\documentclass[11pt]{article}
\input{headers05}

\usepackage{fancyhdr}   
\pagestyle{fancy}      
\lhead{CS 355, FALL 2018}               
\rhead{Name: Hemanta K. Maji} %%% <-- REPLACE Hemanta K. Maji WITH YOUR NAME HERE

\usepackage[strict]{changepage}  
\newcommand{\nextoddpage}{\checkoddpage\ifoddpage{\ \newpage\ \newpage}\else{\ \newpage}\fi}  


\begin{document}

\title{Homework 5}

\date{}

\maketitle 

\thispagestyle{fancy}  
\pagestyle{fancy}      




\begin{enumerate}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 1 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Stretching PRG Output.} (10 points)
Suppose we are given a length-doubling PRG $G$ such that 
$$G:\{0,1\}^B \rightarrow \{0,1\}^{2B}$$
Using $G$, construct a new PRG $G'$ such that 
$$G': \{0,1\}^B \rightarrow \{0,1\}^{100B}$$

({\footnotesize Remark: We do not need a security proof. 
You should only use the PRG $G$ to construct the new PRG $G'$. 
In particular, you should not use any other cryptographic primitive like one-way function etc.}
)

  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage


%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%% PROBLEM 2 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries New Pseudorandom Function Family.} 
  Let $G$ be a length-doubling PRG $G\colon\zo^B\to\zo^{2B}$. 
  Recall the basic  GGM PRF construction presented below. 
   \begin{boxedalgo}
 \begin{itemize}
     \item  Define $G(x) = (G_0(x), G_1(x))$ where $G_0,G_1 : \{0,1\}^B \rightarrow \{0,1\}^B$
%    \item Let $G' : \{0,1\}^B \rightarrow \{0,1\}^n$ be a PRG. 
    \item  We define $g_{\pred{id}}(x_1,x_2,\ldots x_n)$ as $G_{x_n}(\ldots G_{x_2}(G_{x_1}(\pred{id})) \ldots )$ \\where $\pred{id} \xleftarrow[]{\$} \zo^B$.
 \end{itemize}
  \end{boxedalgo}
  Recall that in the class we studied that $g_{\pred{id}}$ is a PRF family for $\zo^n\to\zo^B$, for a fixed value of $n$ when the key $\pred{id}$ is picked uniformly at random from the set $\zo^B$. 

  \begin{enumerate}
   \item (6 points) Why is the above-mentioned GGM construction not a pseudorandom function family from the domain $\zo^*$ to the range $\zo^B$? \newline 
     {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \item (13 points) Given a length-doubling PRG $G\colon\zo^B\to\zo^{2B}$, construct a PRF family from the domain $\zo^n$ to the range $\zo^{100B}$. \newline 
  ({\footnotesize Remark: Again, in this problem, do not use any other cryptographic primitive like one-way function etc. You should only use the PRG $G$ in your proposed construction.}) \newline 
   {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \item (6 points) Consider the following function family $\{h_1,\dotsc,h_\alpha\}$ from the domain $\zo^*$ to the range $\zo^B$. 
    We define $h_{\pred{id}}(x) = g_{\pred{id}}(x , [\;\abs x\;]_2)$, for $k\in\{1,2,\dotsc,\alpha\}$. 
    Show that $\{h_1,\dotsc,h_\alpha\}$ is \ul{not} a secure PRF from $\zo^*$ to the range $\zo^B$. 
    
    ({\footnotesize {\em Note}: The expression $[\;\abs x\;]_2$ represents the length of $x$ in $n$-bit binary expression.}) \newline 
      {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \end{enumerate} 
  



%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%% PROBLEM 3 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries Variant of Pseudorandom Function Family.} 
  Let $G$ be a length-doubling PRG $G\colon\zo^B\to\zo^{2B}$, recall the GGM construction taught in class to construct PRF family from $\{0,1\}^* \rightarrow \{0,1\}^T$ 
   \begin{boxedalgo}
 \begin{itemize}
     \item Define $G(x) = (G_0(x), G_1(x))$ where $G_0,G_1 : \{0,1\}^B \rightarrow \{0,1\}^B$
   \item Let $G' : \{0,1\}^B \rightarrow \{0,1\}^T$ be a PRG. 
    \item We define $g_{\pred{id}}(x_1,x_2,\ldots x_n)$ as $G'(G_{x_n}(\ldots G_{x_2}(G_{x_1}(\pred{id})) \ldots ))$ \\where $\pred{id} \xleftarrow[]{\$} \zo^B$.
 \end{itemize}
  \end{boxedalgo}
  
 % In this problem, we shall generalize the GGM PRF construction in two ways. 
  %\begin{enumerate}
   %\item 
 (15 points)  Prove that the above-mentioned PRF construction is \ul{not} secure when $G'=G$. 
   %\end{enumerate} 
  

  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 4 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries OWF.} (15 points)
Let $f:\{0,1\}^n \rightarrow \{0,1\}^n$ be a one-way function. Define $g: \{0,1\}^{n}\rightarrow \{0,1\}^{n+1}$ as 
\[g(x) = f(x) \Vert 0 \]
where $x \in \{0,1\}^n$. Show that $g$ is also a one-way function. \newline 
{\footnotesize Hint. Suppose there exists an efficient adversary $\cA$ that inverts the function $g$ . 
  You should now construct a new efficient adversary $\cA'$ that uses $\cA$ as a subroutine to invert the function $f$.} \newline 
  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage




%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 5 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Encryption using Random Functions.} 
  Let $\cF$ be the set of all functions $\zo^{n} \to \zo^n$. 
  Consider the following private-key encryption scheme. 
  \begin{boxedalgo}
  \begin{itemize}
  \item $\gen()$: Return $\sk=F$ uniformly at random from the set $\cF$ 
  \item $\enc_\sk(m)$: Return $(c,r)$, where $r$ is chosen uniformly at random from $\zo^n$, $c = m\oplus F(r)$, and $\sk=F$.  
  \item $\dec_\sk(\widetilde c,\widetilde r)$: Return $\widetilde c \oplus F(\widetilde r)$.
  \end{itemize}
  \end{boxedalgo}
  
  \begin{enumerate}
  \item (12 points) Suppose we want to ensure that even if we make $10^9$ calls to the encryption algorithm, all randomness $r$ that are chosen are distinct with probability $1-2^{- 100}$. 
    What value of $n$ shall you choose? \newline 
     {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage

  \item (8 points) Conditioned on the fact that all randomness $r$ in the encryption schemes are distinct, prove that this scheme is secure. \newline 
   {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage

  \end{enumerate}
 


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 6 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries Attack on an Encryption Scheme.} (15 points)
 Let $\cF$ be the set of all function $\zo^n\to\zo^n$. 
 Consider the following private-key encryption scheme. 
 \begin{boxedalgo}
 \begin{itemize}
   \item $\gen()$: Return $\sk=F$ chosen uniformly at random from the set $\cF$ 
   \item $\enc_\sk(m)$: Return $m \oplus F(m)$, where $\sk=F$ 
 \end{itemize}
 \end{boxedalgo}
 We have knowingly not defined the decryption scheme because it might not be efficient to decrypt this scheme even given $\sk=F$! 
 However, the encryption algorithm itself has an issue.  
 
 Prove that the encryption scheme is not secure. 
 %
 \newline 
  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
     
     


\end{enumerate}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PLEASE LIST COLLABORATORS BELOW  %%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
{\bfseries Collaborators :} \newline 
% ENTER THEIR NAMES HERE  

\end{document}

