Which of the following are true for obtaining perfect secrecy using the one-time pad, assuming the message space contains messages all of some fixed length? (Check all that apply.)

The key should be shared between the two communicating parties, and kept secret from any potential attacker.

The key must be as least as long as the messages in the message space.

The key should be chosen uniformly.

The all-0 key must be avoided, since when the all-0 key is used the ciphertext is equal to the message being encrypted.

Which of the following are true about the Vigenere cipher? (Check all that apply.)

The Vigenere cipher is perfectly secret if the length of the key is equal to the length of the messages in the message space.

The Vigenere cipher is computationally infeasible to break if the key has length 100, even if 1000s of characters of plaintext are encrypted.

The Vigenere cipher can always be broken, regardless of the length of the key and regardless of the length of plaintext being encrypted.

A Vigenere cipher with key of length 100 can be broken (in a reasonable amount of time) using exhaustive search of the key space.

Two ASCII messages containing English letters and spaces only are encrypted using the one-time pad and the same key. The 10th byte of the first ciphertext is observed to be 0xB7 and the 10th byte of the second ciphertext is observed to be 0xE7. Let m1 (resp., m2) denote the 10th ASCII character in the first (resp., second) message. What is the most you can conclude about m1 and m2?

One of m1 or m2 is the space character, and the other is the character 'p'.

Nothing can be determined about m1 or m2 since the one-time pad is perfectly secret.

m1 is the character 'p' and m2 is the space character.

m1 is the space character and m2 is the character 'p'.

m1 is the character 'B' and m2 is the character 'E'.

Three ASCII messages containing English letters and spaces only are encrypted using the one-time pad and the same key. The 10th byte of the first ciphertext is observed to be 0x66, the 10th byte of the second ciphertext is observed to be 0x32, and the 10th byte of the third ciphertext is observed to be 0x23. Let m1 (resp., m2, m3) denote the 10th ASCII character in the first (resp., second, third) message. What is the most you can conclude about m1, m2, and m3?

m1 is the space character, m2 is the character 't', and m3 is the character 'e'.

Exactly one of m1, m2, or m3 is the space character, but nothing else can be determined.

m1 is the character 't', m2 is the space character, and m3 is the character 's'.

Nothing can be determined about m1, m2, or m3 since the one-time pad is perfectly secret.

Which of the following is true about computational secrecy? (Select all that apply.)

Computational secrecy only ensures secrecy against attackers running in some bounded amount of time.

Computational secrecy allows an attacker to learn information about the message with small probability.

Computational secrecy currently relies on unproven assumptions.

Computational secrecy means that it is trivial for an attacker to always learn the entire message.

Let G be a function mapping n-bit inputs to 2n-bit outputs. Which of the following is true of the pseudo one-time pad encryption scheme based on G? (Check all that apply.)

The scheme is computationally secret if G is a pseudorandom generator.

The scheme is perfectly secret.

The scheme can be used securely to encrypt multiple messages using the same key.

The key space of the scheme is at least as large as the message space.

Which of the following attackers can be used to demonstrate that the shift cipher for 3-character messages does not satisfy perfect indistinguishability?

Output m0 = 'aaa' and m1 = 'abc'. Given challenge ciphertext C, output 1 if the three characters of C are all different.

Output m0 = 'aaa' and m1 = 'bbb'. Given challenge ciphertext C, output 0 if the first character of C is 'a'.

Output m0 = 'aaa' and m1 = 'abc'. Given challenge ciphertext C, output 0 if the first character of C is 'a'.

Output m0 = 'abc' and m1 = 'bcd'. Given challenge ciphertext C, output 1 if the three characters of C are all different.

Define the following function G taking n-bit inputs and producing (n+1)-bit outputs: G(x)=x∥0, where ∥ denotes concatenation. Which of the following attackers shows that this G is not a pseudorandom function?

On input an (n+1)-bit string y, output 0 if the last bit of y is 0.

On input an (n+1)-bit string y, output 1 if the first bit of y is 0.

On input an (n+1)-bit string y, output 0 if the first bit of y is 0.

On input an (n+1)-bit string y, output 0 if the first bit of y is equal to the last bit of y.

Say G is a pseudorandom generator taking n-bit inputs and producing 2n-bit outputs. Which of the following are necessarily true? (Check all that apply. The symbol '|' is used here for string concatenation.)

G(r) is computationally indistinguishable from a uniform, 2n-bit string if r is a uniform n-bit string.

G(r) | G(r+1) is computationally indistinguishable from a uniform, 4n-bit string if r is a uniform n-bit string.

G(0 | r) is computationally indistinguishable from a uniform, 2n-bit string if r is a uniform (n-1)-bit string.

r | G(r) is computationally indistinguishable from a uniform, 3n-bit string if r is a uniform n-bit string.

Which of the following is a setting in which a pseudorandom generator could be applied?

You have a way to generate random bits at the rate of 100 bits/second, but you need 1,000,000 random bits to run a statistical simulation.

You have a 1 MB file and you would like to make sure that it has not been tampered with.

You have a 1 MB file that you would like to compress.

Consider a pseudo one-time pad encryption scheme Π constructed using some function G. Which of the following did our proof of security for the pseudo one-time pad show?

If G is a pseudorandom generator, then Π is computationally secret.

Π is always computationally secret, for any G.

If G is a pseudorandom generator, then Π is perfectly secret.

Π is always perfectly secret, for any G.

Let F be a block cipher with 128-bit block length. Consider the following encryption scheme for 256-bit messages: to encrypt message M=m1∥m2 using key k (where m1=m2=128), choose random 128-bit r and compute the ciphertext. Which of the following strategies would lead to a valid chosen-plaintext attack?

Let m1 and m2 be arbitrary but distinct. Using the encryption oracle, obtain an encryption r||c1||c2 of m1||m2. Output messages M0 = m1||m2 and M1 = m2||m1. Output 0 if the third block of the challenge ciphertext is c2.

Choose random r and let m be arbitrary but not equal to r. Output messages Mo = r||m and M1 = m||m. Output 0 if the second block of the challenge ciphertext is all-0s.

There is no attack; this scheme is randomized, so it is CPA-secure.

Let m1 and m2 be arbitrary but distinct. Using the encryption oracle, obtain an encryption r||c1||c2 of m2 || m2. Output messages M0 = m1||m1 and M1 = m1||m2. Output 0 if the third block of the challenge ciphertext is c2.

Let F be a pseudorandom function with 128-bit key and 256-bit block length. Which of the following functions G are necessarily pseudorandom generators? (Select all that apply.)

G(x) = F.(0...0)|F.(1...1), where x is a 128-bit input.

G(x) = F.(0...0), where x is a 128-bit input.

G(x) = F,(0...0)| F,(0...0), where x is a 128-bit input.

G(x) = F0...0(x)| F1...1(x), where x is a 256-bit input

Define the keyed function F as follows: Fk(x) = f O x. Which of the following distinguishers demonstrates that F is not a pseudorandom function?

Given access to an oracle g, query y0 = g(0...0) and y1 = g(1... 1). Then output 1 if and only if Y0 ⊕ У1 = 1... 1.

Given access to an oracle g, query y = g(0... 0). Then output 1 if and only if the first bit of y is equal to 1.

Given access to an oracle g, query g(0 ... 0). Then output 1 because we now have the key.

Given access to an oracle g, query y = g(0...0) and y' = g(0...0). Then output 1 if and only if y = у'.

Let F be a block cipher with n-bit block length. Consider the following encryption scheme: to encrypt a message viewed as a sequence of n-bit blocks m1,m2,...,mt using a key k, choose a random n-bit value r and then output the ciphertext r,Fk(r+1+m1),Fk(r+2+m2),...,Fk(r+t+mt), where addition is done modulo 2n. Which of the following attackers demonstrates that this scheme is not computationally indistinguishable:

Let m be an arbitrary n-bit block, and output Mo = m, m and M1 = m, m - 1. Given challenge ciphertext r, C1, C2, output 1 if and only if c1 = C2.

Choose random n-bit blocks m and m', and output Mo = m, m and M1 = m, m'. Given challenge ciphertext r, C1, C2, output 1 if and only if c1 = C2.

Let m be an arbitrary n-bit block, and output Mo = m and M1 = m, m. Given a challenge ciphertext, output 0 if the challenge ciphertext contains 2 blocks, and output 1 otherwise.

Choose random n-bit blocks m1, m2, m3, m4, and output Mo = m1, m2 and M1 = m3, m4. Given challenge ciphertext r, C1, C2, output 0 if r = 0.0, and output 1 otherwise.

Say we use CBC-mode encryption based on a block cipher with 256-bit key length and 128-bit block length to encrypt a 512-bit message. How long is the resulting ciphertext?

Not enough information to determine.

Assume CTR-mode encryption with PKCS #5 padding and a block cipher with 8-byte block length. Say a 4-byte message is encrypted, resulting in ciphertext 0x00 01 02 03 04 05 06 07 00 01 02 03 04 05 06 07. Which of the following ciphertexts will NOT yield an error upon decryption?

0x00 01 02 03 04 05 06 07 00 01 02 04 04 05 07 07

0x00 01 02 03 04 05 06 07 00 01 02 03 04 05 06 F7

0x00 01 02 03 04 05 06 07 00 01 02 03 04 05 07 07

0x00 01 02 03 04 05 06 07 00 01 02 03 05 05 06 07

Let F be a block cipher with n-bit block length. Consider the message authentication code for 2n-bit messages defined by Mack(m1,m2)=Fk(m1⊕m2). Which of the following gives a valid attack on this scheme?

Obtain tag t on message m1,m2 (with m1≠m2), and then output the tag t on the message m2,m1.

Obtain tag t on message m, 0 ... 0 (with m≠0...0), and then output the tag t on the message 0...0,0...0.

Obtain tag t on message m,m, and then output the tag 0...0 on the message 0...0,m.

Obtain tag t on message m,0...,0, and then output the tag t⊕(1...1) on the message m,1...1.

Let F be a block cipher with n-bit block length. Consider the message authentication code for 2n-bit messages defined by Mack(m1,m2)=Fk(m1)⊕Fk(m2). Which of the following gives a valid attack on this scheme?

Output the tag 0...0 on the message 0...0,0...0.

There is no attack; the scheme is secure.

Obtain tag t on the message 0...0,1...10...0,1...1, and output the tag t⊕(1...1) on the message 1...1,1...11... 1,1...1.

Obtain tag �t on the message 0...0,1...10...0,1...1, and output the tag t⊕(1...1) on the message 1...1,0... 01...1,0...0.

Assume a sender and receiver use basic CBC-MAC but authenticate/accept messages of different lengths. Which of the following is a valid attack?

Obtain tag t1 on message m1, and tag t2 on message m1,m2. Then output the tag t2 on the message t1⊕m2.

Obtain tag t1 on message m1, and tag t2 on message m1,m2. Then output the tag t1 on the message t2⊕m2.

Obtain tag t1 on message m1, and tag t2 on message m2,m1. Then output the tag t2 on the message m1,m2.

Obtain tag t1 on message m1, and tag t2 on message t1,m2. Then output the tag t2 on the message m1⊕m2.

Let H,H′ be collision-resistant hash functions. Which of the following functions H′′ is NOT necessarily collision-resistant?

H′′(x)=H(x)∥H′(x), where ∥∥ denotes concatenation.

H′′(x)=H(x)∥0...0, where ∥∥ denotes concatenation.

Assume a sender and receiver use the encrypt-and-authenticate approach for variable-length messages, using CTR-mode encryption and a variant of CBC-MAC secure for authenticating variable-length data (and independent keys for each). Which of the following statements is true?

The combination is not CPA-secure, but it does provide integrity.

The combination is CPA-secure, but it does not provide integrity.

The combination is not CPA-secure, and it does not provide integrity because the CTR-mode encryption allows the attacker to forge a tag in the CBC-MAC.

The combination is not CPA-secure, and it does not provide integrity because CTR-mode encryption is malleable.

Let F be a block cipher with block length n. Consider the following encryption scheme for n-bit messages: to encrypt message m using key k, choose a random c0∈{0,1}^n and output the ciphertext c0,c1,Fk(Fk (c0)⊕c1), where c1=Fk(c0)⊕m. Which of the following statements is true?

This looks like the encrypt-then-authenticate approach using CTR-mode and CBC-MAC, except that here the same key is being used for both -- Prof. Katz warned us about that; this looks insecure!

This can be viewed as an example of the encrypt-and-authenticate approach using CBC-mode and CBC- MAC (with the same key), and is insecure.

This looks like the authenticate-then-encrypt approach using CBC-MAC and CBC-mode encryption (with the same key) -- but here it's ok, since CBC-MAC is applied to something random.

This is an example of the encrypt-then-authenticate approach using CTR-mode and CBC-MAC, so is secure.

Which of the following is the most appropriate primitive for achieving message integrity between two users sharing a key?

Collision-resistant hash function.

Consider the following algorithm for factoring an integer N provided as input (in binary): For i=2to⌈N− −√⌉, if I divides N, then output(i,N/i). Which of the following statements is true?

This algorithm is correct, but it runs in exponential time.

This algorithm is not correct, because it will sometimes fail to find a factorization of N even if N is composite.

This algorithm runs in sub-linear time, and always factors N if N is composite.

This algorithm is not correct, because it will sometimes output a non-trivial factorization of N even when N is prime.

Which of the following is NOT a group?

The integers under multiplication.

The set {0,1,2,...,27} under addition modulo 28.

The set {1,3,7,9} under multiplication modulo 10.

Which of the following is the multiplicative inverse of 10 modulo 15?

There is none, since gcd(10,15) !=1.

Which of the following problems is hard if the RSA assumption holds? In all the below, N is a product of distinct, large primes p and q, and e is relatively prime to φ(N).

Given N, e, and a uniform value y∈ZN∗, find x such that x^e=ymodN.

Given N and e, find x such that x^e=8modN.

Given N,e, and a uniform value x∈ZN∗, find y such that x^e=ymodN.

Given N and e, find x,y such that x^e=ymodN.

Which of the following is a generator of Z13∗?

Z13∗ does not have a generator since it is not a cyclic group.

Let G be a cyclic group of order q and with generator g. Based only on the assumption that the discrete- logarithm problem is hard for this group, which of the following problems is hard?

Given a uniform y∈G, find x such that gx=y.

Given uniform x∈Zq and uniform y∈G, compute yx⋅g.

Given a uniform x∈Zq, find y such that gx=y.

Which of the following is a drawback of the private-key setting that is NOT addressed by the public-key setting?

The communicating parties need the ability to generate random bits.

The communicating parties need to have some prior relationship.

The communicating parties need to share some secret information in advance.

Users must manage and securely store keys for every other party with whom they wish to communicate securely.

Which of the following BEST describes the security offered by the Diffie-Hellman key-exchange protocol (assuming the DDH problem is hard)?

An attacker eavesdropping on an execution of the protocol cannot distinguish the key shared by the parties from a uniform key.

An attacker eavesdropping on an execution of the protocol cannot compute the key shared by the parties.

An attacker eavesdropping on an execution of the protocol does not know whether the parties have shared a key or not.

An attacker is unable to impersonate either party taking part in the protocol.

Assume the Diffie-Hellman protocol is run by two parties in the subgroup of Z23∗ generated by 2. (This subgroup has order 11.) If the first party chooses private exponent 3 and the second chooses private exponent 10, which of the following characterizes the execution of the protocol in this case?

The first party sends 8, the second party sends 12, and they share the key 3.

The first party sends 8, the second party sends 1, and they share the key 1.

The first party sends 3, the second party sends 10, and they share the key 11.

The first party sends 8, the second party sends 12, and they share the key 20.

In which of the following scenarios is public-key encryption a better choice than private-key encryption?

A user wants to send his credit-card number to a merchant on the web.

A general wants to communicate securely with a lieutenant.

A user wants to encrypt the contents of her hard drive.

Two police officers want to set up their communication devices to communicate securely before heading out to an operation.

Which of the following would NOT be a secure way for a receiver to distribute her key for a public-key encryption scheme? (Assume a passive, eavesdropping attacker here.)

Post the private key on one's webpage.

Email the public key to the other party upon request.

Post the public key on one's webpage.

Put the public key into a public directory.

Cryptography

Quiz

•

Computers

•

University

•

Practice Problem

•

Medium

AIzhan Kakharman

Used 81+ times

FREE Resource

80 questions

Show all answers

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

Consider the Vigenere cipher over the lowercase English alphabet, where the key length can be anything from 8 to 12 characters. What is the size of the key space for this scheme?

4 * 26^12

26!

26^12

26^8 + 26^9 + 26^10 + 26^11 + 26^12

MULTIPLE SELECT QUESTION

30 sec • 1 pt

Consider the Vigenere cipher over the lowercase English alphabet, where the key has length 8. For which of the following message spaces will this scheme be perfectly secret? (Check all that apply.)

The set of all 8-character strings of lowercase English letters.

The set of all 9-character strings of lowercase English letters.

The set of all strings of lowercase English letters containing at most 8 characters.

The set of all 7-character strings of lowercase English letters.

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

What is the result of encrypting the ASCII plaintext 'cool!' using the variant Vigenere cipher (where encryption is done using byte-wise XOR) and key 0x01 3F?

0x26 05 E6 35 02

0x63 6F 6F 6C 21

0x62 50 6F 6C 21

0x62 50 6E 53 20

MULTIPLE SELECT QUESTION

30 sec • 1 pt

Say we have a scheme with a claimed proof of security with respect to some definition, based on some assumption. The scheme was successfully attacked when used in the real world. What are possible reasons for this? (Check all that apply.)

The proof might be incorrect.

The definition of security may not correctly capture the real-world threat model.

The assumption may be false.

The attacker did not read the proof of security.

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

In the definition of perfect secrecy, what threat model is assumed?

The attacker can eavesdrop on a single ciphertext.

The attacker is able to interfere with the communication channel between the two honest parties.

The attacker can eavesdrop on as many ciphertexts as it likes.

The attacker can carry out a chosen-plaintext attack.

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

Consider the Vigenere cipher over the lowercase English alphabet, where the key can have length 1 or length 2, each with 50% probability. Say the distribution over plaintexts is Pr[M='aa'] = 0.4 and Pr[M='ab'] = 0.6. What is Pr[C='bb']? Express your answer to 4 decimal places with a leading 0, i.e., if your answer was 1/2 then you would enter 0.5000 (without a trailing period).

0.01

0.0001

0.0084

0.0072

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

Consider the Vigenere cipher over the lowercase English alphabet, where the key can have length 1 or length 2, each with 50% probability. Say the distribution over plaintexts is Pr[M='aa'] = 0.4 and Pr[M='ab'] = 0.6. What is Pr[M='aa' | C='bb']? Express your answer to 4 decimal places with a leading 0, i.e., if your answer was 1/2 then you would enter 0.5000 (without a trailing period). Note: carry out the calculation exactly (i.e., do not use the truncated result that you entered as your answer in the previous question) before truncating your answer to 4 decimal places.

0.9473

0.1

0.0024

0.4839

Access all questions and much more by creating a free account

Create resources

Host any resource

Get auto-graded reports

Continue with Google

Continue with Email

Continue with Classlink

Continue with Clever

or continue with

Microsoft

Apple

Others

Already have an account?

Similar Resources on Wayground

75 questions

Đề 28 E3 HT 23.24

Quiz

•

University

80 questions

Coursera 1 part

Quiz

•

University

80 questions

ITSM-prefi-reviewer

Quiz

•

University

75 questions

Career Development Semester Exam 2025

Quiz

•

8th Grade - University

77 questions

SC-900 (81-167)

Quiz

•

University

80 questions

Revision 8 cohort july

Quiz

•

University

77 questions

Computer Components Quiz

Quiz

•

University

80 questions

Chương 10

Quiz

•

University

Popular Resources on Wayground

15 questions

Fractions on a Number Line

Quiz

•

3rd Grade

20 questions

Equivalent Fractions

Quiz

•

3rd Grade

25 questions

Multiplication Facts

Quiz

•

5th Grade

$fractions$

22 questions

fractions

Quiz

•

3rd Grade

20 questions

Main Idea and Details

Quiz

•

5th Grade

20 questions

Context Clues

Quiz

•

6th Grade

15 questions

Equivalent Fractions

Quiz

•

4th Grade

20 questions

Figurative Language Review

Quiz

•

6th Grade

Discover more resources for Computers

30 questions

Quiz 1 Review

Quiz

•

University

Cryptography

80 questions

Consider the Vigenere cipher over the lowercase English alphabet, where the key length can be anything from 8 to 12 characters. What is the size of the key space for this scheme?

Consider the Vigenere cipher over the lowercase English alphabet, where the key has length 8. For which of the following message spaces will this scheme be perfectly secret? (Check all that apply.)

What is the result of encrypting the ASCII plaintext 'cool!' using the variant Vigenere cipher (where encryption is done using byte-wise XOR) and key 0x01 3F?

Say we have a scheme with a claimed proof of security with respect to some definition, based on some assumption. The scheme was successfully attacked when used in the real world. What are possible reasons for this? (Check all that apply.)

In the definition of perfect secrecy, what threat model is assumed?

Which of the following are true for obtaining perfect secrecy using the one-time pad, assuming the message space contains messages all of some fixed length? (Check all that apply.)

Consider the one-time pad over the message space of 5-bit strings, where Pr[M=00100] = 0.1 and Pr[M=11011] = 0.9. What is Pr[C=00000]? Express your answer to 5 decimal places with a leading 0. I.e., if your answer was 1/2, then you would enter 0.50000 (without a trailing period).

Which of the following are true about the Vigenere cipher? (Check all that apply.)

Access all questions and much more by creating a free account

Similar Resources on Wayground

Popular Resources on Wayground

Discover more resources for Computers