problem1. Which of the following statements is true for a trapdoor function f?

a. The function f can be computed efficiently, no algorithm can invert it unless with negligible probability or unless the algorithm is given a trapdoor

 b. The function f cannot be computed efficiently but there exists an algorithm that computes it efficiently using a trapdoor

 c. The function f cannot be computed efficiently but there exists a polynomial-time algorithm that can invert f's output on a random input unless with negligible probability;  moreover, there exists an algorithm that, given a trapdoor, can compute f

 d. The function f can be computed efficiently but no polynomial-time algorithm can invert f's output on a random input unless with negligible probability; moreover, there exists an algorithm that, given a trapdoor, can compute f's inverse function

problem2. Which of the following statements summarizes the properties of a hard-core predicate P for a one-way function f?

 a. P is hard to compute given the input of f but easy to compute using the output of f

 b. P is easy to compute given the input of f but hard to compute using the output of f

 c. P is hard to compute given the input of f and hard to compute using the output of f

 d. none of the above

problem3. For a still merely intuitive notion of "secure" (e.g., it is hard to guess info about the plaintext from the ciphertext), which cryptographic primitives are sufficient to construct a "secure" public-key cryptosystem?

 a. a one-way function f and a hard-core predicate P for f

 b. a one-way trapdoor function f and a hard-core predicate P for f

 c. a one-way trapdoor permutation f

 d. a hard-core predicate P for f

problem4.  Consider algorithms B.10, B.11, B.12, and B.13 in the [KL] textbook. Which one(s) among these does not run in polynomial time in its input length?

 a. B.10 and B.11

 b. B.10 and B.12

 c. B.11 and B.13

 d. B.12

problem5. Factoring is the problem of computing, on input a positive integer n, a factorization of n in terms of prime powers. This problem can be "easy (i.e., there exists a polynomial-time algorithm that solves it) or "(conjectured to be) hard" (i.e., there seems to be no polynomial-time algorithm that solves it) depending on the (sub)set of integers from which n is chosen. In which of these cases factoring n is easy?

 a. n is a power of 2

 b. n is a prime

 c. n is a prime power (see exercise 7.11 in [KL])

 d. All of the above

problem6. Factoring is the problem of computing, on input a positive integer n, a factorization of n in terms of integer powers of prime numbers. This problem can be "easy” (i.e., there exists a polynomial-time algorithm that solves it) or "(conjectured to be) hard” (i.e., there seems to be no polynomial-time algorithm that solves it) depending on the (sub)set of integers from which n is chosen. De?ne the trial division algorithm D to solve the factoring problem and study its running time t_D(n). Given this algorithm and its running time, we want to infer considerations on factoring n being easy or conjectured to be hard when n is chosen among products of two primes (i.e., n = pq for some primes p, q). Let m_easy(n) be a value for min(p, q) such that factoring n is easy and m_hard(n) be a value for min(p, q) such that factoring n may be conjectured to be hard. Which functions would you select as most meaningful for t_D(n), m_easy(n), m_hard(n)?

 a. t_D(n)=O(n2); m_easy(n)=O(log n); m_hard(n)=O(square root of n);

 b. t_D(n)=O(square root of n); m_easy(n)=O(square root of n); m_hard(n)=O(n);

 c. t_D(n)=O(square root of n); m_easy(n)=O(polylog n); m_hard(n)=O(n);

 d. t_D(n)=O(square root of n); m_easy(n)=O(polylog n); m_hard(n)=O(square root of n);

problem7. Computing discrete logarithms is the problem that takes as input the description of a cyclic group (G;*), the group's order m, the group's generator g, an element y in G, and asks to compute an integer x in Zm such that g *...*g = y, where there are x-1 occurrences of *. This problem can be "easy" (i.e., there exists a polynomial-time algorithm that solves it) or "(conjectured to be) hard" (i.e., there seems to be no polynomial-time algorithm that solves it) depending on the group G considered. In which of these cases computing discrete logarithms is easy?

 a. G is Zm, * is addition mod m

 b. G is Zm, * is multiplication mod m

 c. G is Zm, * is division mod m

 d. All of the above

problem8. Consider the problem of computing discrete logarithms in a cyclic group (G,?), with group’s order m; that is, given the group’sgenerator g, an element y ∈ G, compute an integer x ∈ Zm such that g ? • • • ? g = y, where there are x − 1 occurrences of ?. Then consider the exhaustive search algorithm to search for the discrete logarithm of y in base g for a cyclic group G of order m. Given this algorithm and its running time t(m,n), we want to infer considerations on computing discrete logarithm in G being easy or conjectured to be hard depending on the choices of m as a function of the length n of the group elements. Let m_easy(n) be a value for m such that computing discrete logarithms in G is easy and m_hard(n) be a value for m such that computing discrete logarithms in G may be conjectured to be hard. Which functions would you select as most meaningful for m_easy(n), m_hard(n)?

 a. m_easy(n)=O(n); m_hard(n)=omega(n)

 b. m_easy(n)=O(poly(n)); m_hard(n)=O(poly(n))

 c. m_easy(n)=O(poly(n)); m_hard(n)=omega(poly(n))

 d. m_easy(n)=O(n); m_hard(n)=O(n)

problem9.  Consider the following functions.

1) g1:{0,1}n-->{0,1}n, defined as g1(x)=x xor p, for each x in {0,1}n and for some known value p in {0,1}n

2) g2:{0,1}n-->{0,1}n, defined as a monotone function over the set {0,1}n

3) g3:{0,1}2n-->{0,1}n, defined as g3(x1,x2)=x1 xor x2 for each (x1,x2) in {0,1}2n

Which of the following is true?

a. g1 is one-way, g2 and g3 are not one-way

 b. g2 is one-way, g1 and g3 are not one-way

 c. g3 is one-way, g1 and g2 are not one-way

 d. none of them is one-way

problem10. Let f be a one-way function. Consider the following functions.

1) g1(x1,x2)=(f(x1),x2) for each (x1,x2) in its domain

2) g2(x)=(f(x),f(f(x))) for each x in its domain

3) g3(x1,x2)=(f(x1),x1 xor x2) for each (x1,x2) in its domain

Which of the following is true?

 a. If f is one-way then g1 is one-way, g2 and g3 are not one-way

 b. If f is one-way then g2 is one-way, g1 and g3 are not one-way

 c. If f is one-way then g1 and g2 are one-way, g3 is not one-way

d. If f is one-way then g1, g2 and g3 are one-way

problem 11 You have to choose the length of the modulus n for the RSA trapdoor permutation in use within your public-key cryptosystem. The attacker has one of the following resources: (a) a single computer, (b) a collection of computers distributed across the Internet, or (c) a quantum computer.

Which of the following lengths for n would you choose?

 a. (a): 1024; (b): 2048; (c): 4096

 b. (a): 1024; (b): 2048; (c): I would not use RSA

 c. (a): 2048; (b): 1024; (c): I would not use RSA

 d. (a): 512; (b): 1024; (c): 2048

problem12. Which of these assumptions is sufficient to construct a one-way function?

 a. The hardness of factoring integers that are product of two primes of the same length

 b. The hardness of computing discrete logarithms modulo primes

 c. The hardness of inverting the RSA function

 d. Any of the above

problem13. Which of these assumptions is known to be sufficient to construct a one-way permutation?

 a. The hardness of factoring integers that are product of two primes of the same length

 b. The hardness of computing discrete logarithms modulo primes

 c. The hardness of inverting the RSA function

 d. The hardness of computing discrete logarithms modulo primes or inverting the RSA function

problem14. Which of these assumptions is known to be sufficient to construct a trapdoor permutation?

 a. The hardness of factoring integers that are product of two primes of the same length

 b. The hardness of computing discrete logarithms modulo primes

 c. The hardness of inverting the RSA function

 d. All of the above

problem15. Which of these assumptions is sufficient to construct a hard-core predicate?

 a. The hardness of factoring integers that are product of two primes of the same length

 b. The hardness of computing discrete logarithms modulo primes

 c. The hardness of inverting the RSA function

 d. Any of the above