CS 6260: Applied Cryptography November 12, 2007
Homework 6
Lecturer: Sasha Boldyreva Due: November 20, 2008
Problem 5.1, 5 points.
In RSA-OAEP encryption assume that the output of the keyless transform is a ran-
dom string in ZN, where Nis the RSA modulus. Make an estimate on the probability
that this string is not in Z∗
Nas the function of k, the length of N.
Problem 5.2, 20 points.
Let Gbe a cyclic group with a generator gsuch that the DDH problem is hard for
G, g. Prove that for the associated ElGamal encryption scheme is IND-CPA secure
against adversaries that make only one query to the LR encryption oracle. (The
standard IND-CPA security will follow from the theorem we proved in class.)
Problem 5.3, 20 points.
Assume there exists a polynomial-time algorithm Athat given an RSA public key
(N, e) can invert 1% of all ciphertexts C∈Z∗
N. That is, given (N, e) and C=
Memod Nit can efficiently compute Mif Chappens to be in a “weak” 1% fraction
of all ciphertexts.
Show that then there exists an algorithm that given (N, e) inverts every ciphertext
C∈Z∗
Nwith probability more than 1/2, and is usually efficient (runs in expected
polynomial time).
Hint. Use the multiplicative property of RSA: for every public key (N, e) and
M1, M2∈Z∗
N,Me
1·Me
2= (M1·M2)e(mod N).