\documentclass[11pt]{article}
\input{headers05}

\usepackage{fancyhdr}   
\pagestyle{fancy}      
\lhead{CS 355, Spring 2024}               
\rhead{Name: Hemanta K. Maji} %%% <-- REPLACE Hemanta K. Maji WITH YOUR NAME HERE

\usepackage[strict]{changepage}  
\newcommand{\nextoddpage}{\checkoddpage\ifoddpage{\ \newpage\ \newpage}\else{\ \newpage}\fi}  


\begin{document}

\title{Homework 5}

\date{}

\maketitle 

\thispagestyle{fancy}  
\pagestyle{fancy}      




\begin{enumerate}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 1 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Stretching PRG Output.} (10 points)
Suppose we are given a length-doubling PRG $G$ such that 
$$G:\{0,1\}^B \rightarrow \{0,1\}^{2B}$$
Using $G$, construct a new PRG $G'$ such that 
$$G': \{0,1\}^B \rightarrow \{0,1\}^{2024B}$$

({\footnotesize Remark: We do not need a security proof. 
You should only use the PRG $G$ to construct the new PRG $G'$. 
In particular, you should not use any other cryptographic primitive like one-way function etc.}%
)

  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage


%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%% PROBLEM 2 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries New Pseudorandom Function Family.} (7+8+10) 
  Let $G$ be a length-doubling PRG $G\colon\zo^B\to\zo^{2B}$. 
  Recall the basic  GGM PRF construction presented below. 
   \begin{boxedalgo}
 \begin{itemize}
     \item  Define $G(x) = (G_0(x), G_1(x))$ where $G_0,G_1 : \{0,1\}^B \rightarrow \{0,1\}^B$
%    \item Let $G' : \{0,1\}^B \rightarrow \{0,1\}^n$ be a PRG. 
    \item  We define $g_{\pred{id}}(x_1,x_2,\ldots x_n)$ as $G_{x_n}(\ldots G_{x_2}(G_{x_1}(\pred{id})) \ldots )$ \\where $\pred{id} \xleftarrow[]{\$} \zo^B$.
 \end{itemize}
  \end{boxedalgo}
  Recall that in the class we studied that $g_{\pred{id}}$ is a PRF family for $\zo^n\to\zo^B$, for a fixed value of $n$ when the key $\pred{id}$ is picked uniformly at random from the set $\zo^B$. 

  \begin{enumerate}
   \item (7 points) Why is the above-mentioned GGM construction not a pseudorandom function family from the domain $\zo^*$ to the range $\zo^B$? (Note that $\{0,1\}^{*}$ means that the length of the input to the PRF is arbitrary) \newline 
     {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \item (8 points) Given a length-doubling PRG $G\colon\zo^B\to\zo^{2B}$, construct a PRF family from the domain $\zo^n$ to the range $\zo^{2024B}$. \newline 
  ({\footnotesize Remark: Again, in this problem, do not use any other cryptographic primitive like one-way function etc. You should only use the PRG $G$ in your proposed construction.}) \newline 
   {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \item (10 points) Consider the following function family $\{h_1,\dotsc,h_\alpha\}$ from the domain $\zo^*$ to the range $\zo^B$. 
    We define $h_{\pred{id}}(x) = g_{\pred{id}}(x , [\;\abs x\;]_2)$, for $\pred{id}\in\{1,2,\dotsc,\alpha\}$. 
    Show that $\{h_1,\dotsc,h_\alpha\}$ is \ul{not} a secure PRF from $\zo^*$ to the range $\zo^B$. 
    
    ({\footnotesize {\em Note}: The expression $[\;\abs x\;]_2$ represents the length of $x$ in $n$-bit binary expression. ($n$ denotes the length of $x$)}) \newline 
      {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage
  \end{enumerate} 
  



%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%% PROBLEM 3 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\item {\bfseries Variant of Pseudorandom Function Family.} (15 points)
  Let $G$ be a length-doubling PRG $G\colon\zo^B\to\zo^{2B}$ and $G' : \{0,1\}^B \rightarrow \{0,1\}^T$ be a PRG where $T\geq B$. 
  The following construction is suggested to construct a PRF family from $\{0,1\}^* \rightarrow \{0,1\}^T$. 
  (Note that $\{0,1\}^{*}$ means that the length of the input to the PRF is arbitrary) 
   \begin{boxedalgo}
 \begin{itemize}
     \item Define $G(x) = (G_0(x), G_1(x))$ where $G_0,G_1 : \{0,1\}^B \rightarrow \{0,1\}^B$
   \item Let $G' : \{0,1\}^B \rightarrow \{0,1\}^T$ be a PRG. 
    \item We define $g_{\pred{id}}(x_1,x_2,\ldots x_n)$ as $G'(G_{x_n}(\ldots G_{x_2}(G_{x_1}(\pred{id})) \ldots ))$ \\where $\pred{id} \xleftarrow[]{\$} \zo^B$.
 \end{itemize}
  \end{boxedalgo}
  
 % In this problem, we shall generalize the GGM PRF construction in two ways. 
  %\begin{enumerate}
   %\item 
 Prove that the above-mentioned PRF construction is \ul{not} secure when $G'=G$. (Note that when $G'=G$, then $T=2B$). 
   %\end{enumerate} 
  

  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 4 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries OWF.} (10 points)
Let $f:\{0,1\}^n \rightarrow \{0,1\}^n$ be a one-way function. Define
$g: \{0,1\}^{2n}\rightarrow \{0,1\}^{2n}$ as \[g(x_1,x_2)=f(x_1\oplus 1^n)||x_1\oplus x_2\]\\
where $x_1 \in \{0,1\}^n$, $x_2 \in \{0,1\}^n$ and $1^n$ denotes a string of $n$ bits. Show that $g$ is also a one-way function. \newline 
{\footnotesize Hint. Suppose there exists an efficient adversary $\cA$ that inverts the function $g$ . 
  You should now construct a new efficient adversary $\cA'$ that uses $\cA$ as a subroutine to invert the function $f$.} \newline 
  {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage




%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 5 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Encryption using Random Functions.} (15+10 points)
  Let $\cF$ be the set of all functions $\zo^{n} \to \zo^n$. 
  Consider the following private-key encryption scheme. 
  \begin{boxedalgo}
  \begin{itemize}
  \item $\gen()$: Return $\sk=F$ uniformly at random from the set $\cF$ 
  \item $\enc_\sk(m)$: Return $(c,r)$, where $r$ is chosen uniformly at random from $\zo^n$, $c = m\oplus F(r)$, and $\sk=F$.  
  \item $\dec_\sk(\widetilde c,\widetilde r)$: Return $\widetilde c \oplus F(\widetilde r)$.
  \end{itemize}
  \end{boxedalgo}
  
  \begin{enumerate}
  \item (15 points) Suppose we want to ensure that even if we make $10^{30}$ calls to the encryption algorithm, all randomness $r$ that are chosen are distinct with probability $1-2^{- 401}$. 
    What value of $n$ shall you choose? \newline 
     {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage

  \item (10 points) Conditioned on the fact that all randomness $r$ in the encryption schemes are distinct, prove that this scheme is secure. \newline 
   {\bfseries Solution.}  \newline
   \   %%% <-- ERASE THIS LINE AND WRITE YOUR SOLUTION HERE  
     \newpage

  \end{enumerate}
 

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 6 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries Birthday Paradox.} (10 points)   
Recall that the Birthday Paradox states that if we throw $m= c\sqrt{n}$ balls into $n$ bins, then the probability that there exists a collision (\ie, a bin with at least two balls) is $\geq 0.99$, where $c>0$ is an appropriate constant. \newline
An international university has 12 colleges. Moreover, the students of this university come from 121 different countries around the world. How many students (from the university) in a room will ensure with probability $\geq 0.99$ that there exists at
least a pair of students such that they are from the same country, the same college, and they celebrate their birthday at the same month.
\newpage

\item
{\bfseries PRF.}(10 points) 
Suppose the set of functions $F_\id \colon \zo^n\to\zo^n$ forms a \ul{secure} PRF when $\id$ is chosen uniformly at random from the set $\zo^n$.

We are now constructing a new PRF family $G_\id\colon\zo^{2n}\to\zo^{2n}$, where $\id\in\zo^n$. 
This new function is defined as follows.
  $$ G_\id(x_1,x_2) \defeq \left( ~  x_2 \xor F_\id(x_1) ~, ~ F_\id(x_2) ~ \right)$$
Is this new PRF secure or not? 

(If you think that it is secure, then prove that it is secure.
If you think that it is insecure, then prove why this construction is insecure. 
You get no points for just writing Yes/No.)


\newpage



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PROBLEM 7 %%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\item {\bfseries One Way Function (12 points)} 
In this problem, we will show that a one-way function cannot have a small range.

\begin{enumerate}
    \item (\textbf{6 points})
    First, we need an inequality. 
    Prove that
      $$ p_1^2 + p_2^2 + \dotsi + p_k^2 \geq \frac1k,$$
    where $p_1,\dotsc,p_k\geq0$ such that $p_1+\dotsi +p_k=1$.
    
    Hint: The Cauchy-Schwarz inequality says that for non-negative $x_i$ and $y_i$s, the following inequality holds. 
      $$ \sum_{i=1}^k x_iy_i \leq \left(\sum_{i=1}^k x_i^2\right)^{1/2} \left(\sum_{i=1}^k y_i^2\right)^{1/2}$$
    
    
    \newpage
    
    \item (\textbf{6 points})
    Suppose $f\colon \zo^n \to \zo^\ell$ be a function. 
    The honest challenger samples $x\getsr\zo^n$ and sends the challenge $y=f(x)$ to us. 
    We, on input $y$, run the following algorithm
    \begin{boxedalgo}
        \begin{algorithmic}[1]
            \State Sample $r\getsr \zo^n$
            \State Compute $t = f(r)$
            \State If $y==t$: return $\widetilde x=r$
            \State Else: return $\widetilde x=0$. 
        \end{algorithmic}
    \end{boxedalgo}
    
    Prove that the probability of our algorithm successfully inverting the one-way function $f$ is $\geq \frac1{2^\ell}$ (over the random choice of $x\getsr\zo^n$ by the honest challenger). 
    Equivalently, prove that
      $$ \mathop{\text{Pr}}_{x,r\getsr\zo^n}\left[f(\widetilde x) = f(x)\right] \geq \frac1{2^\ell}.$$
    
    {\footnotesize (Remark: It is not necessary that the size of the preimage of $y\in\zo^\ell$ is same as the size of the preimage of another $y'\in\zo^\ell$.)} 
\end{enumerate}
\end{enumerate}

\newpage
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%% PLEASE LIST COLLABORATORS BELOW  %%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
{\bfseries Collaborators :} \newline 
% ENTER THEIR NAMES HERE  

\end{document}
