Let F {0,1} x {0,1} {0,1} be a length-preserving pseudorandom function and a {0,1}...

Transcribed Image Text:

Let F {0,1} x {0,1}" → {0,1}" be a length-preserving pseudorandom function and a € {0,1}" be a fixed n-bit string known to both Alice and Bob. They construct a private-key encryption scheme II as follows. Gen: On input 1", output a uniformly chosen key k of length n, i.e., output k ← {0,1}". Enc: To encrypt a given message m = {0,1}", Alice computes F (a) and outputs the ciphertext as c = m F₁(a). (a) Show Bob how to decrypt in the scheme II. (b) Does the scheme II have indistinguishable encryptions in the presence of an eavesdropper? Prove your answer. (c) Is the scheme II CPA-secure? Prove your answer. Let F {0,1} x {0,1}" → {0,1}" be a length-preserving pseudorandom function and a € {0,1}" be a fixed n-bit string known to both Alice and Bob. They construct a private-key encryption scheme II as follows. Gen: On input 1", output a uniformly chosen key k of length n, i.e., output k ← {0,1}". Enc: To encrypt a given message m = {0,1}", Alice computes F (a) and outputs the ciphertext as c = m F₁(a). (a) Show Bob how to decrypt in the scheme II. (b) Does the scheme II have indistinguishable encryptions in the presence of an eavesdropper? Prove your answer. (c) Is the scheme II CPA-secure? Prove your answer.

Answer rating: 100% (QA)

a To decrypt the ciphertext c Bob computes F a and then computes m as m c Fk a1 where Fk a1 denotes the inverse of Fk a under the binary XOR operation ie applying Fk a1 again to the result should give ... View the full answer