\documentclass[11pt]{article}
\input{headers06}

\usepackage{fancyhdr}   
\pagestyle{fancy}      
\lhead{CS 355, FALL 2025}               
\rhead{Name: Hemanta K. Maji} %%% <-- REPLACE Hemanta K. Maji WITH YOUR NAME HERE

\usepackage[strict]{changepage}  
\newcommand{\nextoddpage}{\checkoddpage\ifoddpage{\ \newpage\ \newpage}\else{\ \newpage}\fi}  


\begin{document}

\title{Homework 6}

\date{}

\maketitle 

\thispagestyle{fancy}  
\pagestyle{fancy} 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%% PLEASE LIST COLLABORATORS BELOW  %%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
{\bfseries Collaborators:}
%%% List your collaborators and any online resources here.



\newpage
\centering
{\Huge{Practice Questions}}

These are practice questions.
They will \textbf{NOT} be graded.
We have also provided the final answers.
However, it is up to you to understand how or why the given solution is correct.

You do not need to submit these on Gradescope.
However, you may find it easier to just include them in the pdf.
In that case, please do not mark these questions on Gradescope.

\newpage

\begin{enumerate}
	\item {\bfseries RSA Assumption (0 points).} Consider RSA encryption scheme with parameters $N=35=5\times 7$.
	      \begin{enumerate}
	      	\item Compute $\varphi(N)$ and write down the set $\mathbb{Z}^{*}_N$.
	      	          
	      	      {\bfseries Solution.}   
	      	      
	      	      $\varphi(35) = 24$
	      	      $$\bbZ_{35}^* = \{1,2,3,4,6,8,9,11,12,13,16,17,18,19,22,23,24,26,27,29,31,32,33,34\}$$
	      	           
	      	      %\newpage
	      	      \vspace{0.3 \textheight}
	      	\item Use repeated squaring and complete the rows $X,X^2, X^4$ for all $X\in \mathbb{Z}^{*}_N$ as you have seen in the class (slides), that is, fill in the following table by adding as many columns as needed.
	      	      
	      	      {\bfseries Solution.}   
	      	      \begin{center}
	      	      	%      \centering
	      	      	\begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
	      	      		\hline
	      	      		$X$ & 1 & 2  & 3  & 4  & 6 & 8  & 9  & 11 & 12 & 13 & 16 & 17 \\
	      	      		\hline
	      	      		$X^2$ 
	      	      		    & 1 & 4  & 9  & 16 & 1 & 29 & 11 & 16 & 4  & 29 & 11 & 9  \\
	      	      		\hline
	      	      		$X^4$ 
	      	      		    & 1 & 16 & 11 & 11 & 1 & 1  & 16 & 11 & 16 & 1  & 16 & 11 \\
	      	      		\hline
	      	      	\end{tabular}
	      	      \end{center}
	      	      \begin{center}
	      	      	%      \centering
	      	      	\begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
	      	      		\hline
	      	      		$X$   & 18 & 19 & 22 & 23 & 24 & 26 & 27 & 29 & 31 & 32 & 33 & 34 \\
	      	      		\hline
	      	      		$X^2$ & 9  & 11 & 29 & 4  & 16 & 11 & 29 & 1  & 16 & 9  & 4  & 1  \\
	      	      		\hline
	      	      		$X^4$ & 11 & 16 & 1  & 16 & 11 & 16 & 1  & 1  & 11 & 11 & 16 & 1  \\
	      	      		\hline
	      	      	\end{tabular}
	      	      \end{center}
	      	          
	      	      \vspace{0.2 \textheight}
	      	         
	      	\item Find the row $X^7$ and show that $X^7$ is a bijection from $\mathbb{Z}^{*}_N$ to $\mathbb{Z}^{*}_N$.
	      	           
	      	      {\bfseries Solution.}  
	      	              
	      	      \begin{center}
	      	      	%      \centering
	      	      	\begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
	      	      		\hline
	      	      		$X$   & 1 & 2  & 3  & 4  & 6 & 8  & 9  & 11 & 12 & 13 & 16 & 17 \\
	      	      		\hline
	      	      		$X^2$ 
	      	      		      & 1 & 4  & 9  & 16 & 1 & 29 & 11 & 16 & 4  & 29 & 11 & 9  \\
	      	      		\hline
	      	      		$X^4$ 
	      	      		      & 1 & 16 & 11 & 11 & 1 & 1  & 16 & 11 & 16 & 1  & 16 & 11 \\
	      	      		\hline
	      	      		$X^7$ & 1 & 23 & 17 & 4  & 6 & 22 & 9  & 11 & 33 & 27 & 16 & 3  \\
	      	      		\hline
	      	      	\end{tabular}
	      	      \end{center}
	      	      \begin{center}
	      	      	%      \centering
	      	      	\begin{tabular}{|c|c|c|c|c|c|c|c|c|c|c|c|c|}
	      	      		\hline
	      	      		$X$   & 18 & 19 & 22 & 23 & 24 & 26 & 27 & 29 & 31 & 32 & 33 & 34 \\
	      	      		\hline
	      	      		$X^2$ & 9  & 11 & 29 & 4  & 16 & 11 & 29 & 1  & 16 & 9  & 4  & 1  \\
	      	      		\hline
	      	      		$X^4$ & 11 & 16 & 1  & 16 & 11 & 16 & 1  & 1  & 11 & 11 & 16 & 1  \\
	      	      		\hline
	      	      		$X^7$ & 32 & 19 & 8  & 2  & 24 & 26 & 13 & 29 & 31 & 18 & 12 & 34 \\
	      	      		\hline
	      	      	\end{tabular}
	      	      \end{center}
	      	      
	      	      We can see that every value of $X$ shows up once and exactly once in the row for $X^7$
	      	          
	      \end{enumerate}
	      \newpage
	      
	\item (0 points)
	      By hand, compute the three least significant (decimal) digits of $25114997^{9301403}$.  
	      Explain your logic.
	          
	      {\bfseries Solution.} 
	      
	      $973$
	      
	      \newpage
	      
	\item (0 points)
	      Suppose $n = 76499 = 227 \cdot 337,$ where $227$ and $337$ are primes.
	      Let $e_1 = 6039$ and $e_2 = 9031.$ 
	          
	      \begin{enumerate}
	      	\item (0 points) Only one of the two exponents $e_1, e_2$ is a valid RSA encryption key, which one?
	      	              
	      	      {\bfseries Solution.}
	      	      
	      	      Only $e_2$ is valid.
	      	                
	      	      \vfill
	      	              
	      	\item (0 points) For the valid encryption key, compute the corresponding decryption key $d.$
	      	              
	      	      {\bfseries Solution.}   
	      	      
	      	      $d = 68503$
	      	                
	      	      \vfill
	      	              
	      	\item (0 points) Decrypt the cipher text $c = 33.$
	      	              
	      	      {\bfseries Solution.}
	      	                
	      	      $m = 62638$
	      	      \vfill
	      	                
	      \end{enumerate}
\end{enumerate}


\newpage
\centering
{\Huge{Homework Questions}}

These are homework questions and will be graded.
Please make sure to clearly mark each problem on Gradescope.
\newpage

\begin{enumerate}
	
	
	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	%%%%%%%%%%%% Problem 1  %%%%%%%%%%%%%%%%%%%%%%%%%%
	%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	
	\item {\bfseries Answer the following questions (7+7+7 points):}
	      \begin{enumerate}
	      	    
	      	\item (7 points)
	      	      Is the following RSA signature scheme valid? (Justify your answer)
	      	      $$(r\Vert m)=5, \sigma=125, N=187, e=3$$
	      	      Here, $m$ denotes the message, $r$ denotes the randomness used to sign $m$, and $\sigma$ denotes the signature. Moreover, $(r\Vert m)$ denotes the concatenation of $r$ and $m$. The signature algorithm $Sign(m)$ returns $(r\Vert m)^d \mod{N}$ where $d$ is the inverse of $e$ modulo $\varphi(N)$. The verification algorithm $Ver(m,\sigma)$ returns ($(r\Vert m)==\sigma^e \mod{N}$). 
	      	          
	      	      {\bfseries Solution.} 
	      	      
	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	          
	      	      \newpage
	      	          
	      	\item (7 points)
	      	      Remember that in RSA encryption and signature schemes, $N=p\times q$ where $p$ and $q$ are two large primes. 
	      	      Show that in the RSA scheme (with public parameters $N$ and $e$), if you know $N$ and $\varphi(N)$, then you can efficiently factorize $N$, i.e., you can recover $p$ and $q$.
	      	      
	      	          
	      	          
	      	      {\bfseries Solution.}   
	      	      
	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	      \vfill
	      	          
	      	\item (7 points)
	      	      Consider an encryption scheme where 
	      	      $Enc(m):=m^e \mod{N}$ where $e$ is a positive integer relatively prime to $\varphi(N)$ and $Dec(c):=c^d \mod{N}$ where $d$ is the inverse of $e$ modulo $\varphi(N)$.
	      	      Show that in this encryption scheme, if you know the encryption of $m_1$ and the encryption of $m_2$, then you can find 
	      	      the encryption of $(m_1\times m_2)^7$.
	      	            
	      	      {\bfseries Solution.}   
	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	      \vfill
	      	          
	      	      \newpage
	      	          
	      	          
	      	          
	      \end{enumerate}
	      \newpage
	      
	      
	      
	      
	      
	      
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%% Problem 2  %%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	\item {\bfseries Euler Phi Function (30 points)}
	      \begin{enumerate}
	      	\item (10 points)
	      	      Let $N = p_1^{e_1} \cdot p_2^{e_2} \dotsi p_t^{e_t}$ represent the unique prime factorization of a natural number $N$, where $p_1<p_2<\dotsi <p_t$ are prime numbers and $e_1,e_2,\dotsc,e_t$ are natural numbers. 
	      	      Let $\bbZ_N^* = \left\{x \colon 0\leq x<N-1, \gcd(x,N)=1 \right\}$ and $\phi(N)=\abs{\bbZ_N^*}$. 
	      	      Using the inclusion exclusion principle, prove that 
	      	      $$\phi(N) = N \cdot \left(1-\frac1{p_1}\right)\cdot\left(1-\frac1{p_1}\right)\dotsi\left(1-\frac1{p_t}\right).$$
	      	            
	      	      {\bfseries Solution.}   
	      	          
	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	      \newpage
	      	            
	      	\item (5 points)
	      	      For any $x\in \bbZ_N^*$, prove that
	      	      $$ x^{\phi(N)} = 1\mod N.$$
	      	      Hint: Consider the subgroup generated by $x$ and its order. 
	      	          
	      	      {\bfseries Solution.}   
	      	          
	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	          
	      	      \newpage
	      	          
	      	\item {\bfseries Replacing $\phi(N)$ with $\frac{\phi(N)}{2}$ in RSA.} (15 points)
	      	          
	      	      In RSA, we pick the exponent $e$ and the decryption key $d$ from the set $\bbZ_{\phi(N)}^*$.
	      	      This problem shall show that we can choose $e,d\in\bbZ_{\phi(N)/2}^*$ instead. 
	      	          
	      	      Let $p, q$ be two distinct odd primes and define $N = pq$. 
	      	      \begin{enumerate}
	      	      	\item (2 points) For any $e\in \bbZ_{\phi(N)/2}^*$, prove that $x^e \colon \bbZ_N^* \to \bbZ_N^*$ is a bijection. 
	      	      	      
	      	      	      {\bfseries Solution.}   
	      	      	                
	      	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	      	      \vfill
	      	      	              
	      	      	\item (7 points)
	      	      	      Consider any $x \in \mathbb{Z}^*_N.$
	      	      	      Prove that $x^{\frac{\phi(N)}{2}} = 1 \mod p$ and $x^{\frac{\phi(N)}{2}} = 1 \mod q.$
	      	      	                  
	      	      	      {\bfseries Solution.}  
	      	      	                    
	      	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	      	      \vfill
	      	      	      \newpage
	      	      	              
	      	      	      
	      	      	\item (3 points)
	      	      	      Consider any $x \in \mathbb{Z}^*_N.$
	      	      	      Prove that $x^{\frac{\phi(N)}{2}} = 1 \mod N.$
	      	      	      
	      	      	      {\bfseries Solution.}   
	      	      	      
	      	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	      	      \vfill
	      	      	      
	      	      	              
	      	      	\item (3 points)
	      	      	      Suppose $e, d$ are integers that $e \cdot d = 1 \mod \frac{\phi(N)}{2}.$
	      	      	      Show that $(x^{e})^d = x \mod N,$ for any $x\in\bbZ_N^*$.
	      	      	      
	      	      	      {\bfseries Solution.}   
	      	      	      
	      	      	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      	      	      \vfill
	      	      	              
	      	      \end{enumerate}
	      \end{enumerate}
	      \newpage
	      
	      
	      
	      
	      
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%% Problem 3  %%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	\item {\bfseries Understanding hardness of the Discrete Logarithm Problem.} (15 points)
	      Suppose $(G,\circ)$ is a group of order $N$ generated by $g\in G$. 
	      Suppose there is an algorithm $\cA_{DL}$ that, when given input $X\in G$, it    outputs $x\in\{0,1,\dotsc,N-1\}$ such that $g^x=X$ with probability $p_X$. 
	        
	      Think of it this way: The algorithm $\cA_{DL}$ solves the discrete logarithm problem; however, for different inputs $X\in G$, its success probability $p_X$ may be different. 
	        
	      Let $p = \frac{\left(\sum_{X\in G} p_X\right)}{N}$ represent the average success probability of $\cA_{DL}$ solving the discrete logarithm problem when $X$ is chosen uniformly at random from $G$. 
	        
	      Construct a new algorithm $\cB$ that takes {\em any} $X\in G$ as input and outputs $x\in\{0,1,\dotsc,N-1\}$ (by making one call to the algorithm $\cA_{DL}$) such that $g^x=X$ with probability $p$. 
	      This new algorithm that you construct shall solve the discrete logarithm problem for {\em every} $X\in G$ with the same probability $p$. 
	        
	      ({\footnotesize {\em Remark:} 
	      	Intuitively, this result shows that solving the discrete logarithm problem for {\em any} $X\in G$ is no harder than solving the discrete logarithm problem for a {\em random} $X\in G$.
	      }) 
	      
	      {\bfseries Solution.}   
	      
	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      \newpage
	      
	      
	      
	      
	      
	      
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%% Problem 4  %%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	\item {\bfseries Concatenating a random bit string before a message.} (15 points)
	      
	      Let $m\in\zo^a$ be an arbitrary message.
	      Define the set 
	      $$ S_m = \left\{ (r \Vert m) \colon r\in\zo^b\right\}. $$
	      Let $p$ be an odd prime. 
	      Recall that in the RSA encryption algorithm, we encrypted a message $y$ chosen uniformly at random from this set $S_m.$
	      
	      Prove the following
	      $$ \underset{y\getsr S_m}{\text{Pr}} [p\text{ divides } y] \leq 2^{-b} \cdot \left\lceil 2^b/p\right\rceil.  $$
	          
	      ({\footnotesize {\em Remark:} 
	      	This bound is tight as well. 
	      	There exists $m$ such that equality is achieved in the probability expression above. 
	      	Intuitively, this result shows that the message $y$ will be relatively prime to $p$ with probability (roughly) $(1 - 1/p)$. 
	      }) 
	      
	      {\bfseries Solution.}   
	      
	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      \newpage
	      
	        
	      
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%% Problem 5  %%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	\item {\bfseries Properties of $x^e$ when $e$ is relatively prime to $\phi(N)$} (20 points)
	      
	      In this problem, we will partially prove a result from the class that was left unproven. 
	      Suppose $N=pq$, where $p$ and $q$ are distinct prime numbers. 
	      Let $e$ be a natural number that is relatively prime to $\varphi(N)=(p-1)(q-1)$. 
	      In the lectures, we claimed (without proof) that the function $x^e \colon \bbZ_N^*\to\bbZ_N^*$ is a bijection. 
	      The following problem is key to proving this result. 
	      
	      \begin{boxedalgo}
	      	Let $N = pq$, where $p$ and $q$ are distinct prime numbers. 
	      	Let $e$ be a natural number relatively prime to $(p-1)(q-1)$. 
	      	Consider $x,y\in \bbZ_N^*$. 
	      	If $x^e=y^e\mod N$, then prove that $x=y$. 
	      \end{boxedalgo}
	      
	      Hint: You might find the following facts useful. 
	      \begin{itemize}
	      	\item Every $\alpha\in \bbZ_N$ can be uniquely written as $(\alpha_p,\alpha_q)$ such that $\alpha=\alpha_p\mod p$ and $\alpha=\alpha_q\mod q$, using the Chinese Remainder theorem. 
	      	      We will write this observation succinctly as $\alpha = (\alpha_p,\alpha_q)\mod(p,q)$. 
	      	                
	      	\item For $\alpha,\beta\in \bbZ_N$, and $e\in \bbN$ we have $\alpha^e=\beta\mod N$ if and only if $\alpha_p^e =\beta_p\mod p$ and $\alpha_q^e=\beta_q\mod q$.
	      	      We will write this succinctly as $\alpha^e=(\alpha_p^e,\alpha_q^e)\mod(p,q)$. 
	      	                
	      	\item From the Extended GCD algorithm, if $u$ and $v$ are relatively prime then, there exists integers $a,b\in\bbZ$ such that $au + bv =1$. 
	      	              
	      	\item Fermat's little theorem states that $x^{p-1}=1\mod p$ if $x$ is a natural number that is relatively prime to the prime $p$. 
	      \end{itemize}
	      
	      {\bfseries Solution.}   
	      
	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      \newpage
	      
	      
	      
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%% Problem 6  %%%%%%%%%%%%%%%%%%%%%%%%%%
	      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
	\item {\bfseries Challenging: Inverting exponentiation function.} (20 points)
	      
	      Fix $N = pq$, where $p$ and $q$ are distinct odd primes. 
	      Let $e$ be a natural number such that $\gcd(e, \phi(N)) = 1$. 
	      Suppose there is an adversary $\cA$ running in time $T$ such that  
	      $$\prob{[\cA ([x^e \mod N]) = x]} = 0.01$$
	      for $x$ chosen uniformly at random from $\mathbb{Z}^*_N.$ 
	      Intuitively, this algorithm successfully finds the $e$-th root with probability $0.01$, for a random $x$. 
	          
	      For any $\eps\in(0,1)$, construct an adversary $\cB_\eps$ (which, possibly, makes multiple calls to the adversary $\cA$) such that
	      $$\prob{[\cB_\eps ([x^e \mod N]) = x]} = 1 - \epsilon,$$
	      for {\em every} $x \in \mathbb{Z}^*_N.$
	      The algorithm $\cB_\eps$ should have a running time polynomial in $T, \log N,$ and $\log 1/\epsilon$. 
	      
	      {\bfseries Solution.}   
	      
	      \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE
	      
\end{enumerate}


\end{document}
