\documentclass[11pt]{article}

\usepackage[margin=0.75in]{geometry}
\input{latexdefs}

\begin{document}

\newlength{\boxwidth}
\setlength{\boxwidth}{\textwidth}
\addtolength{\boxwidth}{-2cm}
\noindent\framebox[\textwidth]{
\begin{minipage}[t]{\boxwidth}
  {\bf COMP 537: Cryptography \hfill Fall 2023}  \\ [-0.3cm]
  \begin{center} 
    {\Large Problem Set 1}
  \end{center}
\end{minipage}}
\vspace{0.7cm}

\noindent \textbf{Instructions:} You {\bf must} typeset your
solution in LaTeX using the provided template. Please submit your problem set via Gradescope. Include your name and the names of any collaborators at the top of your submission.

\medskip

\noindent \textbf{Acknowledgment:} Several of the problems in this problem set come from the Boneh-Shoup textbook.

\hrule


\paragraph{Problem 1: One-Time Caesar [15 points].}
Consider a cipher with keyspace $\calK=\{0,...,25\}^n$ and message/ciphertext spaces $\calM=\calC=\{\ms{A}, \ms{B}, ..., \ms{Z}\}^n$ (length-$n$ strings of letters of the English alphabet). Define the encryption operation $\ms{Enc}(k,m)$ as follows, where we denote the $i$th character of a message or key $x$ by $x_i$, i.e., $x=x_1x_2...x_n$.\\
\begin{denseitemize}
\item[] $\ms{Enc}(k,m):$
\item[] for $i$ from $1$ to $n$:
\item[] \hspace{3em} Let $c_i$ be $m_i$ shifted forward by $k_i$ characters, wrapping around if we pass $\ms{Z}$.
\item[] output $c$.
\end{denseitemize}

\begin{enumerate}[label=(\alph*), leftmargin=*]
    \item What is the difference between this cipher and the insecure Caesar cipher?

    \item Write down the definition of perfect secrecy. You can just type up the exact definition that's in the lecture notes.

    \item Prove that this cipher has perfect secrecy.

\end{enumerate}


\paragraph{Problem 2: Exercising the PRG definition [15 points].}

Suppose $G$ is a secure PRG that outputs bit strings in $\zo^n$. Which of the following generators derived from $G$ are secure? For each one, either state ``secure'' or ``insecure'' followed by a short (1-2 sentence) justification. If it's insecure, your justification should state an attack on PRG security. Note: we use both the $x||y$ and $(x,y)$ notations to denote concatenation.

\begin{enumerate}[label=(\alph*), leftmargin=*]
    \item $G'(s) = (G(s), G(s))$

    \item $G'(s) = G(s) \oplus 1^n$

    \item $G'(s_1 || s_2) = G(s_1) \oplus G(s_2)$

    \item $G'(s_1 || s_2) = G(s_1) \wedge G(s_2)$ where $\wedge$ denotes bitwise AND

    \item $G'(s_1 || s_2) = (s_1, G(s_2))$

\end{enumerate}

\paragraph{Problem 3: Encryption and Compression [10 points].}
Suppose two standards committees propose to save bandwidth by combining (lossless) compression with encryption. Both committees plan on using a variable-length one-time pad for encryption.

\begin{enumerate}[label=(\alph*), leftmargin=*]
\item One committee proposes to compress messages before encrypting them. Explain why this is a bad idea.
\newline[\textbf{Hint:} Recall that compression can significantly shrink the size of some messages while having little impact on the length of other messages.]


\item The other committee proposes to compress ciphertexts after encryption. Explain why this is a bad idea.

\end{enumerate}

\noindent\textbf{Note:} Over the years, many problems have surfaced when combining encryption and compression, including multiple attacks on widely-used cryptographic schemes.


\paragraph{Problem 4: Self-Referential Encryption [10 points].}

Let us show that encrypting a key under itself can be dangerous. Let $\calE$ be a (one-time) semantically secure cipher defined over $(\calK, \calM, \calC)$, where $\calK\subseteq\calM$, and let $k\getsr\calK$. A ciphertext $c_* := \ms{Enc}(k,k)$ that encrypts $k$ using $k$ is called a \emph{self referential encryption}.

\begin{enumerate}[label=(\alph*), leftmargin=*]
    \item Construct a cipher $\calE'=(\ms{Enc}',\ms{Dec}')$ derived from $\calE$ such that $\calE'$ is semantically secure, but becomes insecure if the adversary is given $\ms{Enc}'(k,k)$ at the beginning of the semantic security game. Please provide the cipher, the attack, and a 1-2 sentence explanation for why it remains semantically secure if the adversary is not given $\ms{Enc}'(k,k)$. You do not need to give a full proof for this part.

    \item Construct a cipher $\calE'=(\ms{Enc}',\ms{Dec}')$ derived from $\calE$ such that $\calE'$ is semantically secure and remains semantically secure (provably) even when the adversary is given $\ms{Enc}'(k,k)$ at the beginning of the semantic security game. To prove that $\calE'$ is semantically secure, you should show the following: for every adversary $\calA$ that attacks $\calE'$, there exists an adversary $\calB$ that attacks $\calE$ such that (i) the running time of $\calB$ is about the same as that of $\calA$, and (ii) $\ms{SSAdv}[\calA, \calE']\leq \ms{SSAdv}[\calB, \calE] + \ms{negl}.$

\end{enumerate}


\paragraph{Optional Feedback [5 points].} Please answer the following questions to
help design future problem sets. You are not required to answer these questions (the points are free),
and if you would prefer to answer anonymously, please use the anonymous feedback form.
However, we do encourage you to provide feedback on how to improve the course experience.
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Roughly how long did you spend on this problem set?

  \item What was your favorite problem on this problem set?

  \item What was your least favorite problem on this problem set?

  \item Any other feedback for this problem set? Was it too easy/difficult?

  \item Any other feedback on the course so far?

\end{enumerate}

\end{document}
