Consider the following encryption scheme. It supports plaintexts from M $=\{0,1\}^$ and ciphertexts from C $=\{0,1\}2^.$ Its keyspace is:

K $=$ : in $\{0,1,\_\}2^|$ k contains exactly $\backslash$lambda $"-"$ characters k $2\backslash$lambda

To encrypt plaintext m under key k$,$ we "fill in$"$ the characters in k using the bits of m$.$

$43$

$2021$

CHAPTER $2.$ THE BASICS OF PROVABLE SECURITY

Show that the scheme does not have one$-$time secrecy$,$ by constructing a program that distinguishes the two relevant libraries from the one$-$time secrecy definition.

Example: Below is an example encryption of m $=1101100001.$

k$1\_0\_\_11010\_1\_0\_0\_$ m$=1101$ Enc$($k$,$ m$)=11100111010110000001$