\documentclass[11pt]{article}

\usepackage[margin=0.75in]{geometry}
\input{latexdefs}

\begin{document}

\newlength{\boxwidth}
\setlength{\boxwidth}{\textwidth}
\addtolength{\boxwidth}{-2cm}
\noindent\framebox[\textwidth]{
\begin{minipage}[t]{\boxwidth}
  {\bf COMP 537: Cryptography \hfill Fall 2023}  \\ [-0.3cm]
  \begin{center} 
    {\Large Problem Set 5}
  \end{center}
\end{minipage}}
\vspace{0.7cm}

\noindent \textbf{Instructions:} You {\bf must} typeset your
solution in LaTeX using the provided template. Please submit your problem set via Gradescope. Include your name and the names of any collaborators at the top of your submission.

\hrule


\problem{Pairing Conceptual Questions [6 points]}
For each of the following statements, say whether it is TRUE or FALSE and briefly explain why.

\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Let $e: \G\times\G \to \G_T$ be a pairing for an elliptic curve group $\G$. If the discrete log problem in $\G$ is easy, then the BDDH problem for $e$ is easy as well.

  \item Let $\G = \langle g \rangle$ be a group of prime order $q$,
        and suppose there exists a pairing $e: \G \times \G \to \G_T$
        of the sort we use to instantiate BLS signatures.
        Then, the group $\G$ is
        safe to use for standard two-party Diffie-Hellman
        key agreement:

        That is, Alice sends $g^a \in \G$ for $a \getsr \Z_q$, Bob sends
        $g^b \in \G$ for $b \getsr \Z_q$, and Alice and Bob use $H(g^{ab})$ as
        their shared secret, where $H: \G \to \G$ is a hash function
        that we model as a random oracle.

\end{enumerate}


\problem{Asymmetric Pairings~[10 points]}

All the pairing-based schemes we saw in class used \emph{symmetric} pairings $e:\G\times\G\to G_T$, but in practice we often use \emph{asymmetric} pairings. These are pairings of the form $e:\G_1\times\G_2\to G_T$ where $\G_1$ and $\G_2$ are different groups. Let $g_1\in\G_1$ and $g_2\in\G_2$ be generators of these groups.

\begin{enumerate}[label=(\alph*), leftmargin=*]

\item Describe the BLS signature scheme in a setting that uses asymmetric pairings. You may assume you have access to a hash function $H:\zo^*\to\G_1$ modeled as a random oracle. Be sure to specify which group each element used belongs to. \\
\textbf{Note:} This will require almost no changes to the protocol.

\item Give a version of the pairing-based three-party key exchange protocol from lecture that works using asymmetric pairings.\\
\textbf{Note:} This will require some changes to the protocol.

\end{enumerate}

\problem{Regev Encryption [10 points]}
For this question, consider the Regev encryption scheme covered in class.

\begin{enumerate}[label=(\alph*), leftmargin=*]
\item The Regev encryption shown in class only supported encryption of ciphertexts $\zo$. Show how to extend this to $\{0,...,15\}$. The same principle should apply for any sufficiently small domain.

\item Show that this scheme is additively homomorphic. Mention any changes needed to make it additively homomorphic, if needed.

\end{enumerate}


\problem{OT/2PC Conceptual Questions [12 points]}

\begin{enumerate}[label=(\alph*), leftmargin=*]

  \item For each of the following statements, say whether it is TRUE or FALSE. Write \emph{at most one sentence} to justify your answer.

  \begin{denseitemize}
    \item[i)] In Yao's protocol for secure two-party computation
       of a function $f(\cdot, \cdot)$ (as described in lecture), the two parties must
       exchange a number of bits that is at least as large as
       a Boolean circuit computing~$f$.

    \item[ii)] Say that Alice, with input $x \in \zo$, and Bob, with input $y \in \zo$,
       use Yao's protocol to compute $f(x,y) \in \zo$, for some function
       $f: \zo \times \zo \to \zo$. Then, under reasonable computational assumptions,
       the protocol must hide $y$ from Alice---that is, Alice's probability of guessing
       Bob's bit after running the protocol
       is at most $1/2 + \negl(\lambda)$ for all functions $f: \zo \times \zo \to \zo$ and a security parameter $\lambda$.
  \end{denseitemize}

  \item List the computational assumptions needed to prove the security of the Yao's garbled circuits scheme we saw in class and briefly state why each one is necessary.

\end{enumerate}

\paragraph{Optional Feedback [5 points].} Please answer the following questions to
help design future problem sets. You are not required to answer these questions (the points are free),
and if you would prefer to answer anonymously, please use the anonymous feedback form.
However, we do encourage you to provide feedback on how to improve the course experience.
\begin{enumerate}[label=(\alph*), leftmargin=*]
  \item Roughly how long did you spend on this problem set?

  \item What was your favorite problem on this problem set?

  \item What was your least favorite problem on this problem set?

  \item Any other feedback for this problem set? Was it too easy/difficult?

  \item Any other feedback on the course so far?

\end{enumerate}

\end{document}
