Prove whether the following function is a PRF or not: Fk (x) = G0 (k) ⊕ x. 5. Let F be a length-preserving PRP; define the following fixed-length encryption scheme for encrypting messages of n/2 bits: on input m ∈ {0, 1}n/2 and k ∈ {0, 1}n , the encryption algorithm Enc selects a random string r ∈ {0, 1}n/2 and outputs c ← Fk (r||m). (a) Write down the corresponding decryption algorithm. (b) Prove whether this scheme is CPA-secure or not. 6. Consider a PRP F and a PRG G. For the following encryption schemes, find whether the scheme achieves COAsecurity and whether it is CPA-secure; in all these scheme the key-generation algorithm selects a key randomly from {0, 1}n : (a) To encrypt a message m, compute Fk (0) and output the ciphertext c = m ⊕ Fk (0). (b) To encrypt a message m, choose a random r, compute Fk (r ⊕ m) and output the ciphertext c = (r, Fk (r ⊕ m)).

1