\documentclass[11pt]{article}

\usepackage[margin=0.75in]{geometry}
\input{latexdefs}

\begin{document}

\newlength{\boxwidth}
\setlength{\boxwidth}{\textwidth}
\addtolength{\boxwidth}{-2cm}
\noindent\framebox[\textwidth]{
\begin{minipage}[t]{\boxwidth}
  {\bf COMP 537: Cryptography \hfill Fall 2023}  \\ [-0.3cm]
  \begin{center} 
    {\Large Problem Set 4}
  \end{center}
\end{minipage}}
\vspace{0.7cm}

\noindent \textbf{Instructions:} You {\bf must} typeset your
solution in LaTeX using the provided template. Please submit your problem set via Gradescope. Include your name and the names of any collaborators at the top of your submission.

\hrule

\problem{Conceptual Questions [16 points]}
For each of the following statements, say whether it is TRUE or FALSE. Write \emph{at most one sentence} to justify your answer.

\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Which of the following are true in a world where $\mathsf{P}=\mathsf{NP}$.
  \begin{enumerate}
    \item[i] Secure PRFs exist in the standard model.
    \item[ii] Secure PRFs exist in the random oracle model.
    \item[iii] The one-time-pad cipher is secure.
  \end{enumerate}

	\item If there exists a PRG with 1-bit stretch, there exists a PRG with $n^{800}$-bit stretch (where $n$ is the length of the PRG seed).

  \item Let $P\colon\calK\times\calX \to \calX$ be a pseudorandom permutation. Then:
    \begin{enumerate}
        \item[i] $f_{k=0}(x)\deq P(0,x)$ is (always) a one way function.

        \item[ii] $f_{k=0}(x)\deq P(0,x)$ is (always) a one way permutation.

        \item[iii] $f_{x=0}(k)\deq P(k,0)$ is (always) a one way function.

        \item[iv] $f_{x=0}(k)\deq P(k,0)$ is (always) a one way permutation.
    \end{enumerate}

\end{enumerate}


\problem{Multi-Commitments [10 points]}

Let $\G$ be a group of prime order $q$ in which the discrete logarithm problem is hard.
Let $g$ and $h$ be generators of $\G$.
As we saw in class,
the Pedersen commitment scheme commits to a message $m \in \Z_q$
using randomness $r \in \Z_q$ as $\Comm(m; r) \deq g^m h^r \in \G$. Moreover, we saw that Pedersen commitments are \emph{additively homomorphic}, meaning that given commitments to $m_1$ and $m_2$, one can compute a commitment to $m_1+m_2$.
The ``public parameters'' associated with the Pedersen commitment scheme
are the description of the prime-order group
$\G$ and the group elements $g$ and $h$.

\begin{enumerate}[label=(\alph*), leftmargin=*]
\item Use $\G$ to construct an additively homomorphic commitment scheme $\Comm_n(m_1, \dots, m_n; r)$
      that commits to a length-$n$ vector of messages $(m_1, \dots, m_n) \in \Z_q^n$
		using randomness $r \in \Z_q$. The output of the commitment should be short -- only a single group element.
    You should specify both the public parameters of your scheme (which may be different from
      that of the basic Pedersen commitment scheme) as well as the description of the
      $\Comm_n$ function.

      You do not need to prove (or even argue for) the security of your scheme, but the resulting scheme should be perfectly hiding and computationally binding assuming hardness of discrete log in $\G$.

\item Show that if you are given a hash function $H \colon \Z_q \to \G$
      (modeled as a random oracle), the public parameters for your
      construction from Part~(a) only needs to consist of the description
      of the group $\G$ and the description of $H$.
      Argue {\em informally} why your modification to the construction is secure. You do {\em not}
      need to provide a formal proof. This problem shows that
      getting rid of public parameters is
      another reason why random oracles are useful in practice!

\end{enumerate}

\problem{ZK Conceptual Questions [12 points]}

For each of the following statements, say whether it is
TRUE or FALSE. Write \textit{at most one sentence} to justify
your answer.

\begin{enumerate}[label=(\alph*), leftmargin=*]
	\item Let $\langle P, V \rangle$ be a zero-knowledge interactive protocol for some language. The protocol has perfect completeness and soundness error $1/3$.
	\begin{enumerate}
		\item[i] A malicious verifier interacting with an honest prover will always accept a true statement.
		\item[ii] An honest verifier interacting with a malicious prover will ``learn nothing'' besides the statements validity.
	\end{enumerate}

	\item Consider a modified version of Schnorr's signature in which the signing
	nonce $r$ is computed as $r \gets H(m)$, where $H: \zo^* \to \Z_q$ is a
	hash function (modeled as a random oracle), $m$ is the message to be signed, and $q$ is the order
	of the group used for the signature scheme.
	This deterministic version of Schnorr's signature scheme is secure.

	\item The security of the Fiat-Shamir transform implies that a sigma protocol with a random challenge and soundness 1/2 can be \emph{directly} converted to a NIZK by replacing the challenge message with a hash, so long as the hash function is modeled as a random oracle.

\end{enumerate}

\problem{Sigma Protocol for Circuit Satisfiability [15 points]}

Let $\cSAT$ be the language of satisfiable Boolean circuits%
%
\footnote{A boolean circuit is modeled as a directed acyclic graph where each node represents either a gate or an input to the circuit (if it has in-degree zero). You can assume without loss of generality that a Boolean circuit consists of only \textsc{xor} and \textsc{and} gates.}
%
:
\[ \cSAT = \left\{ C \colon \zo^n \to \zo \mid n\in\N,\: \exists (x_1, \ldots,
x_n) \in \zo^n \text{ such that } C(x_1, \ldots, x_n) = 1 \right\}\,.
\]
Let $\Comm \colon \zo \times \calR \to \calC$ be a perfectly-binding and computationally-hiding
commitment scheme with message
space $\zo$, randomness space $\calR$, and commitment space $\calC$. Suppose
that there exist Sigma protocols $\pro{P_{\textsc{xor}}, V_{\textsc{xor}}}$
and $\pro{P_{\textsc{and}}, V_{\textsc{and}}}$ for languages $\calL_{\textsc{xor}}$ and $\calL_{\textsc{and}}$, respectively, where:
\begin{align*}
&\calL_{\textsc{xor}} = \left\{ (c_1, c_2, c_3) \in \calC^3 ~\left|~ \begin{array}{c} \exists (m_1, m_2, m_3) \in
\zo^3, (r_1, r_2, r_3) \in \calR^3 \text{ such that } \\ \forall i \in
\set{1,2,3}~ c_i = \Comm(m_i; r_i) \text{ and } m_1 \oplus m_2 = m_3
\end{array} \right. \right\}\\
&\calL_{\textsc{and}} = \left\{ (c_1, c_2, c_3) \in \calC^3 ~\left|~ \begin{array}{c} \exists (m_1, m_2, m_3) \in
\zo^3, (r_1, r_2, r_3) \in \calR^3 \text{ such that } \\ \forall i \in
\set{1,2,3}~ c_i = \Comm(m_i; r_i) \text{ and } m_1 \land m_2 = m_3
\end{array} \right. \right\}\,.
\end{align*}

%\begin{enumerate}[label=(\alph*), leftmargin=*]
%  \item
Give a Sigma protocol for $\cSAT$. In addition to describing a protocol,
you will also need to argue \emph{informally} that your protocol satisfies completeness, soundness,and honest-verifier zero-knowledge. Please state which assumptions about the underlying tools are needed to prove each property.




\paragraph{Optional Feedback [5 points].} Please answer the following questions to
help design future problem sets. You are not required to answer these questions (the points are free),
and if you would prefer to answer anonymously, please use the anonymous feedback form.
However, we do encourage you to provide feedback on how to improve the course experience.
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Roughly how long did you spend on this problem set?

  \item What was your favorite problem on this problem set?

  \item What was your least favorite problem on this problem set?

  \item Any other feedback for this problem set? Was it too easy/difficult?

  \item Any other feedback on the course so far?

\end{enumerate}


\end{document}
