yuuwwang/aicrypto huggingface dataset:
Topic: classic
Question: The following ciphertext was encoded via Caesar cipher with a fixed shift of three letters. Determine the original plaintext: HQFUBSWHG ZRUG.
Options:
ABANDONED WORD
ENCRYPTED TEXT
ABANDONED TEXT
ENCRYPTED WORD
None of the above
Answer (0-based option index): 3
Topic: classic
Question: On Encrypting "thepepsiisintherefrigerator" using Vigenère Cipher System using the keyword "HUMOR" we get cipher text.
Options:
abqqfduugzulqtipaqfraidokvl
abqdvwmugzulqtipaqfraidokvl
abqqfsuugzukqtipaqfraidokvl
abqdvsuugzulqtigaqfraidokvl
abqdvwmuwjphfvvyyrfznydokvl
Answer (0-based option index): 4
Topic: symmetric
Question: In the Triple DES encryption scheme, the total key length is ( ) and the ``meet-in-the-middle'' attack requires ( ) computational tests to breach the cipher.
Options:
${168}$, $2^{111}$
${192}$, $2^{112}$
${184}$, $2^{111}$
${168}$, $2^{112}$
None of the above
Answer (0-based option index): 3
Topic: math
Question: Which of the following is a valid property for congruence?
Options:
$a \equiv b \ (\mathrm{mod}\ n)$ if $n\mid(a-b)$
$a \equiv b \ (\mathrm{mod}\ n)$ implies $b \equiv a \ (\mathrm{mod}\ n)$
$a \equiv b \ (\mathrm{mod}\ n)$ and $b \equiv c \ (\mathrm{mod}\ n)$ implies $a \equiv c \ (\mathrm{mod}\ n)$
All of the mentioned
None of the above
Answer (0-based option index): 3
Topic: symmetric
Question: Assuming the plaintext is guaranteed to be unique and at most one block long, which DES mode minimizes overhead?
Options:
Cipher Block Chaining (CBC)
Output Feedback Modes (OFB)
Electronic Code Book (ECB)
Cipher Feedback Mode (CFB)
None of the above
Answer (0-based option index): 2
Topic: symmetric
Question: Using the Linear Congruential Method (LCM) with parameters $a = 7$, $c = 0$, and $m = 32$ ($X_{n+1} \equiv (aX_n + c) \mod m$), determine the period of the generated sequence.
Options:
11
4
13
7
None of the above
Answer (0-based option index): 1
Topic: symmetric
Question: In the Linear Congruential Method (LCM), what is the most suitable choice for the modulus $m$ to maximize the period?
Options:
$2^{31} - 1$
$2^{32}$
$2^{31}$
$2^{32} - 1$
None of the above
Answer (0-based option index): 0
Topic: math
Question: Find the solution of $x^2 \equiv 3 \mod 11$.
Options:
$x \equiv -9 \mod 11$ and $x \equiv 9 \mod 11$
$x \equiv 9 \mod 11$
$x \equiv 5 \mod 11$ and $x \equiv 6 \mod 11$
No Solution
None of the above
Answer (0-based option index): 2
Topic: misc
Question: Let $(E, D)$ be a (one-time) semantically secure cipher with key space $K = \{0,1\}^\ell$. A bank wishes to split a decryption key $k \in \{0,1\}^\ell$ into three pieces $p_1, p_2, p_3$ so that any two of the pieces enable decryption using $k$, but no single piece can decrypt. The bank generates two random pairs $(k_1, k_1')$ and $(k_2, k_2')$ such that $k_1 \oplus k_1' = k_2 \oplus k_2' = k$. How should the bank assign pieces so that any two pieces enable decryption using $k$, but no single piece can decrypt?
Options:
$p_1 = (k_1, k_2)$, $p_2 = (k_1', k_2')$, $p_3 = (k_2')$
$p_1 = (k_1, k_2)$, $p_2 = (k_2, k_2')$, $p_3 = (k_2')$
$p_1 = (k_1, k_2)$, $p_2 = (k_1', k_2)$, $p_3 = (k_2')$
$p_1 = (k_1, k_2)$, $p_2 = (k_1')$, $p_3 = (k_2')$
None of the above
Answer (0-based option index): 2
Topic: misc
Question: Suppose Alice is broadcasting packets to 6 recipients $B_1, \ldots, B_6$. Privacy is not important, but integrity is. Each recipient should be assured that the packets are from Alice. Alice sets up 4 secret keys $S = \{k_1, k_2, k_3, k_4\}$. She gives each user $B_i$ a subset $S_i \subseteq S$ of the keys. When Alice transmits a packet, she appends 4 tags computed with each of her 4 keys. User $B_i$ accepts a packet as valid only if all tags corresponding to his keys in $S_i$ are valid. 
How should Alice assign keys to the 6 users so that no single user can forge packets on behalf of Alice and fool some other user?
Options:
$S_1 = \{k_1, k_2\}$, $S_2 = \{k_1, k_3, k_4\}$, $S_3 = \{k_1, k_4\}$, \\
$S_4 = \{k_2, k_3\}$, $S_5 = \{k_2, k_3, k_4\}$, $S_6 = \{k_3, k_4\}$
$S_1 = \{k_2, k_4\}$, $S_2 = \{k_2, k_3\}$, $S_3 = \{k_3, k_4\}$, \\
$S_4 = \{k_1, k_3\}$, $S_5 = \{k_1, k_2\}$, $S_6 = \{k_1, k_4\}$
$S_1 = \{k_1, k_2\}$, $S_2 = \{k_1, k_3\}$, $S_3 = \{k_1, k_4\}$, \\
$S_4 = \{k_2, k_3, k_4\}$, $S_5 = \{k_2, k_3\}$, $S_6 = \{k_3, k_4\}$
$S_1 = \{k_1, k_2\}$, $S_2 = \{k_1\}$, $S_3 = \{k_1, k_4\}$, \\
$S_4 = \{k_2, k_3\}$, $S_5 = \{k_2, k_4\}$, $S_6 = \{k_3, k_4\}$
None of the above
Answer (0-based option index): 1
Topic: symmetric
Question: Suppose $H_1$ and $H_2$ are collision resistant hash functions mapping inputs in a set $M$ to $\{0,1\}^{256}$. Our goal is to show that the function $H_2(H_1(m))$ is also collision resistant. We prove the contrapositive: suppose $H_2(H_1(\cdot))$ is not collision resistant, that is, we are given $x \neq y$ such that $H_2(H_1(x)) = H_2(H_1(y))$. We build a collision for either $H_1$ or for $H_2$. This will prove that if $H_1$ and $H_2$ are collision resistant then so is $H_2(H_1(\cdot))$. Which of the following must be true
Options:
Either $H_2(x), H_2(y)$ are a collision for $H_1$ or $x, y$ are a collision for $H_2$.
Either $x, H_1(y)$ are a collision for $H_2$ or $H_2(x), y$ are a collision for $H_1$.
Either $x, y$ are a collision for $H_1$ or $H_1(x), H_1(y)$ are a collision for $H_2$.
Either $x, y$ are a collision for $H_2$ or $H_1(x), H_1(y)$ are a collision for $H_1$.
None of the above
Answer (0-based option index): 2
Topic: symmetric
Question: Let $(E,D)$ be a secure tweakable block cipher. Define the following MAC $(S,V)$$$S(k,m) := E(k,m,0) \quad \text{and} \quad V(k,m,\text{tag}) := \begin{cases} 1 & \text{if } E(k,m,0) = \text{tag} \\ 0 & \text{otherwise} \end{cases}$$ 
In other words, the message $m$ is used as the tweak, and the plaintext given to $E$ is always set to $0$. Is this MAC secure?
Options:
It depends on the specific tweakable block cipher.
Yes
No
None of the above
Answer (0-based option index): 1
Topic: misc
Question: Consider a key exchange protocol using an online Trusted Third Party (TTP). Suppose Alice, Bob, and Carol are three users of this system, each sharing a secret key with the TTP denoted $k_a, k_b, k_c$ respectively. They wish to generate a group session key $k_{ABC}$ that will be known to Alice, Bob, and Carol, but unknown to an eavesdropper. How would you modify a typical TTP-based protocol to accommodate this group key exchange? (Note: assume all these protocols are insecure against active attacks).
Options:

Alice contacts the TTP. The TTP generates a random $k_{AB}$ and a random $k_{AC}$. The TTP sends to Alice: \\
$E(k_a, k_{AB})$, $ticket_1 \leftarrow E(k_b, k_{AB})$, $ticket_2 \leftarrow E(k_c, k_{AC})$. \\
Alice sends $ticket_1$ to Bob and $ticket_2$ to Carol.


Alice contacts the TTP. The TTP generates a random $k_{ABC}$ and sends to Alice: \\
$E(k_a, k_{ABC})$, $ticket_1 \leftarrow E(k_b, k_{ABC})$, $ticket_2 \leftarrow E(k_c, k_{ABC})$. \\
Alice sends $ticket_1$ to Bob and $ticket_2$ to Carol.


Bob contacts the TTP. The TTP generates a random $k_{AB}$ and a random $k_{BC}$. The TTP sends to Bob: \\
$E(k_a, k_{AB})$, $ticket_1 \leftarrow E(k_a, k_{AB})$, $ticket_2 \leftarrow E(k_c, k_{BC})$. \\
Bob sends $ticket_1$ to Alice and $ticket_2$ to Carol.


Alice contacts the TTP. The TTP generates a random $k_{ABC}$ and sends to Alice: \\
$E(k_a, k_{ABC})$, $ticket_1 \leftarrow k_{ABC}$, $ticket_2 \leftarrow k_{ABC}$. \\
Alice sends $ticket_1$ to Bob and $ticket_2$ to Carol.

None of the above
Answer (0-based option index): 1
Topic: asymmetric
Question: Suppose we modify the Diffie-Hellman protocol. Alice chooses a random $a \in \{1, \ldots, p-1\}$ and sends $A = g^a \pmod{p}$ to Bob. Bob, however, chooses a random $b \in \{1, \ldots, p-1\}$ and sends $B = g^{1/b} \pmod{p}$ to Alice (where $1/b$ denotes $b^{-1} \pmod{p-1}$, the modular multiplicative inverse of $b$ modulo $p-1$). What shared secret can they generate, and how would they do it?
Options:
Shared secret is $g^{ab}$. Alice computes $B^{1/a} \pmod{p}$ and Bob computes $A^b \pmod{p}$.
Shared secret is $g^{a/b}$. Alice computes $B^a \pmod{p}$ and Bob computes $A^{1/b} \pmod{p}$.
Shared secret is $g^{b/a}$. Alice computes $B^a \pmod{p}$ and Bob computes $A^{1/b} \pmod{p}$.
Shared secret is $g^{a/b}$. Alice computes $B^{1/a} \pmod{p}$ and Bob computes $A^b \pmod{p}$.
None of the above
Answer (0-based option index): 1
Topic: misc
Question: Consider a toy key exchange protocol using public key encryption. Suppose that when sending his reply $c \leftarrow E(pk, x)$ to Alice, Bob appends a MAC $t:= S(x, c)$ to the ciphertext, so that what is sent to Alice is the pair $(c,t)$. Alice verifies the tag $t$ and rejects the message from Bob if the tag does not verify. Will this additional step prevent the man-in-the-middle attack described in lectures?
Options:
Yes
It depends on what public key encryption system is used.
No
It depends on what MAC system is used.
None of the above
Answer (0-based option index): 2
Topic: asymmetric
Question: Suppose $n+1$ parties, denoted $B, A_1, \ldots, A_n$, wish to establish a shared group key. They require a protocol such that upon completion, all parties possess a common secret key $k$. An eavesdropper observing the entire communication must not be able to determine $k$. The parties agree on the following protocol, which operates in a group $G$ of prime order $q$ with a generator $g$ \begin{enumerate} 
\item For $i=1, \ldots, n$, party $A_i$ chooses a random secret integer $a_i \in \{1, \ldots, q-1\}$ (i.e., $a_i \in \mathbb{Z}_q^*$) and sends $X_i = g^{a_i}$ to Party $B$. 
\item Party $B$ generates a random secret integer $b \in \{1, \ldots, q-1\}$ (i.e., $b \in \mathbb{Z}_q^*$). For each $i=1, \ldots, n$, Party $B$ computes $Y_i = X_i^b = (g^{a_i})^b = g^{a_i b}$ and sends $Y_i$ to Party $A_i$. 
\end{enumerate} 
The intended shared group key is $k = g^b$. Party $B$ can compute this key directly since $B$ knows $b$. How can each Party $A_i$ (who knows $a_i$ and receives $Y_i$) compute this group key $k=g^b$?
Options:
Party $A_i$ computes $g^b$ as $Y_i^{a_i}$.
Party $A_i$ computes $g^b$ as $Y_i^{1/a_i}$.
Party $A_i$ computes $g^b$ as $Y_i - a_i$.
Party $A_i$ computes $g^b$ as $(Y_i^{-1})^{1/a_i}$.
None of the above
Answer (0-based option index): 1
Topic: asymmetric
Question: Recall that the standard RSA trapdoor permutation operates in the group $\mathbb{Z}_N^*$, where $N$ is the product of two large distinct primes. The public key is $(N,e)$ and the private key is $(N,d)$, where $d$ is the modular multiplicative inverse of $e$ modulo $\phi(N)$ (i.e., $e \cdot d \equiv 1 \pmod{\phi(N)}$). 
 
Suppose, hypothetically, that RSA was defined modulo a prime $p$ instead of a composite $N$. In this modified scenario, the "public key" would be $(p,e)$. How would one compute the corresponding "private key" exponent $d$ given $(p,e)$?
Options:
$d \leftarrow e^{-1} \pmod{p^2}$
$d \leftarrow e^2 \pmod{p}$
$d \leftarrow e^{-1} \pmod{p-1}$
$d \leftarrow -e \pmod{p}$
None of the above
Answer (0-based option index): 2
Topic: symmetric
Question: Let $(E, D)$ be a CPA-secure cipher defined over $(K, M, C)$ and let $H_1: M \to T$ and $H_2: C \to T$ be collision-resistant hash functions. Consider the following modified encryption schemes\medskip 
 
\textbf{Scheme A):} 
\begin{itemize} 
\item Encryption: $E_1(k, m) := E(k, m) \| E(k, m)$ (concatenation of two ciphertexts) 
\item Decryption: $D_1(k, c_1 \| c_2) := \begin{cases} D(k, c_1) & \text{if } D(k, c_1) = D(k, c_2) \\ \text{reject} & \text{otherwise} \end{cases}$ 
\end{itemize} 
\medskip 
 
\textbf{Scheme B):} 
\begin{itemize} 
\item Encryption: $E_2(k, m) := \text{let } c \leftarrow E(k, m); \text{ output } (c, c)$ 
\item Decryption: $D_2(k, (c_1, c_2)) := \begin{cases} D(k, c_1) & \text{if } c_1 = c_2 \\ \text{reject} & \text{otherwise} \end{cases}$ 
\end{itemize} 
\medskip 
 
\textbf{Scheme C):} 
\begin{itemize} 
\item Encryption: $E_3(k, m) := \text{let } c \leftarrow E(k, m); \text{ output } (c, H_1(m))$ 
\item Decryption: $D_3(k, (c, h)) := \begin{cases} D(k, c) & \text{if } H_1(D(k, c)) = h \\ \text{reject} & \text{otherwise} \end{cases}$ 
\end{itemize} 
\medskip 
 
\textbf{Scheme D):} 
\begin{itemize} 
\item Encryption: $E_4(k, m) := \text{let } c \leftarrow E(k, m); \text{ output } (c, H_2(c))$ 
\item Decryption: $D_4(k, (c, h)) := \begin{cases} D(k, c) & \text{if } H_2(c) = h \\ \text{reject} & \text{otherwise} \end{cases}$ 
\end{itemize} 
\medskip 
 
Which of the above schemes guarantees authenticated encryption (AE) security (Authenticated-encryption (AE) = CPA privacy + ciphertext-integrity (INT-CTXT))?
Options:
Scheme A
Scheme B
Scheme C
Scheme D
None of the above
Answer (0-based option index): 4
Topic: symmetric
Question: Which of the following AES modes of operation fails to provide semantic security under standard assumptions, meaning it may leak patterns from plaintext to ciphertext?
Options:
AES in CBC mode with a random IV
AES in CTR mode
AES in ECB mode
AES in GCM mode
None of the above
Answer (0-based option index): 2
Topic: misc
Question: In the idealized Random Oracle Model, which cryptographic primitive is most often analyzed as if it were a truly random function to support security proofs?
Options:
Block ciphers
Public-key encryption systems
Cryptographic hash functions
Message authentication codes
None of the above
Answer (0-based option index): 2
Topic: math
Question: Which of the following values among 17, 20, 38, and 50 does \textbf{NOT} admit primitive roots in the multiplicative group $\mathbb{Z}_n^*$?
Options:
17
50
38
20
None of the above
Answer (0-based option index): 3
Topic: math
Question: Evaluate Euler's totient function: $\phi(25) = $
Options:
22
24
20
25
None of the above
Answer (0-based option index): 2
Topic: math
Question: Find an integer $x$ such that $0 \le x \le 28$ and $x^{85} \equiv 6 \pmod{35}$. Which value of $x$ satisfies the congruence?
Options:
6
28
8
32
None of the above
Answer (0-based option index): 0
Topic: math
Question: Which of the following is the smallest positive integer $x$ that satisfies the following system of congruences:
\begin{align*}
 x &\equiv 2 \pmod{3},\ 
 x &\equiv 5 \pmod{7},\
 x &\equiv 11 \pmod{13}.\end{align*}
Options:
16
54
89
121
None of the above
Answer (0-based option index): 3
Topic: asymmetric
Question: Using Rabin cryptosystem with parameters $p=23$ and $q=7$, compute the ciphertext for plaintext $28$. The ciphertext is
Options:
42
93
140
127
None of the above
Answer (0-based option index): 2
Topic: asymmetric
Question: Within the ElGamal cryptosystem, suppose the prime $p = 31$. If $g$ is chosen as the smallest primitive root modulo $p$ and the private key $d = 10$, compute the value of $y$ such that $y \equiv g^d \bmod p$.
Options:
24
36
25
62
None of the above
Answer (0-based option index): 2
Topic: symmetric
Question: Let $E(k,x)$ be a secure block cipher. Consider the following tweakable block cipher construction$$E'((k_1,k_2), t, x) = E(k_1, x) \oplus E(k_2, t)$$ 
where $(k_1, k_2)$ is the key, $t$ is the tweak, and $x$ is the plaintext block. Is this tweakable block cipher secure?
Options:
Yes, it is secure assuming $E$ is a secure block cipher.

No because for $x \neq x'$ we have \\
$E'((k_1,k_2), 0, x) \oplus E'((k_1,k_2), 0, x) = E'((k_1,k_2), 0, x') \oplus E'((k_1,k_2), 0, x')$


No because for $t \neq t'$ we have \\
$E'((k_1,k_2), t, 0) \oplus E'((k_1,k_2), t, 1) = E'((k_1,k_2), t', 0) \oplus E'((k_1,k_2), t', 1)$


No because for $t \neq t'$ we have \\
$E'((k_1,k_2), t, 0) \oplus E'((k_1,k_2), t', 1) = E'((k_1,k_2), t', 1) \oplus E'((k_1,k_2), t', 0)$


No because for $x \neq x'$ and $t \neq t'$ we have \\
$E'((k_1,k_2), t, x) \oplus E'((k_1,k_2), t', x) = E'((k_1,k_2), t, x') \oplus E'((k_1,k_2), t', x)$

None of the above
Answer (0-based option index): 2
Topic: asymmetric
Question: Given a superincreasing sequence $l=\{38, 20, 9, 4, 2, 1\}$ (The sequence is from right to left, corresponding to the bits from low to high.) that sums to 23, determine the binary vector $n$ which yields this total.
Options:
011111
010011
010111
010010
None of the above
Answer (0-based option index): 1
Topic: asymmetric
Question: For RSA with $p = 11$, $q = 17$, and public exponent $e = 7$, decrypt the ciphertext 44 to recover the plaintext.
Options:
88
22
13
41
None of the above
Answer (0-based option index): 1
Topic: asymmetric
Question: Consider a knapsack cryptosystem where letters A-Z are mapped to integers 0 through 25. You receive ciphertext values 14, 25, and 89. If the public key is \{57, 14, 3, 24, 8\} (The sequence is from right to left, corresponding to the bits from low to high.), what plaintext corresponds to this message?
Options:
INK
TIN
KIN
INT
None of the above
Answer (0-based option index): 3
Topic: math
Question: How many real versus imaginary roots (when $y=0$) exist for the elliptic curve equation $y^2 = x^3 - 4x$?
Options:
All solutions are imaginary
All roots are real
Two real, one imaginary root
One real, two imaginary roots
None of the above
Answer (0-based option index): 1
Topic: asymmetric
Question: Let $P = (4, 3.464)$ be a point on the elliptic curve $y^2 = x^3 - 17x + 16$ over the real numbers. What is the result of computing $2P$ on this curve?
Options:
(11.694, -43.723)
(12.022, -39.362)
(43.022, 39.362)
(32.022, 42.249)
None of the above
Answer (0-based option index): 1
Topic: asymmetric
Question: Bob chooses the elliptic curve $E_{67}(2, 3)$ defined over $GF(67)$, along with the base point $e_1 = (2, 22)$ and a private scalar $d = 4$. He computes $e_2 = d \cdot e_1$ and publishes $(E, e_1, e_2)$. If Alice wishes to send $P = (24, 26)$ and randomly selects $r = 2$, what are the resulting ciphertext points $C_1$ and $C_2$? ($E_p(a, b) :  y^2 = x^3 + ax+b \mod p$)
Options:
C1=(35,1) ; C2 =(21,44)
C1=(44,21) ; C2 =(1,35)
C1=(44,21) ; C2 =(44,21)
C1=(21,44); C2 =(35,1)
None of the above
Answer (0-based option index): 0
Topic: misc
Question: Which of the following best characterizes the mathematical relationship between inputs and outputs in a standard MAC algorithm, considering multiple inputs can lead to the same authentication tag?
Options:
injective (one-to-one) mapping
many-to-one transformation
surjective (onto) mapping
None of the above
Answer (0-based option index): 1
Topic: misc
Question: Given a MAC algorithm with a key of size $k$ bits and an authentication tag of $n$ bits, what is the expected computational effort required for a brute-force attack that attempts to guess either the key or a valid tag?
Options:
$2^k$
$2^n$
$\min(2^k,\ 2^n)$
$\frac{2^k}{2^n}$
None of the above
Answer (0-based option index): 2
Topic: symmetric
Question: What is the estimated number of operations required to generate a collision for a hashing algorithm $\mathbf{H}: \{0, 1\}^* \rightarrow \{0, 1\}^n$ ?
Options:
$\mathcal{O}(2^{n/2})$
$\mathcal{O}(2^n)$
$\mathcal{O}(2^{2n})$
$\mathcal{O}(2^{n-1})$
None of the above
Answer (0-based option index): 0
Topic: asymmetric
Question: In the elliptic curve group defined by $y^2 = x^3 - 17x + 16$ over real numbers, what is $P + Q$ if $P = (0, -4)$ and $Q = (1, 0)$?
Options:
(15, -56)
(-23, -43)
(69, 26)
(12, -86)
None of the above
Answer (0-based option index): 0
Topic: asymmetric
Question: The security of the RSA encryption scheme primarily corresponds to which of the following computationally hard problems?
Options:
The discrete logarithm problem
The problem of factoring large composite integers
Elliptic curve point addition and multiplication
A hybrid of factoring and discrete logarithm problems
Answer (0-based option index): 1
Topic: misc
Question: In the context of cryptographic algorithms, what best describes the avalanche effect?
Options:
A minor change in the plaintext causes a significant change in the ciphertext
Changing both the key and the plaintext simultaneously leads to encryption failure
Changing the key slightly will force a completely different plaintext
A slight change in the ciphertext affects the decryption key
None of the above
Answer (0-based option index): 0
Topic: symmetric
Question: Which of the following is a correct difference between CBC (Cipher Block Chaining) mode and Counter (CTR) mode encryption?
Options:
CBC mode requires padding for partial blocks, whereas CTR mode does not.
CTR mode is inherently sequential and cannot be parallelized, whereas CBC can.
CBC mode allows random access decryption, whereas CTR mode does not.
In CBC mode, encryption can be parallelized, whereas decryption cannot in CTR mode.
None of the above
Answer (0-based option index): 0
Topic: symmetric
Question: Why is it important to use a random Initialization Vector (IV) in CBC mode encryption?
Options:
A random IV prevents leakage of message patterns across different encryptions.
A random IV ensures resistance against chosen plaintext attacks in block cipher ECB mode.
A random IV allows decryption without knowing the key.
A random IV ensures integrity protection of the ciphertext.
None of the above
Answer (0-based option index): 0
Topic: symmetric
Question: When implementing CBC-MAC, which type of IV should be used and why?
Options:
A fixed IV, to guarantee deterministic and repeatable MAC outputs.
No IV is required for CBC-MAC.
A random IV, to ensure non-determinism in message authentication.
A unique IV per message, to prevent replay attacks.
None of the above
Answer (0-based option index): 0
Topic: asymmetric
Question: Given an RSA public key $(N,e)$ and the factorization $N = pq$, how can the secret key $d$ be computed?
Options:
$d = e^{-1} \mod \varphi(N)$, where $\varphi(N) = (p - 1)(q - 1)$
$d = e^{-1} \mod (N - 1)$
$d = ep \mod (q - 1)$
$d = p^{-1} \mod q$
None of the above
Answer (0-based option index): 0
Topic: symmetric
Question: Which of the following best defines a collision-resistant hash function?
Options:
It is hard to find any two distinct inputs $x \neq x'$ such that $H(x) = H(x')$
Given $x$, it is hard to find $y$ such that $H(x) = H(y)$.
No collisions exist for any practical input set.
It is hard to invert the hash output.
None of the above
Answer (0-based option index): 0
Topic: symmetric
Question: If a hash function $H$ is one-way, must it also be collision-resistant?
Options:
No, a function can be one-way yet still allow finding collisions efficiently.
Yes, one-wayness always implies collision resistance.
Yes, since inverting implies finding collisions.
It depends on whether the output length $n$ is large enough.
None of the above
Answer (0-based option index): 0
Topic: math
Question: Let p be a prime such that $p \equiv 2 \pmod{3}$, and let $\alpha \in \mathbb{Z}_p^*$. Which of the following efficiently computes the cube root of $\alpha\pmod{p}$?
Options:
Compute $\alpha^{\frac{2p-1}{3}} \pmod{p}$.
Compute $\alpha^{\frac{p+1}{3}} \pmod{p}$.
Compute $\alpha^{\frac{p-1}{2}} \pmod{p}$.
Cube roots modulo such primes cannot be efficiently computed.
None of the above
Answer (0-based option index): 0
Topic: asymmetric
Question: What is the performance advantage of using a modulus $N' = p'q'r'$ (product of three equal-sized primes) over $N = pq$ in RSA ($\lfloor\log_2(N)\rceil = \lfloor\log_2(N')\rceil$), when employing the Chinese Remainder Theorem (CRT) for decryption?
Options:
CRT does not apply to $N'$.
Decryption is faster due to smaller moduli and exponents.
Decryption is slower due to more primes involved.
Encryption becomes faster, but decryption remains the same.
None of the above
Answer (0-based option index): 1
Topic: misc
Question: Sender $S$ digitally signs a message $m$ using its private key and sends it to receiver $R$. Considering possible cryptographic attacks, who among the following can potentially launch a birthday attack to alter $m$ while maintaining the same hash value?
Options:
Only S
Only a third-party attacker
S and a third-party attacker
Receiver R and a third-party attacker
None of the above
Answer (0-based option index): 0