[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-400990-105":59,"doc-detail-400990-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","cs-161-introduction-to-spring-2025-computer-security-exam-prep-6-bobs-birthday","CS 161 Introduction to Spring 2025 Computer Security Exam Prep 6 - Bob’s Birthday","","CS 161 Spring 2025 Computer Security exam prep problems covering core cryptography concepts, including ElGamal encryption and its malleability, RSA digital signatures and message origin guarantees, and an exam modification of ElGamal using a block cipher to encrypt parts of ciphertext. It also includes EvanBot’s signature scheme based on Diffie-Hellman style parameters, prompting derivations for hash expressions and private-key recovery when s=0 is mishandled. Further problems define YAAS authentication with salted, iterated hashing, then require selecting correct login checks and analyzing whether salt knowledge is needed and how many hash calls are required at later logins.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":20,"@type":76,"position":81},"https://docshare.wps.com/document/exam/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/cs-161-introduction-to-spring-2025-computer-security-exam-prep-6-bobs-birthday/400990/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/cs-161-introduction-to-spring-2025-computer-security-exam-prep-6-bobs-birthday/400990.png","ImageObject",300,407,{"name":92,"@type":93},"Jordan Avery","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-06","2026-09-27",true,{"@type":102,"interactionType":103,"userInteractionCount":34},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"Why can’t Bob be certain the message is from Alice after a successful RSA signature verification?","Question",{"text":112,"@type":113},"Bob cannot be sure because Mallory could block Alice’s message and replace it with a different one, undermining authenticity in the given scenario.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"In the modified ElGamal scheme that further encrypts ciphertext portions with a block cipher, is the scheme still malleable?",{"text":117,"@type":113},"No. The correct choice is that the adversary is not able to exploit malleability as in standard ElGamal, as the block cipher behavior corresponds to a pseudorandom permutation in the options given.",{"name":119,"@type":110,"acceptedAnswer":120},"For YAAS, does the server need to know the salt to complete login?",{"text":121,"@type":113},"Yes or No depends on the login-check logic, but the question asks specifically whether salt knowledge is required; the scheme’s construction determines whether salt is needed to compute or verify the stored values.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},400990,1791103312,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":19,"category_name":20,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":34,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":24,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":143,"read_time":144,"preview_page_count":4},1099523882367,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","CS 161 Introduction to  \nSpring 2025 Computer Security Exam Prep 6  \nQ1 Bob’s Birthday (11 points)  \nIt’s Bob’s birthday! Alice wants to send an encrypted birthday message to Bob using ElGamal.  \nRecall the definition of ElGamal encryption:  \n• b is the private key, and B = gb mod p is the public key.  \n• Enc (B, M) = (C1 , C2 ), where C1 = gr mod p and C2 = M × Br mod p  \n• Dec (b, C1 , C2 ) = Cb × C2 mod p  \nQ1.1 (2 points) Mallory wants to tamper with Alice’s message to Bob. In response, Alice decides to sign her message with an RSA digital signature. Bob receives the signed message and verifies the signature successfully. Can he be sure the message is from Alice?  \n Yes, because RSA digital signatures are unforgeable.  \n Yes, because RSA encryption is IND-CPA secure.  \n No, because Mallory could have blocked Alice’s message and replaced it with a different one.  \n No, because Mallory could find a different message with the same hash as Alice’s original message.  \nAs we discussed in class, ElGamal is malleable, meaning that a man-in-the-middle can change a message in a predictable manner, such as producing the ciphertext of the message 2 × M given the ciphertext of M.  \nQ1.2 (3 points) Consider the following modification to ElGamal: Encrypt as normal, but further encrypt portions ofthe ciphertext with a block cipher E, which has a block size equal to the number of bits in p. In this scheme, Alice and Bob share a symmetric key Ksym known to no one else.  \nUnder this modified scheme, C1 is computed as EKsym(gr mod p) and C2 is computed as EKsym(M× Br mod p) . Is this scheme still malleable?  \n Yes, because block ciphers are not IND-CPA secure encryption schemes  \n Yes, because the adversary can still forge k × C2 to produce k × M  \n No, because block ciphers are a pseudorandom permutation  \n No, because the adversary isn’t able to learn anything about the message M  \nPage 1 of 5  \nThis content is protected and may not be shared, uploaded, or distributed.  \nThe remaining parts are independent of the previous part.  \nFor Bob’s birthday, Mallory hacks into Bob’s computer, which stores Bob’s private key b. She isn’t able to read b or overwrite b with an arbitrary value, but she can multiply the stored value of b by a random value z known to Mallory.  \nMallory wants to send a message to Bob that appears to decrypt as normal, but using the modified key b · z. Give a new encryption formula for C1 and C2 that Mallory should use. Make sure you only use values known to Mallory!  \nClarification during exam: For subparts 3 and 4, assume that the value of B is unchanged.  \nQ1.3 (3 points) Give a formula to produce C1, encrypting M.  \nQ1.4 (3 points) Give a formula to produce C2, encrypting M.  \nPage 2 of 5 –  \nThis content is protected and may not be shared, uploaded, or distributed.  \nQ2 Cryptography: EvanBot Signature Scheme (12 points)  \nEvanBot decides to make a signature scheme!  \nTo initialize the system, a Diffie-Hellman generator g and prime p are generated and shared to all parties. The private key is some x mod p chosen randomly, and the public key is y = gx mod p.  \nTo sign a message m such that 2 ≤ m ≤ p − 2 :  \n1. Choose a random integer k between 2 and p − 2.  \n2. Set r = gk mod p.  \n3. Set s = (H(m) − xr)k −1 mod (p − 1) . If s = 0, restart from Step 1 .  \n4. Output (r, s) as the signature.  \nClarification after exam: k is chosen to be coprime to p − 1.  \nTo verify, check that gH (m) ≡   mod p. We will fill in this blank in the next few subparts.  \nQ2.1 (3 points) Select the correct expression for H(m) in terms of x, r, k, s and p − 1.  \nHINT: Use Step 3 of the signature algorithm.  k (xr)−1 + s mod (p − 1)  k −1 + xr mod (p − 1)  \n ks − xr mod (p − 1)  ks + xr mod (p − 1)  \nQ2.2 (4 points) Using the previous result, select the correct value for the blank in the verification step.  \nHINT: Replace the H(m) in g H (m) with your results from the previous subpart.  \n y sr2 mod p  ry rs mod p  \n yr rs mod p  rgyr mod p  \nQ2.3 (5","cbCaiqxR18K2yNVT","https://ap.wps.com/l/cbCaiqxR18K2yNVT","pdf",389155,"English","# Q1 Bob’s Birthday\n## Q1.1 RSA signature verification and message origin\n## Q1.2 Modified ElGamal with block cipher wrapping\n## Q1.3 Construct C1 for modified key usage\n## Q1.4 Construct C2 for modified key usage\n# Q2 Cryptography: EvanBot Signature Scheme\n## Q2.1 Select H(m) expression\n## Q2.2 Fill verification blank\n## Q2.3 Recover x when s=0\n# Q3 Hash Functions: YAAS\n## Q3.1 Login check blank\n## Q3.2 Stored update blank\n## Q3.3 Whether server needs salt\n## Q3.4 Hash-call count for later login","[{\"question\":\"Why can’t Bob be certain the message is from Alice after a successful RSA signature verification?\",\"answer\":\"Bob cannot be sure because Mallory could block Alice’s message and replace it with a different one, undermining authenticity in the given scenario.\"},{\"question\":\"In the modified ElGamal scheme that further encrypts ciphertext portions with a block cipher, is the scheme still malleable?\",\"answer\":\"No. The correct choice is that the adversary is not able to exploit malleability as in standard ElGamal, as the block cipher behavior corresponds to a pseudorandom permutation in the options given.\"},{\"question\":\"For YAAS, does the server need to know the salt to complete login?\",\"answer\":\"Yes or No depends on the login-check logic, but the question asks specifically whether salt knowledge is required; the scheme’s construction determines whether salt is needed to compute or verify the stored values.\"}]","CS 161 Introduction to Spring 2025 Computer Security Exam Prep 6 - Bob’s Birthday | PDF",1790515920,13]