yuuwwang/aicrypto huggingface dataset:
Topic: asymmetric
Question: Alice and Bob are in a country with 50 states. Alice is in state $a \in \{1, \ldots, 50\}$ and Bob is in state $b \in \{1, \ldots, 50\}$. Alice wants to determine if she is in the same state as Bob (i.e., if $a=b$) without revealing her state $a$ to Bob if $a \neq b$. Bob should not learn Alice's state $a$ regardless. They agree on the following cryptographic protocol\begin{enumerate} 
\item They fix a public cyclic group $G$ of prime order $p$ with a generator $g \in G$. 
\item Alice chooses random exponents $x, y \in \mathbb{Z}_p$. She computes and sends to Bob the triplet$$ (A_0, A_1, A_2) = (g^x, g^y, g^{xy+a}) $$ 
(Note: $(A_1, A_2)$ can be seen as an ElGamal encryption of $g^a$ under the ephemeral public key $A_0=g^x$, using $y$ as the ephemeral private key, since $A_2 = g^a \cdot (g^x)^y$.) 
\item Bob chooses random exponents $r, s \in \mathbb{Z}_p$. He computes and sends back to Alice the pair$$ (B_1, B_2) = (A_1^r \cdot g^s, (A_2 \cdot g^{-b})^r \cdot A_0^s) $$ 
\end{enumerate} 
After receiving $(B_1, B_2)$ from Bob, what check should Alice perform to test if $a=b$?
Options:
Alice tests if $B_1^x \cdot B_2 = 1$.
Alice tests if $B_2 \cdot B_1^x = 1$.
Alice tests if $B_1 / B_2^x = 1$.
Alice tests if $B_2 / B_1^x = 1$.
None of the above
Answer (0-based option index): 3
Topic: symmetric
Question: Which of the following represents the encryption process of the standard 3DES (Triple-DES) scheme with a 112-bit key?
Options:
$\mathrm{DES}_{k_3}(\mathrm{DES}_{k_2}(\mathrm{DES}_{k_1}(\cdot)))$, where $k_1 = k_3$
$\mathrm{DES}_{k_3}\bigl(\mathrm{DES}_{k_2}^{-1}(\mathrm{DES}_{k_1}(\cdot))\bigr)$, where $k_1 = k_3$
$\mathrm{DES}_{k_3}\bigl(\mathrm{DES}_{k_2}^{-1}(\mathrm{DES}_{k_1}(\cdot))\bigr)$, where $k_1 = k_2$
$\mathrm{DES}_{k_3}(\mathrm{DES}_{k_2}(\mathrm{DES}_{k_1}(\cdot)))$, where $k_1 = k_2$
None of the above
Answer (0-based option index): 1
Topic: misc
Question: Let $M = C = K = \{0, 1, 2, \ldots, 255\}$ and consider the following cipher defined over $(K, M, C)$: $E(k, m) = m + k \pmod{256}$ and $D(k, c) = c - k \pmod{256}$. Does this cipher have perfect secrecy (meaning that the ciphertext conveys no information about the content of the plaintext)?
Options:
No, only the One Time Pad has perfect secrecy.
Yes
No, there is a simple attack on this cipher.
None of the above
Answer (0-based option index): 1
Topic: asymmetric
Question: Let $N=pq$ be an RSA modulus (where $p$ and $q$ are large distinct primes) and let $e$ be an integer such that $\gcd(e, \phi(N))=1$. Consider a hash function $h$ that processes a message $M$ by first parsing it into two blocks, $M = m_1 \| m_2$. These blocks, $m_1$ and $m_2$, are interpreted as integers. The hash function is then defined as$$h(M) = (m_1 \cdot m_2)^e \pmod N$$ 
Is this hash function $h$ collision-resistant?
Options:
Yes, it is collision resistant.
No, it is not collision resistant.
Collision resistance cannot be determined from the information given.
None of the above
Answer (0-based option index): 1
Topic: classic
Question: Given the ciphertext C = eiioqoyldc and the key K = security, what is the original plaintext if the Playfair cipher was used? Assume 'x' is the special character used for padding identical adjacent letters and to complete a final digraph if necessary. Treat 'i' and 'j' as the same character.
Options:
stalxlings
stallings
secrettext
stollings
None of the above
Answer (0-based option index): 0
Topic: symmetric
Question: Alice encrypts a message using a stream cipher. If she accidentally reuses the same keystream to encrypt a second, different message, what is the MOST likely consequence for an attacker who intercepts both ciphertexts?
Options:
The attacker can immediately decrypt both messages.
The attacker can obtain the XOR of the two original plaintexts, potentially revealing information about both.
The security of only the first message is compromised.
The stream cipher automatically detects the reuse and becomes secure again for subsequent communications.
Answer (0-based option index): 1
Topic: classic
Question: For a $n\times n$ Hill cipher over the English alphabet, which is the correct size of its key space?
Options:
$\prod_{i=0}^{n-1}\left((2^n-2^i)\cdot(13^n-13^i)\right)$
$\prod_{i=0}^{n-1}(2^n-2^i) \cdot \prod_{i=0}^{n-1}(13^{n-1}-13^i)$
$\prod_{i=0}^{n-1}(26^n-26^i)$
$\prod_{i=0}^{n-1}26^i$
None of the above
Answer (0-based option index): 0
Topic: asymmetric
Question: For a LWE instance $(A, b)$, where $A \leftarrow \mathcal{U}(\mathbb{Z}_q^{m\times n})$ and $b \equiv As + e \mod q$, which of the following is the most vulnerable parameter setting for algebraic attack (find the correct $s$ from $(A, b)$ through solving equations)? Let $\mathcal{U}(\mathcal{S})$ be the uniform distribution over the set $\mathcal{S}$, and $\mathcal{D}_{\sigma}$ be the discrete Gaussian distribution centered at $0$ with the standard deviation $\sigma$.
Options:
$s \leftarrow \mathcal{D}_{0.5}, e \leftarrow \mathcal{U}(\{0, 1\}^{n})$
$s \leftarrow \mathcal{U}(\{0, 1\}^{n}), e \leftarrow \mathcal{U}(\{0, 1\}^{n})$
$s \leftarrow \mathcal{U}(\{0, 1\}^{n}), e \leftarrow \mathcal{D}_{0.5}$
$s \leftarrow \mathcal{D}_{0.5}, e \leftarrow \mathcal{D}_{0.5}$
None of the above
Answer (0-based option index): 1
Topic: symmetric
Question: The high strength of a synchronous stream cipher mainly depends on which of the following?
Options:
The design of the keystream generator
The key length
The plaintext length
The complexity of the key
None of the above
Answer (0-based option index): 0
1
Topic: misc
Question: Which of the following cryptosystems are vulnerable to quantum attacks up to date?
Options:
RSA
Rabin
AES-256
NTRU
Answer (0-based option index): 0
1
Topic: asymmetric
Question: For a $\lambda$-secure (the time complexity under classic mode is exponential to $\lambda$) RSA instance $(N, p, q, e,d)$, where $gcd(e, \phi(N)) = 1, \, ed\equiv 1 \mod \phi(N)$. Which of the following cases are vulnerable RSA instances?
Options:
small $d$ such that $N^{1/8} < d < N^{1/4}$
approximate $p, q$ such that $|p-q| < poly(\lambda)$
small $e$ such that $N^{1/8} < e < N^{1/4}$
the leakage of a past key $(e', d')$ such that $e'\neq e, e'd'\equiv 1 \mod \phi(N)$
Answer (0-based option index): 0
1
3
Topic: misc
Question: Which encryption schemes utilize different keys for encryption and decryption?
Options:
Shift cipher
RSA
Advanced Encryption Standard
Data Encryption Standard
ElGamal scheme
Secure Hash Algorithm
Answer (0-based option index): 1
4
Topic: math
Question: Factor the polynomial $x^4 + 1$ in GF(2)
Options:
Cannot be factored in GF(2)
Factors as $(x^2 + 1)^2$
Factors as $(x + 1)^4$
Already in simplest form
Answer (0-based option index): 1
2
Topic: symmetric
Question: Which statements about block cipher modes are correct?
Options:
CBC XORs plaintext with previous ciphertext
CTR doesn't need IV
CBC's last block uses IV
CBC hides plaintext patterns
Answer (0-based option index): 0
3
Topic: asymmetric
Question: What is true about public key message encryption?
Options:
Encrypt with recipient's public key
Encrypt with sender's public key
Decrypt with sender's public key
Decrypt with recipient's private key
Answer (0-based option index): 0
3
Topic: symmetric
Question: Which of the following are essential characteristics of a secure cryptographic hash function?
Options:
Support for revoking keys
Resistance to hash collisions
Deterministic behavior for any given input
Unique one-to-one mapping between inputs and outputs
Computational difficulty in finding a preimage for a given hash
Answer (0-based option index): 1
2
4
Topic: misc
Question: SuperMail wants to ensure that all outgoing emails are authenticated and tamper-proof. Alice wishes to send a message \( M \) to Bob. Let \( K_B \) be Bob's public key and \( K_A^{-1} \) be Alice's private signing key. Based on SuperMail's security goals, which methods are appropriate for ensuring authenticity and integrity?
Options:
Encrypt \( M \) using Bob's public key: \( E_{K_B}(M) \)
Transmit \( M \) along with a digital signature generated with Alice's private key: \( M, \text{Sign}_{K_A^{-1}}(M) \)
Generate a symmetric key \( k \), send \( E_{K_B}(k) \), and send \( M \oplus \text{RC4}(k) \)
Generate a symmetric key \( k \), send \( E_{K_B}(k) \), and \( \text{AES-CBC-Encrypt}_k(M) \)

Generate a symmetric key \( k \); send \( M, \text{MAC}_k(M), E_{K_B}(k), \text{Sign}_{K_A^{-1}}(E_{K_B}(M) || E_{K_B}(k)) \)
Answer (0-based option index): 1
4
Topic: misc
Question: Alice needs to securely send a private email \( M \) to Bob. Let \( K_B \) be Bob's public key and \( K_A^{-1} \) be Alice's private signing key. Which methods protect confidentiality while ensuring authenticity?
Options:
Send \( E_{K_B}(M), \text{Sign}_{K_A^{-1}}(K_B) \)
Send \( E_{K_B}(M), \text{Sign}_{K_A^{-1}}(M) \)
Send \( E_{K_B}(M), \text{Sign}_{K_A^{-1}}(E_{K_B}(M)) \)
Generate a symmetric key \( k \); send \( E_{K_B}(k), \text{Sign}_{K_A^{-1}}(E_{K_B}(k)) \), and then encrypt \( M \) with \( k \)

Generate two keys \( k_1, k_2 \); send \( E_{K_B}(k_1||k_2), \text{Sign}_{K_A^{-1}}(E_{K_B}(k_1||k_2)) \), $E_{k_1}(M || \text{MAC}_{k_2}(M))$
Answer (0-based option index): 2
4
Topic: asymmetric
Question: In the RSA encryption scheme, after selecting two large numbers $p$ and $q$, which of the following must be true about their properties?
Options:
$p$ and $q$ must be prime numbers
$p$/$q$ must yield an integer quotient
$p$ and $q$ should divide $\phi(n)$
$p$ and $q$ must be co-prime
Answer (0-based option index): 0
3
Topic: symmetric
Question: Differential cryptanalysis is a method of analyzing which type of cipher algorithm?
Options:
DES
AES
RSA
Rabin
Answer (0-based option index): 0
1
Topic: misc
Question: Let $(E, D)$ be a (one-time) semantically secure cipher where the message and ciphertext space is $\{0,1\}^n$. Which of the following encryption schemes are (one-time) semantically secure? (Select all that apply)
Options:
Scheme 1: $E'(k, m) = E(0^n, m)$
Scheme 2: $E'((k,k'), m) = E(k,m) \| E(k', m)$, where $k \neq k'$
Scheme 3: $E'(k,m) = E(k,m) \| \text{LSB}(m)$
Scheme 4: $E'(k,m) = 0 \| E(k,m)$
Scheme 5: $E'(k,m) = E(k,m) \| k$
Scheme 6: $E'(k,m) = \text{reverse}(E(k,m))$
Answer (0-based option index): 1
3
5
Topic: symmetric
Question: Let $F: \{0,1\}^n \times \{0,1\}^n \to \{0,1\}^n$ be a secure PRF (i.e., a PRF where the key space, input space, and output space are all $\{0,1\}^n$) and say $n = 128$. Which of the following constructions are secure PRFs? (Select all that apply)
Options:
$F'(k, x) = \begin{cases} F(k,x) & \text{when } x \neq 0^n \\ 0^n & \text{otherwise} \end{cases}$
$F'(k,x) = F(k,x)[0,\ldots,n-2]$ (i.e., $F'(k,x)$ drops the last bit of $F(k,x)$)
$F'((k_1,k_2), x) = F(k_1,x) \| F(k_2,x)$ (here $\|$ denotes concatenation, and $k\neq k'$)
$F'(k, x) = k \oplus x$
$F'(k,x) = F(k, x) \oplus F(k, x \oplus 1^n)$
$F'(k,x) = F(k, x \oplus 1^n)$
Answer (0-based option index): 1
2
5
Topic: misc
Question: Let $(S, V)$ be a secure MAC defined over $(K, M, T)$ where $K =\{0, 1\}^{128}, M = \{0,1\}^n$, and $T = \{0,1\}^{128}$. Which of the following constructions are secure MACs? (Select all that apply. $k\in K, m\in M, \, t \in T$)
Options:
$S'(k,m) = S(k, m \oplus m)$ and $V'(k,m,t) = V(k, m \oplus m, t)$
$S'(k,m) = S(k,m)$ and $V'(k,m,t) = [V(k, m, t) \text{ or } V(k, m \oplus 1^n, t)]$
$S'(k,m) = S(k, m[0,\ldots,n-2] \| 0)$ and $V'(k,m,t) = V(k, m[0,\ldots,n-2] \| 0, t)$

$S'((k_1,k_2), m) = (S(k_1,m), S(k_2,m))$ and \\
$V'((k_1,k_2),m,(t_1,t_2)) = [V(k_1,m,t_1) \text{ and } V(k_2,m,t_2)]$

$S'(k,m) = S(k, m \| m)$ and $V'(k,m,t) = V(k, m \| m, t)$
$S'(k,m) = S(k, m \oplus 1^n)$ and $V'(k,m,t) = V(k, m \oplus 1^n, t)$
Answer (0-based option index): 3
5
Topic: symmetric
Question: Let $H: \{0, 1\}^* \rightarrow \{0, 1\}^l$ be a collision resistant hash function, where $l > 32$. Which of the following constructions are collision resistant?
Options:
$H'(m) = H(|m|)$ (i.e., hash the length of $m$)
$H'(m) = H(0)$
$H'(m) = H(m) \| H(0)$
$H'(m) = H(m)[0,\ldots,31]$ (i.e., output the first 32 bits of the hash)
$H'(m) = H(H(m))$
$H'(m) = H(m \| m)$
$H'(m) = H(m) \oplus H(m \oplus 1^{|m|})$ (where $m \oplus 1^{|m|}$ is the complement of $m$)
Answer (0-based option index): 2
4
5
Topic: misc
Question: Let $(E,D)$ be an encryption system with key space $K$, message space $\{0,1\}^n$ and ciphertext space $\{0,1\}^s$. Suppose $(E, D)$ provides authenticated encryption. Which of the following systems provides authenticated encryption?
Options:
$E'(k,m) = (E(k,m), H(m))$ and $D'(k,(c,h)) = \begin{cases} D(k,c) & \text{if } H(D(k,c)) = h \\ \perp & \text{otherwise} \end{cases}$ \\
(here $H$ is some collision-resistant hash function.)

$E'((k_1,k_2),m) = E(k_2, E(k_1,m))$ and \\
$D'((k_1,k_2), c) = \begin{cases} D(k_1,D(k_2,c)) & \text{if } D(k_2,c) \neq \perp \\ \perp & \text{otherwise} \end{cases}$

$E'(k,m) = (E(k,m), 0)$ and $D'(k,(c,b)) = D(k,c)$
$E'(k,m) = E(k, m \oplus 1^n)$ and $D'(k,c) = \begin{cases} D(k,c) \oplus 1^n & \text{if } D(k,c) \neq \perp \\ \perp & \text{otherwise} \end{cases}$
Answer (0-based option index): 1
3