### Assignments

Deadline: September 16, 2019, on paper into the boxes left of office C210 in the CS building (before 12:00) or before the lecture in the JETI lecture hall in Otakaari 5. Solving 1 exercise problem mostly correctly gives 2 points. A reasoneable attempt at 1 exercise problem gives 1 point. You can solve as many problems as you want and obtain feedback for them. You cannot get more than 4 points on this exercise sheet. There is a lot of choice, and grading is generous, so try to choose problems that challenge you.

Deadline: September 23, 2019, on paper into the boxes left of oﬃce C210 in the CS building (before 12:00) or before the lecture in the JETI lecture hall in Otakaari 5. Solving 1 exercise problem mostly correctly gives 2 points. A reasonable attempt at 1 exercise problem gives 1 point.

You can solve as many problems as you want and obtain feedback for them. You cannot get more than 4 points on this exercise sheet. There is a lot of choice, and grading is generous, so try to choose problems that challenge you.**Please put your name and the time/name of your group/teaching assistants onto your solutions.**Concerning

**Problem 4**, please consult slide 28 of Lecture 2 which was skipped at the lecture due to lack of time.Deadline: September 30, 2019, on paper into the boxes left of oﬃce C210 in the CS building (before 12:00) or before the lecture in the JETI lecture hall in Otakaari 5. Solving 1 exercise problem mostly correctly gives 2 points. A reasonable attempt at 1 exercise problem gives 1 point.

You can solve as many problems as you want and obtain feedback for them. You cannot get more than 4 points on this exercise sheet. There is a lot of choice, and grading is generous, so try to choose problems that challenge you.**Please put your name and the time/name of your group/teaching assistants onto your solutions.**Deadline: October 7, 2019, on paper into the boxes left of oﬃce C210 in the CS building (before 12:00) or before the lecture in the JETI lecture hall in Otakaari 5. Solving 1 exercise problem mostly correctly gives 2 points. A reasonable attempt at 1 exercise problem gives 1 point.

You can solve as many problems as you want and obtain feedback for them. You cannot get more than 4 points on this exercise sheet. There is a lot of choice, and grading is generous, so try to choose problems that challenge you.**Please put your name and the time/name of your group/teaching assistants onto your solutions.**Deadline: October 14, 2019, on paper into the boxes left of oﬃce C210 in the CS building (before 12:00) or before the lecture in the JETI lecture hall in Otakaari 5. Solving 1 exercise problem mostly correctly gives 2 points. A reasonable attempt at 1 exercise problem gives 1 point.

You can solve as many problems as you want and obtain feedback for them. You cannot get more than 4 points on this exercise sheet. There is a lot of choice, and grading is generous, so try to choose problems that challenge you.**Please put your name and the time/name of your group/teaching assistants onto your solutions.**Deadline: November 4, 2019, on paper into the boxes left of oﬃce C210 in the CS building (before 12:00) or before the lecture in the JETI lecture hall in Otakaari 5. Solving 1 exercise problem mostly correctly gives 2 points. A reasonable attempt at 1 exercise problem gives 1 point.

You can solve as many problems as you want and obtain feedback for them. You cannot get more than 4 points on this exercise sheet. There is a lot of choice, grading is generous, and the main purpose is to obtain feedback on your ideas. We encourage you to choose problems that challenge you.**Please put your name and the time/name of your group/teaching assistants onto your solutions. Please refer to the Definitions and Foundations (DAF) document and the lecture notes provided in the material section.**Oct 29 (Update): Formulated Exercise 3 in a clearer way.

Oct 30, 2019, 09:05: corrected typo: In the previous version, the checks in the SET oracle wrongly checked wheter k \neq \bot. However, they need to check that k=\bot, meaning that the key has not been assigned yet

Oct 31, 2019, 11:19: corrected typos, "at least on" --> "at least one"; Exercise 3c "not picked at random" --> "not picked by the adversary"

This exercise is aimed to support understanding of security notions and unforgeability of message authentication codes, in particular.

Deadline: November 4, 2019, on paper into the boxes left of oﬃce C210 in the CS building (before 12:00) or before the lecture in the JETI lecture hall in Otakaari 5. Solving 1 exercise problem mostly correctly gives 2 points. A reasonable attempt at 1 exercise problem gives 1 point.

You can solve as many problems as you want and obtain feedback for them. You cannot get more than 4 points on this exercise sheet. There is a lot of choice, grading is generous, and the main purpose is to obtain feedback on your ideas. We encourage you to choose problems that challenge you.

**Please put your name and the time/name of your group/teaching assistants onto your solutions. Please refer to the Definitions and Foundations (DAF) document and the lecture notes provided in the material section.**Update 7.11.2019 14:17: in ex1: there were a few dangling square brackets that are now removed, the verification algorithms (m_i.ver) did not take tau as input even though they should, m_2.ver algorithm had the tau and (y_0, …, y_..) swapped on line 4. In ex 3, UNF_CMA_A had the second package named KEY_B while it should be KEY_A.

This exercise sheet is aimed at understanding security notions for symmetric encryption as well as at getting used to the notion of a reduction and inlining proofs.

Submission deadline: Monday, November 18, at 12:00 in the letterboxes left of office C210 or before the lecture in the JETI lecture hall. Please put your own name and the name of your exercise group/teaching assistant(s) on your homework submission.

Nov 12, 02:24: Exercise Sheet Published

Nov 14, 04:50: Added clarification below Exercise 1 that you do not need to add a proof that the probability is small that we get twice the same ciphertext c_0 and c_1 when we run se.enc(k,m) twice, with independent randomness. This property follows from IND-CPA security/AE-security.

This exercise is aimed at understanding the differences between confidentiality on the one hand and authentication/integrity on the other hand, and, in particular, how the two of them interfere. Additionally, the exercise sheet is aimed at reflecting on the methodology we have been using, the way we have been specifying games, used pseudo-code etc.

Submission deadline: Nov 25, 12:00 in the letterboxes on the left of C210 in the CS building, or in JETI lecture hall before the lecture.

Nov 20, 2019, 13:12: Two corrections: In se_1, before, it said c \gets c||0, but it should actually be c \gets c’||0 (corrected now). In se_{mte}.enc, it said se.enc(k,(m',tau)), but is should just be se.enc(k,m') (corrected now).

Nov 21, 2019, 12:27: We only consider deterministic MACs in this course. Accidentally, MAC generation was indicated as randomized in some places on the exercise sheet, corrected it.

Submission by Dec 2, 2019, 12:00, in the letterboxes left of office C210 in the CS building or in the JETI lecture hall. Each exercise yields up to 3 points: 3 points for a mostly complete and mostly correct solution, 2 points for a solution containing useful reflections, and 1 point for a reasoneably good attempt. The maximal number of points obtained from this exercise sheet is 6.

Update (Nov 26, 18:50): The GETSK oracle was accidentally called GETPK, corrected the typo

Update (Nov 27, 01:42): Clarified wording, added further hints.

Update (Nov 28, 16:28): fix a typo: DEC-C^1 was missing the line 'sk <- GETSK' on page 3.