RSA KEY GENERATION - ADVANCED
ENCRYPTION ALGORITHMS
PROBLEM SET
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
1. Calculate n = p * q = 61 * 53 = 3233
2. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
3. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
4. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
1. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
2. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
3. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
4. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
5. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
1. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
2. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
3. Alice and Bob exchange A and B
4. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
5. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
1. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
2. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
3. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1. Split plaintext: L0 = 5C, R0 = 3A
2. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
3. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
2. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
3. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1. Initial state: 1011
2. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
3. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
2. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
3. Calculate n = p * q = 61 * 53 = 3233
4. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
5. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
6. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
7. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
8. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
9. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
10. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
11. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
12. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
13. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
14. Alice and Bob exchange A and B
15. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
16. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
17. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
18. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
19. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
20. Split plaintext: L0 = 5C, R0 = 3A
21. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
22. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
23. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
24. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
25. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
26. Initial state: 1011
27. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
28. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
29. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
30. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
31. Calculate n = p * q = 61 * 53 = 3233
32. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
33. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
34. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
35. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
36. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
37. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
38. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
39. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
40. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
41. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
42. Alice and Bob exchange A and B
43. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
44. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
45. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
46. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
47. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
48. Split plaintext: L0 = 5C, R0 = 3A
49. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
50. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
51. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
52. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
53. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
54. Initial state: 1011
55. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
56. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
57. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
58. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
59. Calculate n = p * q = 61 * 53 = 3233
60. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
61. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
62. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
63. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
64. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
65. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
66. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
67. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
68. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
69. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
70. Alice and Bob exchange A and B
71. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
72. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
73. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
74. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
75. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
76. Split plaintext: L0 = 5C, R0 = 3A
77. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
78. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
79. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
80. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
81. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
82. Initial state: 1011
83. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
84. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
85. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
86. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
87. Calculate n = p * q = 61 * 53 = 3233
88. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
89. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
90. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
91. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
92. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
93. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
94. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
95. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
96. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
97. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
98. Alice and Bob exchange A and B
99. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
100. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
101. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
102. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
103. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
104. Split plaintext: L0 = 5C, R0 = 3A
105. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
106. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
107. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
108. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
109. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
110. Initial state: 1011
111. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
112. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
113. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
114. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
115. Calculate n = p * q = 61 * 53 = 3233
116. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
117. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
118. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
119. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
120. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
121. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
122. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
123. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
124. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
125. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
126. Alice and Bob exchange A and B
127. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
128. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
129. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
130. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
131. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
132. Split plaintext: L0 = 5C, R0 = 3A
133. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
134. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
135. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
136. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
137. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
138. Initial state: 1011
139. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
140. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
141. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
142. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
143. Calculate n = p * q = 61 * 53 = 3233
144. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
145. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
146. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
147. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
148. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
149. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
150. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
151. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
152. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
153. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
154. Alice and Bob exchange A and B
155. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
156. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
157. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
158. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
159. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
160. Split plaintext: L0 = 5C, R0 = 3A
161. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
162. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
163. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
164. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
165. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
166. Initial state: 1011
167. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
168. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
169. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
170. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
171. Calculate n = p * q = 61 * 53 = 3233
172. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
173. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
174. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
175. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
176. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
177. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
178. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
179. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
180. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
181. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
182. Alice and Bob exchange A and B
183. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
184. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
185. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
186. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
187. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
188. Split plaintext: L0 = 5C, R0 = 3A
189. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
190. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
191. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
192. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
193. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
194. Initial state: 1011
195. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
196. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
197. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
198. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
199. Calculate n = p * q = 61 * 53 = 3233
200. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
201. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
202. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
203. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
204. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
205. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
206. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
207. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
208. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
209. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
210. Alice and Bob exchange A and B
211. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
212. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
213. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
214. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
215. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
216. Split plaintext: L0 = 5C, R0 = 3A
217. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
218. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
219. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
220. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
221. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
222. Initial state: 1011
223. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
224. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
225. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
226. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
227. Calculate n = p * q = 61 * 53 = 3233
228. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
229. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
230. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
231. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
232. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
233. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
234. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
235. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
236. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
237. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
238. Alice and Bob exchange A and B
239. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
240. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
241. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
242. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
243. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
244. Split plaintext: L0 = 5C, R0 = 3A
245. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
246. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
247. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
248. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
249. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
250. Initial state: 1011
251. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
252. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
253. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
254. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
255. Calculate n = p * q = 61 * 53 = 3233
256. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
257. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
258. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
259. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
260. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
261. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
262. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
263. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
264. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
265. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
266. Alice and Bob exchange A and B
267. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
268. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
269. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
270. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
271. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
272. Split plaintext: L0 = 5C, R0 = 3A
273. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
274. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
275. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
276. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
277. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
278. Initial state: 1011
279. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
280. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
281. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
282. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
283. Calculate n = p * q = 61 * 53 = 3233
284. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
285. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
286. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
287. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
288. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
289. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
290. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
291. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
292. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
293. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
294. Alice and Bob exchange A and B
295. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
296. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
297. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
298. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
299. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
300. Split plaintext: L0 = 5C, R0 = 3A
301. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
302. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
303. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
304. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
305. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
306. Initial state: 1011
307. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
308. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
309. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
310. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
311. Calculate n = p * q = 61 * 53 = 3233
312. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
313. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
314. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
315. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
316. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
317. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
318. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
319. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
320. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
321. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
322. Alice and Bob exchange A and B
323. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
324. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
325. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
326. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
327. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
328. Split plaintext: L0 = 5C, R0 = 3A
329. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
330. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
331. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
332. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
333. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
334. Initial state: 1011
335. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
336. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
337. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
338. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
339. Calculate n = p * q = 61 * 53 = 3233
340. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
341. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
342. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
343. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
344. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
345. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
346. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
347. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
348. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
349. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
350. Alice and Bob exchange A and B
351. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
352. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
353. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
354. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
355. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
356. Split plaintext: L0 = 5C, R0 = 3A
357. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
358. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
359. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
360. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
361. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
362. Initial state: 1011
363. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
364. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
365. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
366. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
367. Calculate n = p * q = 61 * 53 = 3233
368. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
369. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
370. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
371. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
372. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
373. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
374. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
375. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
376. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
377. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
378. Alice and Bob exchange A and B
379. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
380. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
381. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
382. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
383. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
384. Split plaintext: L0 = 5C, R0 = 3A
385. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
386. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
387. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
388. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
389. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
390. Initial state: 1011
391. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
392. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
393. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
394. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
395. Calculate n = p * q = 61 * 53 = 3233
396. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
397. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
398. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
399. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
400. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
401. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
402. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
403. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
404. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
405. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
406. Alice and Bob exchange A and B
407. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
408. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
409. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
410. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
411. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
412. Split plaintext: L0 = 5C, R0 = 3A
413. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
414. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
415. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
416. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
417. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
418. Initial state: 1011
419. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
420. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
421. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
422. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
423. Calculate n = p * q = 61 * 53 = 3233
424. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
425. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
426. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
427. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
428. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
429. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
430. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
431. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
432. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
433. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
434. Alice and Bob exchange A and B
435. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
436. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
437. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
438. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
439. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
440. Split plaintext: L0 = 5C, R0 = 3A
441. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
442. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
443. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
444. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
445. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
446. Initial state: 1011
447. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
448. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
449. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
450. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
451. Calculate n = p * q = 61 * 53 = 3233
452. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
453. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
454. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
455. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
456. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
457. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
458. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
459. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
460. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
461. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
462. Alice and Bob exchange A and B
463. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
464. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
465. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
466. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
467. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
468. Split plaintext: L0 = 5C, R0 = 3A
469. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
470. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
471. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
472. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
473. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
474. Initial state: 1011
475. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
476. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
477. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
478. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
479. Calculate n = p * q = 61 * 53 = 3233
480. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
481. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
482. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
483. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
484. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
485. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
486. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
487. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
488. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
489. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
490. Alice and Bob exchange A and B
491. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
492. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
493. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
494. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
495. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
496. Split plaintext: L0 = 5C, R0 = 3A
497. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
498. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
499. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
500. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
501. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
502. Initial state: 1011
503. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
504. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
505. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
506. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
507. Calculate n = p * q = 61 * 53 = 3233
508. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
509. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
510. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
511. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
512. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
513. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
514. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
515. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
516. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
517. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
518. Alice and Bob exchange A and B
519. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
520. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
521. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
522. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
523. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
524. Split plaintext: L0 = 5C, R0 = 3A
525. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
526. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
527. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
528. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
529. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
530. Initial state: 1011
531. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
532. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
533. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
534. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
535. Calculate n = p * q = 61 * 53 = 3233
536. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
537. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
538. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
539. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
540. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
541. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
542. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
543. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
544. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
545. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
546. Alice and Bob exchange A and B
547. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
548. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
549. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
550. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
551. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
552. Split plaintext: L0 = 5C, R0 = 3A
553. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
554. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
555. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
556. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
557. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
558. Initial state: 1011
559. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
560. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
561. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
562. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
563. Calculate n = p * q = 61 * 53 = 3233
564. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
565. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
566. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
567. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
568. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
569. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
570. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
571. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
572. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
573. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
574. Alice and Bob exchange A and B
575. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
576. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
577. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
578. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
579. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
580. Split plaintext: L0 = 5C, R0 = 3A
581. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
582. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
583. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
584. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
585. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
586. Initial state: 1011
587. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
588. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
589. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
590. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
591. Calculate n = p * q = 61 * 53 = 3233
592. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
593. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
594. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
595. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
596. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
597. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
598. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
599. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
600. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
601. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
602. Alice and Bob exchange A and B
603. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
604. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
605. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
606. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
607. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
608. Split plaintext: L0 = 5C, R0 = 3A
609. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
610. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
611. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
612. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
613. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
614. Initial state: 1011
615. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
616. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
617. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
618. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
619. Calculate n = p * q = 61 * 53 = 3233
620. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
621. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
622. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
623. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
624. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
625. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
626. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
627. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
628. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
629. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
630. Alice and Bob exchange A and B
631. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
632. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
633. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
634. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
635. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
636. Split plaintext: L0 = 5C, R0 = 3A
637. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
638. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
639. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
640. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
641. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
642. Initial state: 1011
643. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
644. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
645. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
646. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
647. Calculate n = p * q = 61 * 53 = 3233
648. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
649. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
650. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
651. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
652. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
653. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
654. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
655. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
656. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
657. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
658. Alice and Bob exchange A and B
659. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
660. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
661. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
662. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
663. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
664. Split plaintext: L0 = 5C, R0 = 3A
665. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
666. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
667. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
668. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
669. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
670. Initial state: 1011
671. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
672. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
673. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
674. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
675. Calculate n = p * q = 61 * 53 = 3233
676. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
677. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
678. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
679. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
680. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
681. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
682. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
683. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
684. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
685. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
686. Alice and Bob exchange A and B
687. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
688. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
689. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
690. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
691. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
692. Split plaintext: L0 = 5C, R0 = 3A
693. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
694. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
695. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
696. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
697. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
698. Initial state: 1011
699. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
700. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
701. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
702. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
703. Calculate n = p * q = 61 * 53 = 3233
704. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
705. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
706. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
707. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
708. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
709. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
710. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
711. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
712. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
713. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
714. Alice and Bob exchange A and B
715. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
716. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
717. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
718. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
719. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
720. Split plaintext: L0 = 5C, R0 = 3A
721. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
722. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
723. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
724. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
725. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
726. Initial state: 1011
727. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
728. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
729. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
730. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
731. Calculate n = p * q = 61 * 53 = 3233
732. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
733. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
734. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
735. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
736. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
737. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
738. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
739. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
740. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
741. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
742. Alice and Bob exchange A and B
743. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
744. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
745. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
746. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
747. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
748. Split plaintext: L0 = 5C, R0 = 3A
749. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
750. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
751. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
752. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
753. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
754. Initial state: 1011
755. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
756. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
757. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
758. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
759. Calculate n = p * q = 61 * 53 = 3233
760. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
761. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
762. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
763. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
764. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
765. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
766. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
767. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
768. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
769. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
770. Alice and Bob exchange A and B
771. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
772. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
773. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
774. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
775. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
776. Split plaintext: L0 = 5C, R0 = 3A
777. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
778. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
779. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
780. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
781. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
782. Initial state: 1011
783. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
784. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
785. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
786. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
787. Calculate n = p * q = 61 * 53 = 3233
788. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
789. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
790. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
791. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
792. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
793. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
794. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
795. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
796. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
797. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
798. Alice and Bob exchange A and B
799. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
800. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
801. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
802. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
803. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
804. Split plaintext: L0 = 5C, R0 = 3A
805. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
806. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
807. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
808. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
809. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
810. Initial state: 1011
811. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
812. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
813. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
814. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
815. Calculate n = p * q = 61 * 53 = 3233
816. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
817. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
818. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
819. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
820. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
821. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
822. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
823. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
824. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
825. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
826. Alice and Bob exchange A and B
827. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
828. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
829. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
830. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
831. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
832. Split plaintext: L0 = 5C, R0 = 3A
833. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
834. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
835. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
836. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
837. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
838. Initial state: 1011
839. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
840. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
841. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
842. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
843. Calculate n = p * q = 61 * 53 = 3233
844. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
845. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
846. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
847. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
848. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
849. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
850. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
851. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
852. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
853. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
854. Alice and Bob exchange A and B
855. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
856. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
857. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
858. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
859. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
860. Split plaintext: L0 = 5C, R0 = 3A
861. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
862. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
863. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
864. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
865. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
866. Initial state: 1011
867. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
868. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
869. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
870. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
871. Calculate n = p * q = 61 * 53 = 3233
872. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
873. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
874. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
875. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
876. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
877. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
878. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
879. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
880. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
881. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
882. Alice and Bob exchange A and B
883. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
884. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
885. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
886. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
887. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
888. Split plaintext: L0 = 5C, R0 = 3A
889. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
890. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
891. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
892. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
893. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
894. Initial state: 1011
895. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
896. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
897. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
898. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
899. Calculate n = p * q = 61 * 53 = 3233
900. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
901. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
902. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
903. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
904. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
905. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
906. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
907. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
908. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
909. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
910. Alice and Bob exchange A and B
911. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
912. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
913. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
914. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
915. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
916. Split plaintext: L0 = 5C, R0 = 3A
917. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
918. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
919. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
920. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
921. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
922. Initial state: 1011
923. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
924. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
925. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
926. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
927. Calculate n = p * q = 61 * 53 = 3233
928. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
929. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
930. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
931. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
932. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
933. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
934. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
935. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
936. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
937. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
938. Alice and Bob exchange A and B
939. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
940. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
941. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
942. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
943. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
944. Split plaintext: L0 = 5C, R0 = 3A
945. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
946. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
947. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
948. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
949. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
950. Initial state: 1011
951. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
952. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
953. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
954. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
955. Calculate n = p * q = 61 * 53 = 3233
956. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
957. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
958. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
959. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
960. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
961. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
962. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
963. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
964. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
965. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
966. Alice and Bob exchange A and B
967. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
968. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
969. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
970. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
971. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
972. Split plaintext: L0 = 5C, R0 = 3A
973. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0 XOR F(R0,
K1) = 5C XOR 71 = 2D
974. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1 XOR F(R1,
K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
975. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5) mod 17 m
= 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
976. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod 17 = 28
mod 17 = 11
977. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6) - 1
mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
978. Initial state: 1011
979. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
980. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
981. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy knows x.
982. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t to
Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
983. Calculate n = p * q = 61 * 53 = 3233
984. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
985. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
986. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm: 3120 =
183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1 = 9 - 1
* 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1 = 2 *
3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
987. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59 W2 =
0c b7 ad d6 W3 = af 7f 67 98
988. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98 → 2f,
af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09 2f 53
d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
989. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
990. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
991. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
992. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
993. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
994. Alice and Bob exchange A and B
995. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881 mod 23 =
2
996. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 = 35184372088832 mod
23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
997. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
998. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 = 10
999. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1000. Split plaintext: L0 = 5C, R0 = 3A
1001. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0
XOR F(R0, K1) = 5C XOR 71 = 2D
1002. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1
XOR F(R1, K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1003. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5)
mod 17 m = 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
1004. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod
17 = 28 mod 17 = 11
1005. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6)
- 1 mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1006. Initial state: 1011
1007. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
1008. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1009. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy
knows x.
1010. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t
to Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
1011. Calculate n = p * q = 61 * 53 = 3233
1012. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
1013. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
1014. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm:
3120 = 183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1
= 9 - 1 * 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1
= 2 * 3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
1015. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59
W2 = 0c b7 ad d6 W3 = af 7f 67 98
1016. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98
→ 2f, af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09
2f 53 d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
1017. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
1018. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
1019. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
1020. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
1021. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
1022. Alice and Bob exchange A and B
1023. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881
mod 23 = 2
1024. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 =
35184372088832 mod 23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
1025. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
1026. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 =
10
1027. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1028. Split plaintext: L0 = 5C, R0 = 3A
1029. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0
XOR F(R0, K1) = 5C XOR 71 = 2D
1030. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1
XOR F(R1, K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1031. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5)
mod 17 m = 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
1032. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod
17 = 28 mod 17 = 11
1033. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6)
- 1 mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1034. Initial state: 1011
1035. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
1036. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1037. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy
knows x.
1038. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t
to Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
1039. Calculate n = p * q = 61 * 53 = 3233
1040. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
1041. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
1042. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm:
3120 = 183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1
= 9 - 1 * 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1
= 2 * 3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
1043. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59
W2 = 0c b7 ad d6 W3 = af 7f 67 98
1044. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98
→ 2f, af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09
2f 53 d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
1045. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
1046. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
1047. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
1048. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
1049. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
1050. Alice and Bob exchange A and B
1051. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881
mod 23 = 2
1052. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 =
35184372088832 mod 23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
1053. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
1054. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 =
10
1055. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1056. Split plaintext: L0 = 5C, R0 = 3A
1057. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0
XOR F(R0, K1) = 5C XOR 71 = 2D
1058. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1
XOR F(R1, K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1059. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5)
mod 17 m = 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
1060. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod
17 = 28 mod 17 = 11
1061. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6)
- 1 mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1062. Initial state: 1011
1063. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
1064. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1065. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy
knows x.
1066. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t
to Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
1067. Calculate n = p * q = 61 * 53 = 3233
1068. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
1069. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
1070. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm:
3120 = 183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1
= 9 - 1 * 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1
= 2 * 3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
1071. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59
W2 = 0c b7 ad d6 W3 = af 7f 67 98
1072. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98
→ 2f, af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09
2f 53 d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
1073. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
1074. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
1075. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
1076. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
1077. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
1078. Alice and Bob exchange A and B
1079. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881
mod 23 = 2
1080. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 =
35184372088832 mod 23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
1081. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
1082. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 =
10
1083. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1084. Split plaintext: L0 = 5C, R0 = 3A
1085. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0
XOR F(R0, K1) = 5C XOR 71 = 2D
1086. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1
XOR F(R1, K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1087. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5)
mod 17 m = 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
1088. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod
17 = 28 mod 17 = 11
1089. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6)
- 1 mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1090. Initial state: 1011
1091. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
1092. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1093. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy
knows x.
1094. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t
to Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
1095. Calculate n = p * q = 61 * 53 = 3233
1096. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
1097. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
1098. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm:
3120 = 183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1
= 9 - 1 * 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1
= 2 * 3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
1099. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59
W2 = 0c b7 ad d6 W3 = af 7f 67 98
1100. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98
→ 2f, af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09
2f 53 d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
1101. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
1102. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
1103. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
1104. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
1105. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
1106. Alice and Bob exchange A and B
1107. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881
mod 23 = 2
1108. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 =
35184372088832 mod 23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
1109. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
1110. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 =
10
1111. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1112. Split plaintext: L0 = 5C, R0 = 3A
1113. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0
XOR F(R0, K1) = 5C XOR 71 = 2D
1114. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1
XOR F(R1, K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1115. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5)
mod 17 m = 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
1116. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod
17 = 28 mod 17 = 11
1117. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6)
- 1 mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1118. Initial state: 1011
1119. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
1120. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1121. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy
knows x.
1122. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t
to Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
1123. Calculate n = p * q = 61 * 53 = 3233
1124. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
1125. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
1126. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm:
3120 = 183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1
= 9 - 1 * 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1
= 2 * 3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
1127. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59
W2 = 0c b7 ad d6 W3 = af 7f 67 98
1128. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98
→ 2f, af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09
2f 53 d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
1129. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
1130. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
1131. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
1132. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
1133. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
1134. Alice and Bob exchange A and B
1135. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881
mod 23 = 2
1136. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 =
35184372088832 mod 23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
1137. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
1138. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 =
10
1139. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1140. Split plaintext: L0 = 5C, R0 = 3A
1141. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0
XOR F(R0, K1) = 5C XOR 71 = 2D
1142. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1
XOR F(R1, K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1143. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5)
mod 17 m = 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
1144. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod
17 = 28 mod 17 = 11
1145. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6)
- 1 mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1146. Initial state: 1011
1147. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
1148. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1149. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy
knows x.
1150. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t
to Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
Problem . RSA Key Generation Generate an RSA public/private key pair with primes p = 61
and q = 53. Choose e = 17 as the public exponent. Show all steps, including the calculation of
the private exponent d.
Solution:
Steps for RSA key generation:
1151. Calculate n = p * q = 61 * 53 = 3233
1152. Calculate φ(n) = (p-1) * (q-1) = 60 * 52 = 3120
1153. Check if e and φ(n) are coprime: gcd(17, 3120) = 1, so e is valid
1154. Calculate d: solve de ≡ 1 (mod φ(n)) Using the extended Euclidean algorithm:
3120 = 183 * 17 + 9 17 = 1 * 9 + 8 9 = 1 * 8 + 1 8 = 8 * 1 + 0 Working backwards: 1
= 9 - 1 * 8 1 = 9 - 1 * (17 - 1 * 9) = 2 * 9 - 1 * 17 1 = 2 * (3120 - 183 * 17) - 1 * 17 1
= 2 * 3120 - 367 * 17 Therefore, d = -367 mod 3120 = 2753
Public key: (n = 3233, e = 17) Private key: (n = 3233, d = 2753)
Problem . AES Key Expansion Given the 128-bit AES key K = 0f 15 71 c9 47 d9 e8 59 0c b7
ad d6 af 7f 67 98, calculate the first round key. Show your work, including the use of the S-box
and RCON.
Solution:
AES-128 key expansion process for the first round key:
1155. Divide K into four words: W0, W1, W2, W3 W0 = 0f 15 71 c9 W1 = 47 d9 e8 59
W2 = 0c b7 ad d6 W3 = af 7f 67 98
1156. Calculate W4: a) RotWord(W3) = 7f 67 98 af b) SubBytes: 7f → d2, 67 → 09, 98
→ 2f, af → 53 SubWord result: d2 09 2f 53 c) XOR with RCON[1] = 01 00 00 00: d3 09
2f 53 d) XOR with W0: d3 09 2f 53 XOR 0f 15 71 c9 = dc 1c 5e 9a
1157. W5 = W4 XOR W1 = dc 1c 5e 9a XOR 47 d9 e8 59 = 9b c5 b6 c3
1158. W6 = W5 XOR W2 = 9b c5 b6 c3 XOR 0c b7 ad d6 = 97 72 1b 15
1159. W7 = W6 XOR W3 = 97 72 1b 15 XOR af 7f 67 98 = 38 0d 7c 8d
Therefore, the first round key is: dc 1c 5e 9a 9b c5 b6 c3 97 72 1b 15 38 0d 7c 8d
Problem . Diffie-Hellman Key Exchange Alice and Bob want to perform a Diffie-Hellman
key exchange. They agree on prime p = 23 and generator g = 5. Alice chooses secret a = 6,
and Bob chooses secret b = 15. Calculate their shared secret key and show all intermediate
steps.
Solution:
Diffie-Hellman key exchange steps:
1160. Alice computes A = ga mod p A = 56 mod 23 = 15625 mod 23 = 8
1161. Bob computes B = gb mod p B = 515 mod 23 = 30517578125 mod 23 = 19
1162. Alice and Bob exchange A and B
1163. Alice computes the shared secret: s = Ba mod p s = 196 mod 23 = 47045881
mod 23 = 2
1164. Bob computes the shared secret: s = Ab mod p s = 815 mod 23 =
35184372088832 mod 23 = 2
The shared secret key is 2.
Problem . ElGamal Encryption Using the ElGamal cryptosystem with prime p = 17 and
generator g = 3, encrypt the message m = 13 for a recipient with public key y = 12 and private
key x = 5. Use k = 7 as the ephemeral key. Show all steps of the encryption process.
Solution:
ElGamal encryption steps:
1165. Calculate c1 = gk mod p c1 = 37 mod 17 = 2187 mod 17 = 11
1166. Calculate the shared secret: s = yk mod p s = 127 mod 17 = 35831808 mod 17 =
10
1167. Calculate c2 = m * s mod p c2 = 13 * 10 mod 17 = 130 mod 17 = 11
The encrypted message is the pair (c1, c2) = (11, 11).
Problem . Feistel Network Design a simple Feistel network with 2 rounds. The round
function F should be F(R, K) = (R + K) mod 28, where R is the 8-bit right half of the input and K
is the 8-bit round key. Use K1 = 37 for round 1 and K2 = 93 for round 2. Encrypt the plaintext
P = 5C3A (hexadecimal) using your Feistel network and show the intermediate values after
each round.
Solution:
Feistel network encryption:
1168. Split plaintext: L0 = 5C, R0 = 3A
1169. Round 1: F(R0, K1) = (3A + 37) mod 256 = 71 (hex) L1 = R0 = 3A R1 = L0
XOR F(R0, K1) = 5C XOR 71 = 2D
1170. Round 2: F(R1, K2) = (2D + 93) mod 256 = C0 (hex) L2 = R1 = 2D R2 = L1
XOR F(R1, K2) = 3A XOR C0 = FA
The ciphertext is C = L2||R2 = 2DFA (hexadecimal). Intermediate values: After round 1: 3A2D
After round 2 (final ciphertext): 2DFA
Problem . Elliptic Curve Point Addition Consider the elliptic curve E: y2 = x3 + 2x + 3 over
the field F17. Given points P = (5, 1) and Q = (3, 6) on E, compute R = P + Q. Show all steps,
including the calculation of the slope and the final coordinates of R.
Solution:
Elliptic curve point addition steps:
1171. Calculate the slope m: m = (y2 - y1) / (x2 - x1) mod 17 m = (6 - 1) / (3 - 5)
mod 17 m = 5 / (-2) mod 17 m = 5 * (-2)-1 mod 17 = 5 * 8 mod 17 = 6
1172. Calculate x3: x3 = m2 - x1 - x2 mod 17 x3 = 62 - 5 - 3 mod 17 x3 = 36 - 8 mod
17 = 28 mod 17 = 11
1173. Calculate y3: y3 = m(x1 - x3) - y1 mod 17 y3 = 6(5 - 11) - 1 mod 17 y3 = 6(-6)
- 1 mod 17 y3 = -37 mod 17 = 14
Therefore, R = P + Q = (11, 14).
Problem . Stream Cipher Analysis A stream cipher uses an LFSR with the feedback
polynomial x4 + x3 + 1 and initial state 1011. Generate the first 16 bits of the keystream. Then,
given the ciphertext 1100 0101 1011 0010 (spaces added for readability), decrypt it to find the
plaintext. Assume the cipher performs a simple XOR operation between the keystream and the
plaintext.
Solution:
LFSR keystream generation:
1174. Initial state: 1011
1175. Feedback: XOR of bits 4 and 3 (rightmost is bit 1)
1176. Keystream generation (16 bits): 1, 0, 1, 1, 1, 1, 0, 0, 0, 1, 0, 1, 1, 0, 1, 0
Decryption: XOR the keystream with the ciphertext: Keystream: 1011 1100 0101 1010
Ciphertext: 1100 0101 1011 0010 Plaintext: 0111 1001 1110 1000
The plaintext is 0111 1001 1110 1000.
Problem . Zero-Knowledge Proof Design a zero-knowledge proof protocol for the following
scenario: Peggy wants to prove to Victor that she knows the discrete logarithm of y to the base
g modulo p, without revealing the actual value. Describe the protocol steps and explain why it
satisfies the properties of completeness, soundness, and zero-knowledge.
Solution:
Zero-knowledge proof protocol for discrete logarithm:
1177. Setup: Public parameters are prime p, generator g, and y = gx mod p. Peggy
knows x.
1178. Protocol: a) Peggy chooses a random r and computes t = gr mod p. She sends t
to Victor. b) Victor chooses a random challenge c and sends it to Peggy. c) Peggy
computes s = r + cx mod (p-1) and sends s to Victor. d) Victor verifies that gs ≡ t * yc
(mod p)
Properties: 1. Completeness: If Peggy knows x, she can always compute s correctly, and
Victor’s verification will always succeed. 2. Soundness: If Peggy doesn’t know x, she can’t
consistently produce valid s for different challenges c, except with negligible probability. 3.
Zero-knowledge: Victor learns nothing about x because r is random and independent of x, and s
doesn’t reveal information about x without knowing r.
The protocol is zero-knowledge because a simulator can produce transcripts indistinguishable
from real interactions without knowing x: 1. Choose random s and c 2. Compute t = gs * y-c
mod p This simulated transcript is identical to a real interaction.
