Moed_B_2008

Moed_A_2010

Moed_B_2010

Questions you should skip:

2010.A: 1

2010.B: 3

2008.A: 2

2008.B: 3

In 2007.A.4: add the assumption p-1,q-1 don't divide each other. (At some point we said the latter is not needed, but it is. You can find the full solution here.)

As already said, in previous years, the course might have focused on different subjects and thus also the exams.

]]>I intend to solve these questions (or at least some of them) in the recitation on Thursday 16 Jan. You can find the solution here.

]]>I'm afraid I woke up sick and without a voice, so recitation today is cancelled. The material for today was supposed to be outside the scope of the course and the exam.

Sorry for the short notice

Nir

p.s.: I was planning to tell you about program obfuscation. If enough of you are interested I'll be happy to arrange a meeting at a different time.

]]>Hence, we replaced the two of the items with easier items of the same weight. We made the previous ones a bonus, and augmented the guidance. Those of you who already solved the tricky ones (now the bonus ones), don't need to redo the easier ones, you will get both the basic and the bonus credit. Thanks to Naor for pointing out the problem in the original guidance! ]]>

You should show that $A'$ breaks $(\epsilon/(t+1),1)$-unforgeability, and not $(\epsilon/t,1)$. ]]>

1. In question 1, $m\in \{0,1\}^*$.

2. In question 2, you should show that the scheme is $2\varepsilon$-semantically secure (rather than $\varepsilon$). Also, clarified what $\epsilon$-HCB means for trapdoor functions.

3. In question 3, (a) it should have been $A'^{E_{sk}(\cdot)}$ (the

- It's enough to choose $N=\frac{2(\log\log p+\log4)}{\delta^2}$.
- For any events $A_1,\dots,A_k$, it holds that $\Pr[A_1\vee A_2\vee\dots\vee A_k]\leq \Pr[A_1]+\Pr[A_2]+\dots+\Pr[A_k]$. (Known as "union bound".)