If the Plaintext Is Thrill, What Is the Key? If the Plaintext Is Tiller, What Is the Key?

HW1

(due Sep. 26)

1. Using the letter encodings in the Table of the lecture notes, the following ciphertext message was encrypted with a one-time pad

KITLKE.

If the plaintext is “thrill,”what is the key? if the plaintext is “tiller,”what is the key?

2. Suppose that you have a message consisting of 1024 bits. Design a method that will extend a key that is 64 bits long into a string of 1024bits. Then this 1024 bits will be XORed with the message, just like a one-time pad. Is the resulting cipher as secure as a one-time pad? Is it possible for any such cipher to be as secure as a one-time pad?

3. The formula for counter mode encryption is

Ci = Pi⊙E(IV+i, K)

Suppose instead we use the formula

Ci = Pi⊙E(K, IV+i)

Is this secure? If so, why? If not, describe an attack.

4. Consider a Feistel cipher with four rounds and P = (L0, R0). What is the ciphertext C if the round function is

a. F(Ri-1,Ki) = Kj

b. F(Ri-1,Ki) = Ri-1⊙Kj

5. Alice has four blocks of plaintext, P0, P1, P2, P3, which she encrypts using CBC mode to obtain C0, C1, C2, C3. She then sends the IV and ciphertext to Bob. Upon receiving the ciphertext, Bob plans to verify the integrity as follows. He’ll first decrypt to obtain the putative plaintext, and then he’ll re-encrypt this plaintext using CBC mode and the received IV. If he obtains the same C3 as the final ciphertext block, he will trust the integrity of the plaintext.

a. Suppose that Trudy changes C1 to a random value X (leaving all other blocks and the IV unchanged). Will Bob detect that the data lacks integrity?

b. Suppose that Trudy changes C3 to a random value Y (leaving all other blocks and the IV unchanged). Will Bob detect that the data lacks integrity?

6. Suppose Alice has four blocks of plaintexts, P0, P1, P2, P3 and she computes a MAC using key K1, and then CBC encrypts the data using key K2 to obtain C0, C1, C2, C3. Alice sends the IV, the ciphertext, and the MAC to Bob. However, Trudy intercepts the message and replaces C1 with X, so that Bob receives the IV, C0, X, C2, C3, and the MAC. Bob attempts to verify the integrity of the data by decrypting (using key K2) and the computing MAC (using a key K1) on the putative plaintext.

a. Show that Bob will detect Trudy’s tampering.

b. Suppose that Alice and Bob only share a single symmetric key K. They agree to let K1=K and K2=K⊙Y, where Y is known to Alice, Bob, and Trudy. Does this create any security problem?