CS 120/CSCI E-177: Introduction to Cryptography
Problem Set 2
Assigned: Oct. 5, 2006 Due: Oct. 11, 2006 (1:10 PM)
Justify all of your answers. See the syllabus for collaboration and lateness policies. You can submit
by email to ciocan@eecs (please include source files) or by hardcopy to Carol Harlow in MD 343.
Problem 1. (Factorization is “NP-easy”)
1. Let L={(x, y)∈N×N:xhas a factor between 2 and y}. Show that the language Lis in
NP.
2. Show that if Lis in P, then there is a polynomial-time algorithm for integer factorization.
Thus, if P=NP, then factorization is easy.
Problem 2. (Reducing the error of randomized algorithms) Suppose we have randomized
algorithm for computing a function fwhich gives an incorrect answer with probability ≤1/3, and
we want to reduce its error by repeating it several times and taking a majority vote. Use the
Chernoff Bound to estimate how many repetitions suffice to reduce the error probability to 1/1000.
And to 2−k?
Problem 3. (Statistical Security) Recall that (G, E, D) has statistically ε-indistinguishable
encryptions if for every two m1,m2∈ P and every T⊆ C,
|Pr [EK(m1)∈T]−Pr [EK(m2)∈T]| ≤ ε,
where the probabilities are taken over KR
←Gand the coin tosses of E.
1. Show that statistical 0-indistinguishability is equivalent to perfect indistinguishability.
For the remaining parts, suppose (G, E, D) has statistically ε-indistinguishable encryptions for
message space P. Below you will prove that the number of keys must be at least (1 −ε)· |P|, so
statistical security doesn’t help much to overcome the limitations of perfect secrecy.
2. Call a ciphertext cdecryptable to m∈ P if there is a key ksuch that Dk(c) = m. Prove that
for every two messages m,m0∈ P ,
Pr [EK(m) is decryptable to m0]≥1−ε,
where the probability is taken over KR
←Gand the coin tosses of E.
1
