Problem 1. What is a secure pseudo-random-function (PRF)? Problem 2. Mention two of what you find to be the more important differences between AES and DES. Problem 3. Given a secure PRF F over X = X = ) = {0, 1}" show the following results: - That F1(k, x) = F(k, x) || 0 is insecure. That F2(k, x) = F(k, x) Ox is a secure PRF. - That F3((k1, k2), x) = F(ki, x) OF(k2, x) is a secure PRF. - That FA(k, x) = F(k, x) || F(k, F(k, x)) is insecure. remember the general approach to proving such results is 1) reduction: if Fi is truly secure, show that if it were not, you could break the security of F, 2) if Fi is truly not secure, develop a distinguisher that breaks it. You can provide high-level proofs rather than detailed ones. Problem 4. (Adaptive versus non-adaptive PRF adversaries). A non-adaptive PRF adversary unlike an adaptive adversary is only allowed to query F(k, x) in one-run in the process of trying to distinguish it from a truly random function. i.e. he cannot observe the output of F(k, x1 ) and use that information in coming up with 72 where 2 is going to be the next query to F. Develop a PRF F that is secure against non-adaptive attackers but breaks as soon as the attacker can make adaptive queries. Problem 5. Describe what a meet-in-the-middle (MITM) attack is. What is the time and space complexity of a MITM attack against a 3E block cipher (back-to-back repitition of a single block cipher E by three times: 3E(k3e, m) = E(ki, E(k2, E(k3, m))) ) Problem 6. What is a collision-resistant hash function? Describe the properties: collision-resistance, second pre-image resistance, and one-wayness? Problem 7. Name and describe three different cryptanalysis techniques against block-ciphers. Problem 8. (Output feedback mode (OFB)). Research how output-feedback-mode works and describe it concisely here. How would you go about proving that OFB is CPA-secure? Problem 9. (Bad Davies-Mayer Construction). Show that the compression function h(x, y) = E(y, x) ey is not collision-resistant by coming up with (x, y) = (x, y') for which h(x, y) = h(x, y'). Do the same for h(x, y) = E(x, y Ox) Ox. (Hint: Try passing the same value to the key and input of E and use this as a query) Problem 10. How are user passwords typically converted to keys and stored on physical storage on commercial PCs