Problems for week 5-6, Cryptography

A wants to send message m to B and therefore sends B a message containing the
names of the two parties and the message encrypted for B. B acknowledges the
message by first decrypting the last part to recover m and then sending back a
similarly structured message to A, but with the roles of the two parties interchanged.
A can now decrypt the last part, check that she gets m and conclude that B has
indeed received m.
(a) This protocol is not secure against adversaries within the organization. More
precisely, consider an adversary who himself has a key pair and can send messages
and get them acknowledged. Show that if he, by eavesdropping, gets
access to the two messages sent in a protocol run between A and B, he can go
on to recover m.
(b) Both messages in the protocol have the structure S, R, E eR (m), where S denotes
Sender and R denotes Receiver of the message. It is proposed to modify the
message structure to S, R, E eR (m||X) for some suitable X. For each of the
following three proposals for X, explain why or why not it prevents the attack
from (a).
i. X = S.
ii. X = R.
iii. X = message number within the run, i.e. X = 1 for the first message and
X = 2 for the second.
7. We consider here the Blum-Goldwasser public-key stream cipher. A simplified version
of this scheme goes as follows.
Alice chooses p, q to be primes both congruent to 3 modulo 4 and N = p · q. N is
her public key; p and q are private.
To encrypt message m of length n bits for Alice, Bob first generates a bitstream as
follows. He chooses a random seed s and computes
x 0 = s
x n+1 = x 2 n mod N.
The bitstream is b 2 b 3 . . . b n+1 where b k is the least significant bit of x k . Then Bob
encrypts m by bitwise xor c = m ⊕ b 2 b 2 . . . b n+1 . Note that the least significant bit
of the two first x i are not used. Finally, he sends to Alice the pair (x n , c). The first
component differs from the secret-key stream ciphers as discussed in lecture 11; the
point is that s is not a shared secret between Alice and Bob. Instead, Alice (and only
Alice) can use x n to recover x 2 , which is what she needs to recreate the bitstream.
Let us show this:
(a) Assume Alice receives (x, c). As a first step, she computes d such that d ·
2 n mod Φ(N) = 4, where n is the length of c. Show that she can do this. (Note
also that if message lengths are known she can precompute d and store it as
part of her private key.)
(b) Show that x d = x 2 .
(c) How does Alice decrypt the message?
(d) Why cannot the Adversary decrypt the message?
8. (Requires material from lecture 12). The bitstream generator in the previous exercise
is called the Blum-Blum-Shub generator and is very well-known. It has been
proved to be cryptographically secure. What is its advantage over the RSA bitstream
generator?
2