\documentclass[11pt]{article}

\usepackage[margin=0.75in]{geometry}
\input{latexdefs}

\begin{document}

\newlength{\boxwidth}
\setlength{\boxwidth}{\textwidth}
\addtolength{\boxwidth}{-2cm}
\noindent\framebox[\textwidth]{
\begin{minipage}[t]{\boxwidth}
  {\bf COMP 537: Cryptography \hfill Fall 2023}  \\ [-0.3cm]
  \begin{center} 
    {\Large Problem Set 3}
  \end{center}
\end{minipage}}
\vspace{0.7cm}

\noindent \textbf{Instructions:} You {\bf must} typeset your
solution in LaTeX using the provided template. Please submit your problem set via Gradescope. Include your name and the names of any collaborators at the top of your submission.

\medskip

\noindent \textbf{Acknowledgment:} Several of the problems in this problem set come from the Boneh-Shoup textbook.

\hrule


\problem{DDH PRG [15 points]}
Let $\G$ be a cyclic group of prime order $q$ generated by $g\in\G$. Consider the following PRG defined over $(\Z^2_q, \G^3)$:
\begin{align*}
G(\alpha,\beta) := (g^\alpha, g^\beta, g^{\alpha\beta}).
\end{align*}

\begin{enumerate}[label=(\alph*), leftmargin=*]
\item Prove that $G$ is a secure PRG assuming that the DDH assumption holds in $\G$.

\item Let $\G$ be the prime order order subgroup of $\Z_{23}^*$ generated by $g=2$. What are the elements of the group $\G$, and what is the order $q$ of group $\G$? In addition to stating the answer, please explain why this is the answer.

\item Let $\G$ be the prime order order subgroup of $\Z_{23}^*$ generated by $g=2$. What is the output of $G(5,6)$?

\textbf{Note:} you should be able to do this without a calculator, but it's ok to use one if you want.

\end{enumerate}


\problem{Non-Binding Signatures [15 points]}
It turns out that secure signatures are not necessarily \emph{binding}. That is, suppose the signer generates a signature $\sigma$ on a message $m$. The definition of a secure signature does not preclude the signer from producing another message $m'\neq m$ for which $\sigma$ is a valid signature. It turns out binding isn't needed for many applications, so it's left out of the definition. That said, many signature schemes we have seen are in fact binding.

\begin{enumerate}[label=(\alph*), leftmargin=*]
\item Please give an example of a signature scheme that is \emph{not} binding: for a given $(\ms{pk}, \ms{sk})$, the signer can find two distinct messages $m_0$ and $m_1$ where the same signature $\sigma$ is valid for both messages under~$\ms{pk}$.

\textbf{Hint:} Consider using a hash and sign approach to building the signature scheme but with the discrete log-based hash function we discussed in class.

\item Describe how the signer can produce a second message for the same signature.

\item Give the intuition for why the scheme is secure. You should state the relevant assumptions and why they are needed, but you don't need to give a proof.
\end{enumerate}

\problem{Attacking RSA-FDH [5 points]}
Consider the RSA-FDH signature scheme. The public key is a pair $(N,e)$ where $N$ is an RSA modulus, and a signature on a message $m\in\calM$ is defined as $\sigma:=H(m)^{1/e}\in\Z_N$, where $H:\calM\to\Z_N$ is a hash function. Suppose the adversary could find three messages $m_1,m_2,m_3\in\calM$ such that $H(m_1)\cdot H(m_2) = H(m_3)$ in $\Z_N$. Show that the resulting RSA-FDH signature scheme is no longer existentially unforgeable under a chosen message attack.

\problem{RSA Signatures with Same Modulus [15 points]}
This problem explores why every party has to be assigned a different modulus $N=pq$ in the RSA trapdoor permutation. Suppose we try to use the same modulus $N=pq$ for everyone. Every party is assigned a public exponent $e_i\in\Z$ and a private exponent $d_i\in\Z$ such that $e_i\cdot d_i = 1\  \ms{ mod } \ \varphi(N)$. At first, this appears to work fine. To sign a message, $m\in\calM$, Alice would publish the signature $\sigma_a \gets H(m)^{d_a}\in\Z_N$ where $H:\calM\to\Z^*_N$ is a hash function. Similarly, Bob would publish the signature $\sigma_b\gets H(m)^{d_b}\in\Z_N$. Since Alice is the only one who knows $d_a$ and Bob is the only one who knows $d_b$, this seems fine.

\noindent Unfortunately, this scheme is completely insecure. Bob can use his secret key $d_b$ to sign messages on behalf of Alice.

\begin{enumerate}[label=(\alph*), leftmargin=*]
\item Show that Bob can use his public-private key pair $(e_b, d_b)$ to obtain a multiple of $\varphi(N)$. Denote this integer by $V$.

\item Suppose Bob knows Alice's public key $e_a$, and assume for now that $e_a$ is relatively prime to $V$. Show that for any message $m\in\calM$, Bob can compute $\sigma\gets H(m)^{1/e_a}$. In other words, Bob can invert Alice's trapdoor permutation and obtain her signature on $m$.

\textbf{Hint.} Recall since $e_a$ and $V$ are relatively prime, Bob can find an integer $d$ such that  $d\cdot e_a = 1$ mod $V$, i.e., Bob can compute the inverse of $e_a$ mod $V$.

\item Show how to make your solution in part (b) work even if $e_a$ is not relatively prime to $V$.
\end{enumerate}


\paragraph{Optional Feedback [5 points].} Please answer the following questions to
help design future problem sets. You are not required to answer these questions (the points are free),
and if you would prefer to answer anonymously, please use the anonymous feedback form.
However, we do encourage you to provide feedback on how to improve the course experience.
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Roughly how long did you spend on this problem set?

  \item What was your favorite problem on this problem set?

  \item What was your least favorite problem on this problem set?

  \item Any other feedback for this problem set? Was it too easy/difficult?

  \item Any other feedback on the course so far?

\end{enumerate}


\end{document}
