\documentclass[11pt]{article}
\input{headers03}

\usepackage{fancyhdr}   
\pagestyle{fancy}      
\lhead{CS 555, FALL 2021}               
\rhead{Name: Hemanta K. Maji} %%% <-- REPLACE Hemanta K. Maji WITH YOUR NAME HERE

\usepackage[strict]{changepage}  
\newcommand{\nextoddpage}{\checkoddpage\ifoddpage{\ \newpage\ \newpage}\else{\ \newpage}\fi}  


\begin{document}

\title{Homework 3}

\date{}

\maketitle 

\thispagestyle{fancy}  
\pagestyle{fancy}


\begin{enumerate}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 1 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Security of encryption schemes (8+8+8+10 points).} 
For each of the encryption schemes below, state whether the scheme is secure or not. Justify your answer in each case. 
\begin{enumerate}
    \item The message space is $\cM = \{0,1, \dotsc, 6 \}$. 
    Algorithm $\gen$ chooses a uniform key from the key space $\cK = \{1, \dotsc, 6\}$. The encryption algorithm $\enc_{sk}(m)$ returns $(sk+m) \mod 7$, and the decryption algorithm $\dec_{sk}(m)$ returns $(c-sk) \mod 7$.
    
    {\bfseries Solution.}  
    
    \newpage
    
    \item The message space is $\cM = \{0,1, \dotsc, 6 \}$. 
    Algorithm $\gen$ chooses a uniform key from the key space $\cK = \{0,1, \dotsc, 7\}$. 
    The encryption algorithm $\enc_{sk}(m)$ returns $(sk+m) \mod 7$, and the decryption algorithm $\dec_{sk}(m)$ returns $(c-sk) \mod 7$.
     
    {\bfseries Solution.}  
    
    \newpage
    
    \item The message space is $\cM=\{1,3,5,\dots,2019,2021\}$. 
    Algorithm $\gen$ chooses a uniform key from the key space $\cK = \{0,2,4,6, \dotsc,2020\}$. 
    The encryption algorithm $\enc_{sk}(m)$ returns $(sk+m) \mod 2022$, and the decryption algorithm $\dec_{sk}(m)$ returns $(c-sk) \mod 2022$. 
    
    {\bfseries Solution.}  
    
    \newpage
    
    \item The message space $\cM$ is the set of all $n$ bit strings ($\{0,1\}^n$) containing $t$ $1$s. 
    The key space $\cK$ is the set of all permutation of the $n$ positions.
    Algorithm $\gen$ chooses a key uniformly at random from the key space $\cK.$
    The encryption algorithm $\enc_{sk}(m)$ returns $\pi(m)$, and the decryption algorithm $\dec_{sk}(m)$ returns $\pi^{-1}(m)$ where $\pi^{-1} \circ \pi = \mathbb{1}$, $\mathbb{1}$ is the identity permutation.
    
    For example, when $n = 3, t = 2$, let $\cM = \{110, 101, 011\}$ be the set of all $3$ bit strings with two $1$s. 
    Let $m = 101 \in \cM$ be a message.
    Let $\pi: \cM \rightarrow \cM, \pi \in \cK$ be a permutation of the $3$ positions such that $\pi(b_1b_2b_3) = b_2b_3b_1,$ i.e. $\pi(101) = 011.$
    
    {\footnotesize Note:
    This encryption scheme shows that the witness for an encryption does not have to be unique.
    }

    {\bfseries Solution.} 
    
\end{enumerate}

\newpage





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 2 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries Equivalent definition of Perfect Secrecy (15 points).} 
In the lecture we defined the perfect security for any private-key encryption scheme $(\pred{Gen},\pred{Enc},\pred{Dec})$ as follows. 
For any message $m$, cipher-text $c$, and a priori probability distribution $\M$ over the set of messages, we have: 
$$ \probX{ \M=m \vert \C=c } = \probX{\M=m}$$
Show that the above definition is \underline{equivalent} to the following alternative definition.  
For all messages $m,m'$, cipher-text $c$, and a priori probability distribution $\M$ over the set of messages, we have: 
$$ \probX{\C=c \vert \M=m} = \probX{\C = c \vert \M=m'},$$

{\footnotesize Remarks: 
\begin{enumerate}
    \item Proving equivalence means that you have to show that the first definition implies the second definition. 
    And, the second definition also implies the first definition.
    
    \item Additionally, in this problem, for simplicity, assume that in the the probability expressions no ``division by error'' occurs.
\end{enumerate}}

    {\bfseries Solution.}  
   
\newpage





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 3 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Defining Perfect Security from Ciphertexts (15 points).} 
An upstart in the field of cryptography has proposed a new definition for perfect security of private-key encryption schemes. 
According to this new definition, a private-key encryption scheme $(\pred{Gen},\pred{Enc},\pred{Dec})$ is perfectly secure, if, for all a priori distribution $\M$ over the message space, and any two cipher-texts $c$ and $c'$, we have the following identity. 
$$\probX{\C=c} = \probX{\C=c'}$$
Show that the definition in the class does \ul{not} imply this new definition.  

{\footnotesize Remark. 
You need to construct a private-key encryption scheme that is secure according to the definition we learned in the class. 
However, this scheme does not satisfy the new definition.}
  
    {\bfseries Solution.}   

\newpage





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 4 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries One-time Pad for 4-Alphabet Words (8+8 points).} 
We interpret alphabets $\mathtt a,\mathtt b,\dotsc,\mathtt z$ as integers $0,1,\dotsc,25$, respectively. 
We will work over the group $(\bbZ^4_{26},+)$, where $+$ is coordinate-wise integer sum $\mod 26$.
For example, $\mathtt{abcx} + \mathtt{aczd} = \mathtt{a d b a}$. 
  
Now, consider the one-time pad encryption scheme over the group $(\bbZ^4_{26},+)$. 

\begin{enumerate}
\item What is the probability that the encryption of the message $\mathtt{kiwi}$ is the cipher text $\mathtt{kiwi}$?
  
    {\bfseries Solution.}  
    
    \vspace{0.3\textheight}
     

\item What is the probability that the encryption of the message $\mathtt{kiwi}$ is the cipher text $\mathtt{lime}$? 

    {\bfseries Solution.}  
    
\end{enumerate}
\newpage





%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 5 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries Lagrange Interpolation(7+7+6 points).} 
We want to derive a part of the Chinese Remainder Theorem using principles of Lagrange Interpolation. Our goal is the following 
\begin{boxedalgo}
Suppose $p$ and $q$ are two distinct primes. Suppose $a\in \{0,\ldots,p-1\}$ and $b\in \{0,\ldots,q-1 \}$. We want to find a natural number $x$ such that 
\begin{align*}
    x \pmod p =a\ \text{and}\ x\pmod q=b 
\end{align*}
\end{boxedalgo}
We shall proceed towards this objective incrementally (similar to the approach of Lagrange interpolation). 
\begin{enumerate}
    \item Find a natural number $x_p$ satisfying $x_p \pmod p = 1$, and $x_p \pmod q =0$. 
    
    {\bfseries Solution.}  
    
    \newpage
    
    \item Find a natural number $x_q$ satisfying $x_q \pmod p = 0$ and $x_q \pmod q =1$. 
    
    {\bfseries Solution.}  
    
    \newpage
    
    \item Find a natural number $x$ satisfying $x \pmod p = a$ and $x \pmod q =b$. 
    
    {\bfseries Solution.}  
    
\end{enumerate}
\newpage






%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 6 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries An Illustrative Execution of Shamir's Secret Sharing Scheme (6+10+9 points).} 
We shall work over the field $(\bbZ_7,+,\times)$. 
We are interested in sharing a secret among 6 parties such that any 4 parties can reconstruct the secret, but no subset of 3 parties gain any additional information about the secret. 
  
Suppose the secret is $s=3$. 
The random polynomial of degree $<4$ that is chosen during the secret sharing steps is $p(X) = X^3+ 2X + 3$. 

\begin{enumerate}
    \item What are the respective secret shares of parties 1, 2, 3, 4, 5, and 6? 
    
    {\bfseries Solution.}   
    
    \newpage
    
    \item Suppose parties 1, 2, 5, and 6 are interested in reconstructing the secret. 
Run Lagrange Interpolation algorithm as explained in the class. 
    
({\footnotesize {\em Remark:} 
      It is essential to show the step-wise reconstruction procedure to score full points. 
      In particular, you need to write down the polynomials $p_1(X)$, $p_2(X)$, $p_3(X)$, and $p_4(X)$.
}) 
     {\bfseries Solution.}  
     
     \newpage
    
    \item Suppose parties 1, 2, and 5 get together. 
    Let $q_{\widetilde s}(X)$ be the polynomial that is consistent with their shares and the point $(0,\widetilde s)$, for each $\widetilde s\in \bbZ_p$. 
    Write down the polynomials $q_0(X)$, $q_1(X)$, $\dotsc$, $q_6(X)$.  
    
    {\bfseries Solution.}  
    
\end{enumerate}     
\newpage     



     

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 7 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   
\item {\bfseries A bit of Counting (8+8+9 points).} 
In this problem, we will do a bit of counting related to polynomials that pass through a given set of points in the plane. 
We already did this counting (slightly informally) in the class. 
Writing the solution for this problem shall make the solution's intuition more concrete. 
  
We are working over the field $(\bbZ_p,+,\times)$, where $p$ is a prime number. 
Let $\cP_t$ be the set of all polynomials in the indeterminate $X$ with degree $<t$ and coefficients in $\bbZ_p$. 
  
\begin{enumerate}
    \item Let $(x_1,y_1)$, $(x_2,y_2)$, $\dotsc$, and $(x_t,y_t)$ be $t$ points in the plane $\bbZ_p^2$. 
    We have that $x_i \neq x_j$ for all $i\neq j$, that is, the first coordinates of the points are all distinct. 
    
    Prove that there exists a {\em unique polynomial} in $\cP_t$ that passes through these $t$ points. 
    
    ({\footnotesize
      Hint: 
        Use Lagrange Interpolation and Schwartz--Zippel Lemma. 
    })
    
    {\bfseries Solution.}   
    
    \newpage
    
    \item Let $(x_1,y_1)$, $(x_2,y_2)$, $\dotsc$, and $(x_{t-1},y_{t-1})$ be $(t-1)$ points in the plane $\bbZ_p^2$.
    We have that $x_i \neq x_j$ for all $i\neq j$, that is, the first coordinates of the points are all distinct.
    
    Prove that there are $p$ polynomials in $\cP_t$ that pass through these $(t-1)$ points. 
    {\bfseries Solution.}    
    
    \newpage
  
    \item Let  $(x_1,y_1)$, $(x_2,y_2)$, $\dotsc$, and $(x_k,y_k)$ be $k$ points in the plane $\bbZ_p^2$, where $k\leq t$. 
    We have that $x_i \neq x_j$ for all $i\neq j$, that is, the first coordinates of the points are all distinct.
    
    Prove that there are $p^{t-k}$ polynomials in $\cP_t$ that pass through these $k$ points.  
    {\bfseries Solution.}  
    
    \newpage
\end{enumerate} 
\newpage
     




%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 8 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries Monotone Circuits for Secret Sharing (15 points).}
Recall from the lecture that the {\em additive secret sharing} scheme secret-shares a secret among $n$ parties that can be recovered when all parties are present. 
The {\em repetitive secret sharing} scheme secret-shares a secret among $n$ parties that can be recovered by any party. 
Intuitively, these two secret sharing schemes implement the atomic access structure accepted by the AND and the OR gates, respectively. 

In the lecture, it was mentioned that any monotone circuit can be expressed using AND and OR gates. 
The threshold access structure is also accepted by a monotone circuit. 
For example, consider the access structure of $n=4$ parties where any $k=3$ parties can reconstruct the secret. 
The access structure is represented by the following monotone circuit. 
  $$(A \wedge B \wedge C) \vee (A \wedge B \wedge D) \vee (A \wedge C \wedge D) \vee (B \wedge C \wedge D)$$
  
Construct a secret sharing scheme for this access structure by recursively using the additive and repetitive secret sharing schemes. 







\end{enumerate}
\newpage
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PLEASE LIST COLLABORATORS BELOW  %%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
{\bfseries Collaborators :} 
% ENTER THEIR NAMES HERE 

\end{document}
