[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-395059-105":59,"doc-detail-395059-en":122},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":115,"head_meta":117,"extra_data":119,"updated_unix":121},105,"en","cos-433-cryptography-princeton-university-final-exam","COS 433: Cryptography - Princeton University - Final Exam","","Princeton University COS 433 Cryptography final exam questions assess core knowledge of public-key cryptography and hash-function security. Problems focus on distinguishing CPA/CCA security levels, explaining why Encrypt-then-Sign fails for CCA security, constructing one-way functions from encryption schemes, and analyzing signature security under collision-resistant hashing. Additional tasks cover CCA1/CCA2 weaknesses, parallelizable hashing via tree-style evaluation, Merkle–Damgard limitations, and constructing or modifying PRFs under key leakage constraints.",{"@graph":69,"@context":114},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":20,"@type":76,"position":81},"https://docshare.wps.com/document/exam/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/cos-433-cryptography-princeton-university-final-exam/395059/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/cos-433-cryptography-princeton-university-final-exam/395059.png","ImageObject",300,407,{"name":92,"@type":93},"A glass of water","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-01","2026-09-26",true,{"@type":102,"interactionType":103,"userInteractionCount":29},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108],{"name":109,"@type":110,"acceptedAnswer":111},"What is the purpose of the tree-style parallel hash construction, and what limitation remains?","Question",{"text":112,"@type":113},"The construction reduces computation depth by hashing in parallel pairs using a collision-resistant base hash function, achieving time proportional to log T with T processors. It is not collision-resistant for variable-length messages, where padding/structure can enable different-length inputs to produce the same output; the task asks to block this attack.","Answer","https://schema.org",{"og:url":83,"og:type":116,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":118,"canonical":83},"index,follow",{"doc_id":120,"site_id":62},395059,1791149499,{"code":4,"msg":5,"data":123},{"doc_id":120,"user_id":124,"nickname":92,"user_avatar":125,"doc_module":4,"category_id":19,"category_name":20,"doc_title":65,"doc_description":67,"doc_content":126,"file_id":127,"file_url":128,"file_type":129,"file_size":130,"view_count":29,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":81,"language":131,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":132,"faqs":133,"seo_title":134,"seo_description":67,"update_tm":135,"read_time":39,"preview_page_count":4},962090760832,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","COS 433: Cryptography Princeton University  \nFinal Exam  \nFinal Exam  \n1 Problem 1 (20 points)  \n(a) Your friend is confused why constructing CCA-secure public key encryption is so much harder than in the secret key setting. Inspired by the \\Encrypt-thenMAC\" scheme, your friend proposes the following \"Encrypt-then-Sign\" scheme, which simply replaces the components of \\Encrypt-then-MAC\" with public key objects: 􀀌rst encrypt the message using a CPA-secure public key encryption scheme, and then sign the scheme using a CMA-secure digital signature scheme. Explain why this will not work.  \n(b) Show how to build a one-way function given any public key encryption scheme  \n(c) In class, we saw the following signature scheme: to sign a message m, compute  \n􀀛 = F􀀀1(sk; H(m)) where (F; F􀀀1) is a trapdoor permutation, and H is a hash function. Show that collision resistance of H is not enough to prove security. To do so, devise a one-way permutation (F; F􀀀1) and collision resistant hash function H such that F􀀀1(sk; H(m)) is not a CMA-secure signature scheme. Todo so, start with an arbitrary collision resistant hash function H0 and arbitrary trapdoor permutation (F0 ; F0􀀀 1 ) .  \n(d) Suppose taking cube roots is hard mod N. Show that it is hard to solve the equation 27x3 􀀀 135x2 + 225x = c mod N for a random c 2 ZN .  \n2 Problem 2 (20 points)  \nRecall that CCA1 security (aka lunch time security) is a weaker version of full CCA security where the CCA queries are limited to occurring before the challenge query.  \n(a) Devise a public key encryption scheme that is CPA secure, but not CCA1 secure. Prove both the security and insecurity. You may use as a starting point any reasonable assumption we've seen in class (CPA/CCA secure public key encryption, DDH, RSA, one-way functions, etc) .  \n(b) Devise a public key encryption scheme that is CCA1 secure, but not full CCA secure (that is, CCA queries after the challenge query are devastating) . Prove both security and insecurity. Again, you may use as a starting point any reasonable assumption we've seen in class.  \n(c) Determine if the following is true, and in either case prove it: if you encrypt a message m = m0 m 1 : : : as Enc (pk; m0 ) ; Enc (pk; m1 ) ; : : : and Enc is CCA1 secure, then the resulting encryption scheme is CCA1 secure.  \n(d) Determine if the analogous statement is true for CCA2 security, and in either case prove it: If Enc is CCA2 secure, then the resulting scheme is CCA2 secure.  \n3 Problem 3 (20 points)  \nOne disadvantage of the Merkle-Damgard hash function is that it cannot be parallelized. Here, we will see that it is possible hash in a way that can be parallelized. Let h : f0 ; 1g2􀀕 ! f0 ; 1g􀀕 be a collision resistant hash function. Let T = 2t be a power of 2 . We will now construct a hash function H for 􀀕T-bit messages.  \nFirst, given a message m 2 f0 ; 1g􀀕T , break m into T blocks m 1 ; : : : ; mT of 􀀕 bits. Now, hash the message using h two blocks at a time (m(1)1 = h (m1 ; m2 ) ; m(1)2 = h (m3 ; m4 ) ; : : : ) to get T =2 blocks of 􀀕 bits, m (1)1; : : : ; mT(1=)2 . Now we hash these T =2 blocks using h again two blocks at a time (m(2)1 = h(m(1)1; m(1)2) ; m(2)2 = h(m(1)3; m(1)4) ; : : : ) . Repeat until 􀀌nally only one block remains. This one 􀀌nal block is the output of the hash function.  \n(a) Explain brie􀀍y how, given T processors, H can be computed in time O(log T ) .  \n(b) Show that H is collisions resistant. In particular, show how, given a collision m  m0 for H, it is possible to e􀀎ciently compute a collision x  x0 for h.  \n(c) Explain why this hash function will not be collision resistant for variable length messages. That is, show how to devise two messages m; m0 with length T 􀀕 and T0 􀀕 respectively, such that H (m) = H(m0 ) .  \n(d) Devise a way to block the attack from part (c) .  \n4 Problem 4 (20 points)  \nRecall the tree-based PRF we saw in class using pseudorandom generators. Show how the secret key holder can do the following. Given an arbitrary point x, ","cbCail1zmxPWVBcp","https://ap.wps.com/l/cbCail1zmxPWVBcp","pdf",106960,"English","# Problem 1\n## Problem 2\n## Problem 3\n## Problem 4\n## Problem 5","[{\"question\":\"What is the purpose of the tree-style parallel hash construction, and what limitation remains?\",\"answer\":\"The construction reduces computation depth by hashing in parallel pairs using a collision-resistant base hash function, achieving time proportional to log T with T processors. It is not collision-resistant for variable-length messages, where padding/structure can enable different-length inputs to produce the same output; the task asks to block this attack.\"}]","COS 433: Cryptography - Princeton University - Final Exam | PDF",1790415673]