\documentclass[11pt]{article}
\input{headers03}

\usepackage{fancyhdr}   
\pagestyle{fancy}      
\lhead{CS 355, FALL 2018}               
\rhead{Name: Hemanta K. Maji} %%% <-- REPLACE Hemanta K. Maji WITH YOUR NAME HERE

\usepackage[strict]{changepage}  
\newcommand{\nextoddpage}{\checkoddpage\ifoddpage{\ \newpage\ \newpage}\else{\ \newpage}\fi}  


\begin{document}

\title{Homework 3}

\date{}

\maketitle 

\thispagestyle{fancy}  
\pagestyle{fancy}      




\begin{enumerate}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 1 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Equivalent definition of Perfect Secrecy.} 
In the lecture we defined the perfect security for any private-key encryption scheme $(\pred{Gen},\pred{Enc},\pred{Dec})$ as follows. 
For any message $m$, cipher-text $c$, and a priori probability distribution $\M$ over the set of messages, we have: 
$$ \probX{ \M=m \vert \C=c } = \probX{\M=m}$$
(40 points) Show that the above definition is \underline{equivalent} to the following alternative definition.  
For all messages $m,m'$, cipher-text $c$, and a priori probability distribution $\M$ over the set of messages, we have: 
$$ \probX{\C=c \vert \M=m} = \probX{\C = c \vert \M=m'},$$

{\footnotesize Remarks: 
(1) Proving equivalence means that you have to show that the first definition implies the second definition. 
And, the second definition also implies the first definition.

(2) Additionally, in this problem, for simplicity, assume that in the the probability expressions no ``division by error'' occurs.}

  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 2 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Defining Perfect Security from Ciphertexts.} An upstart in the field of cryptography has proposed a new definition for perfect security of private-key encryption schemes. 
According to this new definition, a private-key encryption scheme $(\pred{Gen},\pred{Enc},\pred{Dec})$ is perfectly secure, if, for all a priori distribution $\M$ over the message space, and any two cipher-texts $c$ and $c'$, we have the following identity. 
$$\probX{\C=c} = \probX{\C=c'}$$
(20 points) Show that the definition in the class does \ul{not} imply this new definition.  

{\footnotesize Remark. 
You need to construct a private-key encryption scheme that is secure according to the definition we learned in the class. 
However, this scheme does not satisfy the new definition.}
  
  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 3 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries One-time Pad for 3-Alphabet Words.} 
  We interpret $a,b,\dotsc,z$ as $0,1,\dotsc,25$. 
  We will work over the group $(\bbZ^3_{26},+)$, where $+$ is coordinate-wise integer-sum $\mod 26$. 
  For example, $abx + acd = ada$. 
  
  Now, consider the one-time pad encryption scheme over the group $(\bbZ^3_{26},+)$. 
  \begin{enumerate}
  \item (5 points) What is the probability that the encryption of the message $cat$ is the cipher text $cat$? \newline
  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \item (5 points) What is the probability that the encryption of the message $cat$ is the cipher text $dog$? \newline 
  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \end{enumerate}  

 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 4 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries A Conjectured Private-key Encryption Scheme.} 
Consider the following encryption scheme.
\begin{itemize}
    \item The message space $\mathcal{M}$ is the set of all $n$-bit strings that have exactly $t$-ones in them. 
    \item The key space $\mathcal{K}$ is the set of all permutations from the set $\{1,2,\dotsc,n\}$ to $\{1,2,\dotsc,n\}$. % The key is chosen uniformly at random from the set of all permutations. 
    \item The set of all cipher-texts, represented by $\mathcal C$, is identical to $\mathcal M$. 
\end{itemize}
The private-key encryption scheme $(\gen,\enc,\dec)$ is defined below.
\begin{boxedalgo}
\begin{itemize}
    \item $\gen()$ : Return a random permutation $\sk$ from $\{1,2,\dotsc,n\}$ to $\{1,2,\dotsc,n\}$.
    \item $\enc_\sk(m)$: Return $c$, where $c$ is obtained by permuting the message $m$ using the permutation $\sk$. 
      For example, if $m = m_1m_2\dotsc m_n$, then the permutation of $m$ using $\sk$ is the string $c = c_1c_2\dotsc c_n = m_{\sk(1)}m_{\sk(2)}\dotsc m_{\sk(n)}$. 
    \item $\dec_\sk(c)$: Return $\widetilde m$, where $\widetilde m$ is obtained from $c$ by inverting the permutation $\sk$. 
      For example, if $c = c_1c_2\dotsc c_n$, then decoded message is $c_{\sk^{-1}(1)} c_{\sk^{-1}(2)} \dotsc c_{\sk^{-1}(n)} $.
\end{itemize}
\end{boxedalgo}
(30 points) Is this scheme perfectly secure? 
If yes, then provide a proof. 
If no, then give a counterexample. 

{\bfseries A worked-out example of the encryption algorithm.}
Let $n=4$ and $t=2$. 
Therefore, we have the set of messages $\cM = \{1100, 1010, 1001, 0110, 0101, 0011\}$. 
Note that the size of the set $\mathcal M$ is ${\choose nt} = 6$.
The set $\mathcal K$ is the set of all permutations from the set $\{1,2,3,4\}$ to the set $\{1,2,3,4\}$. 
Note that there are a total of $4! = 24$ such permutations. 

Suppose the $\gen()$ algorithm picked the following permutation
$$\sk(1)=3, \sk(2)=1, \sk(3)=4, \sk(4)=2$$
Suppose Alice wants to encrypt the message $m = m_1m_2m_3m_4 = 1010$ using the \sk above. 
Then, the cipher-text is $c = m_{\sk(1)}m_{\sk(2)}m_{\sk(3)}m_{\sk(4)} = m_3m_1m_4m_2=1100$.
When Bob wants to decrypt the message $c = c_1c_2c_3c_4 = 1100$, he outputs $\widetilde m = c_{\sk^{-1}(1)} c_{\sk^{-1}(2)} c_{\sk^{-1}(3)} \widetilde c_{\sk^{-1}(4)} = c_2c_4c_1c_3=1010$.

Note that in the example presented above, we recovered the original message! 
However, is this scheme secure?\newline 
  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage    
     
     
     
     
     
     
     
     
     

\end{enumerate}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PLEASE LIST COLLABORATORS BELOW  %%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
{\bfseries Collaborators :} \newline 
% ENTER THEIR NAMES HERE  

\end{document}
