Font size
WorksheetsCryptography
Total questions: 60
Worksheet time: 38mins
1. Assume you are given a 500-character encrypted message, encrypted in Vigenère cryptosystem, in which you know the plaintext word CRYPTOGRAPHY occurs exactly two times, and we know that the ciphertext sequence PTFDLSTTHDZC is the encryption of CRYPTOGRAPHY. The first occurrence starts at character position 24 and second at character position 198 (we start counting from 1). What is the length of the key used for encryption?
5
6
8
9
Which of the following statement(s) is/are correct?
1.Any encryption scheme with key length less than message length can not be a perfectly-secure scheme.
2.A scheme is COA secure if and only if it is KPA secure
3.The one-time pad scheme is perfectly-secure if on any subsequent invocation of the key generation algorithm, an earlier key gets re-generated.
4.A scheme is CPA secure if and only if it is CCA secure
1 and 3
1,2,and 3
2 and 4
Neither of 1, 2, 3 or 4
Consider an instance of shift cipher with the probability distribution over the message space as follows: P[M=a] = 0.25, P[M=b] = 0.5, P[M=c] = 0.25. Then identify the correct statement(s) from the following?
Probability that the ciphertext is “D” is the same as the probability that the ciphertext is “E”
Probability that the ciphertext is “D” is half the probability that the ciphertext is “E”
Probability that the ciphertext is “A” is 1/4th the probability that the ciphertext is “D”
Probability that the ciphertext is “D” is 1/26
Which of the following is/are true for the Vernam cipher?
The scheme is CPA-secure
The scheme is not single-message COA-secure, if the sender obtains a key k=0n
from the key-generation algorithm
The scheme is not single-message COA-secure, as the encryption algorithm is deterministic
The scheme is not CPA-secure
Which of the following is/are not perfectly secure encryption scheme(s):
Playfair Cipher
Vernam Cipher
Affine Cipher
Vigenère Cipher
Let G:{0,1}m→{0,1}n be a secure PRG. Then consider the function G′:{0,1}m+1→{0,1}n+1 , where G′(s1||s2)=defG(s1)||s2. Then which of the following is/are false for G′?
The construction G′ is not a secure PRG, as it always leaks the last bit of the seed.
The construction G′ is a secure PRG, provided its seeds are chosen uniformly random.
The construction G′ is not a secure PRG, even if its seeds are chosen randomly.
The construction G′ is a secure PRG, no matter how its seeds are chosen.
Let G:{0,1}m→{0,1}n be a secure PRG. Then which of the following is/are not a secure PRG?
G′:{0,1}m→{0,1}n, where G′(s)=defG(s)⊕1n
G′:{0,1}m→{0,1}n, where G′(s)=defG(s)⊕0n
G′:{0,1}m→{0,1}2n, where G′(s)=defG(s)||G(s)
None of the above
Suppose we want to execute OTP encryption scheme over message space M={0,1}ℓ+1
but with key-space K={0,1}ℓ. For this, to encrypt an (ℓ+1)-bit message using an ℓ-bit random key k, the encryption algorithm picks an additional random bit x and outputs the ciphertext c=m⊕(k∥x).
The adversary will not learn any information about the underlying message
The adversary can learn something about the underlying message
The scheme satisfies correctness property without any error
The scheme satisfies the correctness property except with probability ½
Let G:{0,1}m→{0,1}n be a secure PRG. Then which of the following is/are true?
G′:{0,1}2m→{0,1}n, where G′(s1||s2)=defG(s1)⊕G(s2) is a secure PRG.
G′:{0,1}2m→{0,1}n, where G′(s1||s2)=defG(s1)⊕G(s2) is not a secure PRG.
G′:{0,1}2m→{0,1}2n, where G′(s1||s2)=defG(s1)||G(s2) is a secure PRG.
G′:{0,1}2m→{0,1}m+n, where G′(s1||s2)=defs1||G(s2) is not a secure PRG.
Difference between perfect security and semantic security involves one or more of the following:
Bounds on how long the adversary can run the experiment
In the respective indistinguishability experiment, adversary has the exact same probability of success
Bounds on computational capabilities of the adversary
None of the above
Which of the following is/are true for One-Way Functions (OWF)?
They are deterministic functions
OWF can be a many-to-one function
A One-Way Permutation (OWP) is an OWF which is also a bijection
The time complexity to compute the inverse of OWFs is a polynomial function of the security
Select the incorrect option(s):
Trivium is a hardware-oriented stream cipher
In the CPA security model, the adversary is allowed to interact with the encryption oracle a polynomial number of times
RC4 cipher is a practical instantiation of a secure PRG
Encryption algorithm in any stream cipher is randomized
Which of the following statement(s) is/are correct?
If a PRG exists, then so does one-way functions and vice-versa
Determining the sign of x , for x∈ ℝ, given x2, is an example of a hard-core predicate
A single-message CPA-secure encryption scheme is also a multi-message CPA-secure scheme
Secure PRGs can be constructed using secure PRFs and vice-versa
Let F:{0,1}n×{0,1}n→{0,1}n be a secure PRF. Then consider the keyed function F′:{0,1}2n×{0,1}n→{0,1}n, where F′(k1∥k2,x)≜F(k1,x)⊕F(k2,x).
The function F' is a secure PRF
The function F' is not a secure PRF, if k1 is publicly known
The function F' is not a secure PRF, if k2 is publicly known
The function F' is not a secure PRF, if k1 and k2 are publicly known
Let F:{0,1}n×{0,1}n→{0,1}n be a secure PRF. Then which of the following is/are not a secure PRF?
The function F′:{0,1}n×{0,1}n→{0,1}n, where F′k(x)≜Fk(x)⊕x.
The function F′:{0,1}n×{0,1}n→{0,1}n, where F′k(x)≜FFk(0)(x).
The function F′:{0,1}n×{0,1}n→{0,1}n, where F′k(x)≜FFk(x)(x).
The function F′:{0,1}n×{0,1}n→{0,1}2n, where F′k(x)≜FFk(0)(x)∥x.
Suppose we use CBC-mode of encryption with a block cipher with key-length of 256 bits and block length of 128 bits to encrypt a 2048-bit message. Then What will be the length of the resulting ciphertext?
2048 bits
4096 bits
2176 bits
None of the above
Consider a variant of the CBC mode, where the encryption rule for encrypting the ith
block mi is ci=ci−1⊕Fk(mi)
The variant is multi-message COA-secure
The variant is single-message CPA-secure
The variant is not CPA-secure
The variant is both CPA as well as CCA-secure
A sender produces a ciphertext using ECB mode. Imagine one of the bits of the ciphertext gets flipped during the transmission. Then:
g end
Exactly one of the bits of the recovered plaintext will be incorrect
All the bits of the recovered plaintext will be incorrect at the receiving end
At least one of the bits of the recovered plaintext will be incorrect
More than one bit of the recovered plaintext will be incorrect at the receivin
Given Fk is a secure PRF, define F′k(x)={Fk(x), if x is evenFk(x+1), if x is odd}.
Then which of the following is(are) true?
F′k is a secure SPRP
F′k is a secure PRP
F′k can be used to instantiate the CTR mode of block cipher
F′k cannot be used to instantiate the CBC mode of block cipher
Let F:{0,1}n×{0,1}n→{0,1}n be a secure PRF. Then which of the following constructions is/are not necessarily a secure PRF?
F′:{0,1}n×{0,1}2n→{0,1}2n, where F′k(x||y)=defFk(x)||Fk(y)
F′:{0,1}n×{0,1}2n→{0,1}n, where F′k(x||y)=defFk(x)∧Fk(y)
F′:{0,1}n×{0,1}n→{0,1}2n ,where F′k(x)=defFk(x)||Fk(x⊕1n)
All of the above
Which of the following is(are) incorrect?
If adversary can derive a related cipher-text as a function of an existing cipher-text, then the scheme is not CCA secure
3DES is widely recommended for use due to its high security to key-length ratio
In a CCA attack, the adversary can ask for decryptions of any ciphertext of its choice
Chosen ciphertext attack is significant only from a theoretical point of view since a decryption oracle in unrealistic in practice
Select the correct option(s) with respect to Message Authentication Code (MAC):
The tag verification algorithm can be randomized or deterministic.
Head of an organization sending a broadcast e-mail to employees is an example application that requires encryption and not authentication.
CBC MAC can be used to generate tag for variable length messages
Block-wise CBC MAC initialized with IV=1n, instead of IV being the number of message blocks is insecure
Consider a MAC construction for messages of length 2n using a secure PRF F . To authenticate a 2n –bit message m=m1||m2, where m1 and m2 each n –bit long, output a tag (Fk(m1), Fk(Fk(m2)))
where k is a n –bit truly random PRF key. Which of the following options is(are) incorrect for the given construction?
The construction is not CMA-secure
The construction is SCMA-secure
The construction is not SCMA-secure
The construction is CMA-secure
Let Π1=(TagGen1,TagVrfy1) and Π2=(TagGen2,TagVrfy2) be MAC systems, over the key space K={0,1}n, where the key-generation algorithm for both Π1 and Π2 outputs a random key from the key space. It is given that either Π1 or Π2 is a secure MAC, but which one is not known. Then which of the following is/are false?
To authenticate a message, sender can generate tag on the message using either Π1 or Π2
To authenticate a message, sender has to generate tag on the message using both Π1 and Π2
and receiver has to verify both the tags
To authenticate a message, sender has to generate tag on the message using both Π1and Π2 and receiver can accept the message by verifying any of the two tags
None of these
. Let Π= (Enc,Dec) be a symmetric-key cipher with key space K, where the key-generation algorithm outputs a random key from the key space. Then consider a MAC system Π′=(TagGen,TagVer) over K, where the key-generation algorithm outputs a random key from the key space: the tag-generation algorithm outputs TagGenk(m)=Enck(m) and TagVerk(m,σ) outputs 1, if and only if Deck(σ)=m holds. Identify the correct statement(s)
Π′ is always secure
Π′ is secure, provided Π is CPA-secure
Π′ is secure, provided Π is CCA-secure
Π′ is secure, provided Π has ciphertext integrity
1. Let H be a collision-resistant hash function and consider another hash function H′, where H′(x)=H(H(x))||0n
H′ is not collision-resistant
H′ may be collision-resistant
H′ is collision-resistant
If |x|=n, then |H′(x)|=2n.
Consider the following construction of two hash functions h and h′. On input sequence of bytes, X=(X1,....,Xn), the functions output h(X)=X1⊕X2....⊕Xn and h′(X)=X1¯¯¯¯¯¯⊕X2¯¯¯¯¯¯....⊕Xn¯¯¯¯¯¯¯, where Xi¯¯¯¯¯¯ is complement of Xi. Then:
Both the functions h and h′ are collision-resistant
Neither h nor h′ is collision-resistant
The function h is not collision-resistant, and the collision resistance of h′ depends upon the value of n
The collision-resistant of both h and h′ depends upon the value of n
Given H and G are collision resistant hash functions. Which of these functions is/are collision-resistant?
F1(x):=H(x)||1
F2(x):=H(x)||G(x)
F3(x):=H(x)||H(x)
All of the above
Which of the following statement(s) is/are incorrect?
Information theoretic MACs are secure against an adversary running for exponential time
Perfect unforgeability is exactly analogous to perfect secrecy
One-time IT-secure MAC is exactly analogous to one-time pad used in encryption
One construction of MAC is to first create a fixed length digest from an arbitrary length message upon which a MAC is computed
Let Π1=(TagGen1,TagVrfy1)
and Π2=(TagGen2,TagVrfy2) be MAC systems, over the key space K={0,1}n, where the key-generation algorithm for both Π1 and Π2 outputs a random key from the key space. It is given that either Π1 or Π2 is a secure MAC, but which one is not known. Then which of the following is/are true?
Π=(TagGen,TagVrfy)over key-space K={0,1}2n is a secure MAC, where TagGenk1||k2(m)=(TagGen1k1(m),TagGen2k2(m)) and TagVrfyk1||k2(m,σ1,σ2)=1,iffTagVrfy1k1(m,σ1)=1 AND TagVrfy2k2(m,σ2)=1
Π=(TagGen,TagVrfy) over key-space K={0,1}2n is a secure MAC, where TagGenk1||k2(m)=(TagGen1k1(m),TagGen2k2(m)) and TagVrfyk1||k2(m,σ1,σ2)=1, iff TagVrfy1k1(m,σ1)=1 OR TagVrfy2k2(m,σ2)=1
Neither the construction in part (a), nor the construction in part (b) is secure.
Nothing can be said regarding the construction in part (a) or part (b).
Let Π=(Gen, Enc, Dec) be a symmetric-key encryption scheme with message-space and ciphertext-space M and C={0,1}l
respectively. Then consider a variant Π′=(Gen, Enc′, Dec′) with message-space and ciphertext-space M and C′={0,1}(l+1) respectively, where Enc′k(m)=Enck(m)||0 and Dec′k(c)=Deck(c[0, …,l−1]). Here c∈{0,1}(l+1)
and c[0,…,l-1] denotes the first l bits of c .
Π' is not CCA-secure even if Π is CCA-secure
If Π is multi-message COA-secure, then Π' is multi-message COA-secure
If Π is CPA-secure, then Π' is CPA-secure
If Π is CCA-secure, then Π' is CCA-secure
Select the correct option(s) from the following:
A CCA secure scheme necessarily implies a secure authenticated encryption scheme
A secure authenticated encryption scheme is necessarily CCA secure
If an encryption scheme is CPA-secure, then it is also an authenticated encryption scheme
It is impossible for an adversary to forge a valid tag with a non-zero probability when a secure message authentication scheme is used
Select the correct option(s) from the following:
Binding property of hash-function based commitment schemes relies on the collision resistance property of the hash function
A Merkle tree to store 1024 unique elements will have a total of 211−1 nodes
Modifying a leaf node in a Merkle tree will result in O(k) changes to a tree of depth k
Receiver in hash-function based commitment schemes is allowed to make polynomial number of calls to the Random Oracle
Select the incorrect option(s):
Deterministic MAC cannot be used in the construction of secure authenticated encryption scheme
To break the security of a cryptographic construction which is provably-secure in the ROM model, one must discover a weakness in the actual hash function
There doesn’t exist any ROM based crypto primitive that is efficient and highly secure
In a secure authenticated encryption scheme, the decryption oracle does not provide any advantage to the adversary
Choose the correct combination for Commitment Schemes:
1. Honest receiver, corrupt sender
i. Binding Property
2. Receiver
ii. Provides opening information
3. Honest sender, corrupt receiver
iii. Accept or reject data
4. Sender
iv. Hiding property
1-i, 2-ii, 3-iv, 4-iii
1-iv, 2-iii, 3-i, 4-ii
1-i, 2-iii, 3-iv, 4-ii
1-iv, 2-ii, 3-i, 4-iii
Which of the following properties hold(s) for a cyclic group?
It satisfies closure axiom
It satisfies associativity
It satisfies distributive property
It consists of a special element called generator g, which can generate all elements of the group by different powers
Select the incorrect option(s):
The goal of the sender and receiver in the key-exchange problem is to agree upon a random common key, over a public channel
In the Padding Oracle attack, adversary can learn the length and value of the padding bytes only
The goal of the sender and receiver in the key-exchange problem is to agree upon a fixed common key, over a private channel
The authenticate-then-encrypt approach which is instantiated with a CPA-secure encryption scheme and an SCMA-secure MAC is COA-secure as well as CCA-secure
Select the correct option(s):
Padding Oracle attack is based on the error response sent by the receiver
One-way trapdoor functions have same security properties as one-way functions
Secret key is used as a trapdoor information to compute the inverse of a one-way trapdoor function
Choosing separate keys for encryption and authentication is not needed if the correct order of encryption and authentication is chosen to obtain a secure authenticated encryption scheme
Consider the composition of encryption schemes and tag generation schemes and select the incorrect option(s):
Encrypt-then-authenticate approach leads to an authenticated encryption scheme
Encrypt and authenticate composition may not always lead to an authenticated encryption scheme
Authenticate-then-encrypt always leads to an authenticated encryption scheme
Encrypt-then-authenticate approach does not lead to an authenticated encryption scheme
Select the correct option(s):
A cyclic group has exactly one generator
Group (Z5,+5) has 4 generators
The order of the group (Zp∗,.p) where p is prime, is a prime number.
4651mod 55 = 45
Select the correct option(s):
DDH assumption is stronger than CDH assumption
DLog is difficult to solve for every multiplicative cyclic group
Given a cyclic group (G,o), if it is computationally easy to solve the DLog problem then it implies that only one of either CDH or DDH problems are easily solvable
If DDH assumption holds in (G,o), then both CDH and DLog assumption hold
Let G be a prime order cyclic group of order q with a generator g . Let H:G⇒K be a hash function modelled as a random oracle. Which of the following assumption(s) is/are correct for (G,H) if the probability distribution (gα, gβ, H(gαβ))
is computationally indistinguishable from the distribution (gα, gβ, r), where α,β are randomly selected from Zq
and r is randomly selected from K .
DDH
DLog
CDH
All of the above
Which of the following statement(s) is/are incorrect?
The number of points that lie on the elliptic curve y2=x3+2x+3(mod 5)
is more than that for the curve y2=x3+2x+3(mod 7)
In a prime order group, every element of the group is a generator
Given a point P on an elliptic curve, and the O point at infinity, P+O=P
If P=(x,y) is a point on an elliptic curve, then 2P=(2x,2y)
We want to build a PRG f:Z2q⇒G3
, where G is a prime order cyclic group of order q with a generator g, where DLog, CDH and DDH assumption holds. Let f(α,β)≝(gα,gβ,x)
. For what value(s) of x, the function f is a secure PRG?
gαβ
gα+β
gα−β
gβ
We want to construct a collision-resistant hash function over a cyclic group based on the hardness of Discrete-logarithm and related problems. For this, consider a prime order cyclic group G of order q with a generator g. Then consider the function f:Znq⇒G
, where f(α1,…,αn)≝gα1.α2.⋯.αn. Here (α1,…,αn)∈Znq
. Select the incorrect statement(s):
Function f is collision-resistant, provided CDH assumption holds in G
Function f is collision-resistant, provided DDH assumption holds in G
Function f is collision-resistant, provided DLog assumption holds in G
All of the above
Let c=(c1,c2)
be a ciphertext, produced by an instance of El Gamal encryptionscheme, for some unknown plaintext m and let a PPT adversary possess (c1,c2), but not m. The adversary also have access to the public information like public key, groupdescription, etc. Moreover, let m′
be a plaintext available with the adversary. Then:
It is possible for the adversary to compute an El Gamal ciphertext of m.m′
from c
It is not possible for the adversary to compute an El Gamal ciphertext of m.m′
from c
Computing an El Gamal ciphertext of m.m′
from c is equivalent to breaking the CPA-security of the El Gamal encryption scheme
None of the above
Consider the following security experiment against the text-book RSA signature:the PPT adversary is given the public verification-key vk
and a random message m. (from the message space) by the verifier.The challenge for the adversary is to then come up with a valid signature on m
, without getting the signing-oracle access at all. Then
The adversary can win in the security experiment with probability 1
If the RSA assumption holds, then the adversary can win the experiment only with a negligible probability
The adversary can never win the experiment
Even if the RSA assumption holds, the adversary can win the experiment with a non-negligible probability
Which of the following is/are false for the El Gamal encryption scheme?
If DDH assumption holds then it is CPA-secure
If CDH assumption holds then it is CPA-secure
If DDH assumption holds then it is CCA-secure
It is not CCA-secure, since it is malleable
Consider the following modification to the Diffie-Hellman key-exchange protocol,executed over a cyclic group of order q
with generator g: the sender and receiver sends Ks=gx and Kr=gy to each other, where x,y are randomly selected from Zq and outputs Ks.Kr
as the final key. Assume DLog, CDH, DDH and all other related assumptions are true in the underlying group and this modified protocol is executed in the presence of a semi-honest PPT adversary. Then
From the view point of the adversary, the output key will be pseudorandom
From the view point of the adversary, the output key is uniformly random and unknown
The adversary will know some part of the output key
The adversary will completely know the underlying output key
We want to construct a collision-resistant hash function over a cyclic group based on the hardness of Discrete-logarithm and related problems. For this, consider a primeorder cyclic group G
of order q with a generator g. Then consider the function f:Znq→G, where f(α1,…,αn)=defgα1⋅α2⋅…⋅αn. Here, (α1,…,αn)∈Znq
Function f
is collision-resistant, provided DLog assumption holds in G
Function f
is collision-resistant, provided DDH assumption holds in G
Function f
is collision-resistant, provided CDH assumption holds in G
Function f
is not collision-resistant
Select the incorrect option(s):Select the incorrect option(s):
A digital signature scheme consists of four algorithms
The verification key of a digital signature scheme is publicly available, but the signing key is secret
The verification key of a digital signature scheme is held secret, but the signing key is made public
A randomized signing algorithm will result in success during verification process
Let H:Z∗N⇒Z∗N
be a hash function modeled as a random oracle. Consider the following RSA based signature scheme: KeyGen: Output Signing key = (sk,N) and verification key = (vk,N) as per the RSA KeyGen Sign(sk, m): output σ:=(H(M))skmodN. Verify(vk, m, σ): output ‘yes’ if H(m)=(σ)vkmodN
and ‘no’ otherwise. Then which of the following hold(s) for the signature scheme?
Even if the RSA assumption holds, the adversary can win the signature-forgery experiment with a non-negligible probability
If the RSA assumption holds, then the adversary can win the signature-forgery experiment only with a negligible probability
The adversary can win in the signature-forgery experiment with probability 1
The adversary cannot win in the signature-forgery experiment
Alice submits a bid to an auction, and so that other bidders cannot see her bid, she encrypts it under the public key of the auction service. Suppose that the auction service provides a public key for an RSA encryption scheme, with a modulus N (where 2 and 5 are not the factors of N) and a public exponent e. Assume that bids are encoded simply as integers between 0 and N – 1 prior to encryption. Also, assume that Alice submits a bid which is a “round number”, which in this case means that her bid is a number that is divisible by 10. And say her encrypted bid is X (for simplicity, assume we are using plain deterministic RSA). An adversary Chris on seeing X wants to submit an encryption of a bid that exceeds Alice’s bid by 10%, without even knowing what Alice’s bid is. Then the ciphertext submitted by Chris is:
10e⋅X
11e⋅X
110e⋅X
None of the given options
Which of the following does not hold for Schnorr Identification scheme?
It is not based on the discrete log assumption
The exchange between prover and verifier happens in zero-knowledge fashion which means that neither party knows about the computation power of each other
The verifier can only know if the prover knows about the secret key without knowing anything more about the key
A dishonest prover can convince a verifier only with a negligible probability
Consider the following security experiment against the text-book RSA signature: the PPT adversary is given the public verification key vk and a message m (from the message space) by the verifier. The challenge for the adversary is to then come up with a valid signature on m, without getting the signing-oracle access at all. Then
If the RSA assumption holds, then the adversary can win the experiment only with a negligible probability
Even if the RSA assumption holds, the adversary can win the experiment with a non-negligible probability
The probability of the adversary winning the experiment cannot be related to the hardness of the RSA problem
The adversary can win the experiment with a non-negligible probability even if the RSA assumption does not hold.
Multiplicative inverse of 129 modulo 1677
1233
1471
13
Does not exist
None of the given options
Identify the correctstatement(s) for Shamir secret sharing scheme:
The correctness holds if computations are performed over a ring
The correctness holds if computations are performed over the integers
The correctness holds if computations are performed over a field
The privacy holds even if the secret is set to be any coefficient of the sharingpolynomial, other the constant term
In the Schnorr identification scheme:
Prover reveals the value of the Discrete logarithm of a publicly known value
Prover proves that it knows the Discrete logarithm of a public known random value
Prover computes the Discrete logarithm of a publicly known value
None of the above
Which of the following is/are false about Zero knowledge proofs?
The verifier can always learn something about the secret information that the prover possesses at the end of the proo
Completeness and Soundness are not the only properties that must be satisfied by a Zero-knowledge proof system
All Zero-knowledge proof systems uses asymmetric-key primitives
All the given options
Choose the correct option(s) from the following:
A secure secret-sharing scheme cannot be deterministic
Shamir’s secret-sharing uses public-key operations
Shamir’s secret sharing uses polynomial interpolation to reconstruct the secret
The message space for Shamir’s secret sharing is compulsorily a group
