Recent Forum Posts
 From categories: All categories News: Course News, Fall 2017/2018 Forum: Course Forum, Fall 2017/2018
page 1123...next »
15 Mar 2018 13:41
in discussion Forum / Course Forum, Fall 2017/2018 » Moed B subjects

Yes and yes.

Re: Moed B subjects by , 15 Mar 2018 13:41
student (guest) 07 Mar 2018 10:15
in discussion Forum / Course Forum, Fall 2017/2018 » Moed B subjects

Hey nir, In moed A you stated on the forum that subjects from last lectures wont be in the exam: FHE, FE, IO, CCA security. Is this holds also for moed b?

Moreover - does the exam style will be similar to moed a?
Thanks!

Moed B subjects by student (guest), 07 Mar 2018 10:15

A reference solution for Moed A can be found here.

Reference solution for Moed A by , 15 Feb 2018 19:59

A reference solution for assignment 6 can be found here.

Reference solution for assignment 6 by , 15 Feb 2018 19:56
05 Feb 2018 19:34
in discussion Forum / Course Forum, Fall 2017/2018 » HW6 Q3a

No mistake.
The goal here is to show that the adversary cannot turn an encryption of an unknown message to an encryption of a related message.
So intuitively, we want to say that if the adversary can turn an encryption of m to an encryption of f(m), then it in fact turns anything to an encryption of f(m), which is something we may not be able to prevent.

Re: HW6 Q3a by , 05 Feb 2018 19:34
Evyatar (guest) 05 Feb 2018 19:32
in discussion Forum / Course Forum, Fall 2017/2018 » HW6 Q3a

It's actually much easier the way it is stated in the HW now, so I hope it was not a mistake

by Evyatar (guest), 05 Feb 2018 19:32
Evyatar (guest) 05 Feb 2018 14:43
in discussion Forum / Course Forum, Fall 2017/2018 » HW6 Q3a

In Question 3 about CCA-security, we have to prove the difference between two probabilities is negligible.
I think there is a mistake in the second term, and it should be $f_n(m')$ instead of $f_n(m)$.

HW6 Q3a by Evyatar (guest), 05 Feb 2018 14:43
Omer Benami (guest) 03 Feb 2018 12:05
in discussion Forum / Course Forum, Fall 2017/2018 » Exams solutions

2014b 2a: I think it's the same construction as HW4 question 1b (the bonus question)

by Omer Benami (guest), 03 Feb 2018 12:05
Nathan (guest) 03 Feb 2018 09:28
in discussion Forum / Course Forum, Fall 2017/2018 » Exams solutions

2014b 3: If the prover sends the verifier an encryption of the witness using some PKE scheme, it certainly isn't a zero-knowledge protocol, but the randomness of V* can be easily simulated using Gen, and the transcript can also be easily simulated because of the security of the PKE scheme.

by Nathan (guest), 03 Feb 2018 09:28
Mr. Exam (guest) 03 Feb 2018 08:00
in discussion Forum / Course Forum, Fall 2017/2018 » Exams solutions

Did anyone manage to solve the following and can share their answers?
2014b: 2.a
2014b: 3.

by Mr. Exam (guest), 03 Feb 2018 08:00
01 Feb 2018 21:30
in discussion Forum / Course Forum, Fall 2017/2018 » Exams solutions

The definition of CCA from hw6 coincides with CCA2.
I won't ask about CCA in the exam though.

by , 01 Feb 2018 21:30
01 Feb 2018 21:29
in discussion Forum / Course Forum, Fall 2017/2018 » Exams solutions

I'm afraid it's too late to ask for that now.

Re: Exams solutions by , 01 Feb 2018 21:29

It won't.

Re: Subjects from the last lectures by , 01 Feb 2018 21:27

The point is that the actual simulator that we construct doesn't get the witness.
The challenge is to show that its output is indistinguishable from a real proof $(P(w),V^*)(x)$.
To do this we consider a hybrid simulator $S'(w)$ that is essentially between the two, it behaves the same as $S$ only that instead of the zero commitments, it puts commitments that are consistent with $w$ etc. You can show that the proof generated by $S'$ is computationally ind from that of $S$ using the hiding of the commitments. Then you show that $S'$ is distributed identically to $(P(w),V^*)(x)$.

Re: Question re Sim in ZKP by , 01 Feb 2018 21:26
Omer Benami (guest) 01 Feb 2018 20:59
in discussion Forum / Course Forum, Fall 2017/2018 » Subjects from the last lectures

Hi,
I was wondering if the material from HW6 (FHE, FE, and IO) will be on the test. The previous tests didn't touch on this material, and the solutions for Homework 6 won't be published until after the exam.

Subjects from the last lectures by Omer Benami (guest), 01 Feb 2018 20:59
student (guest) 01 Feb 2018 17:20
in discussion Forum / Course Forum, Fall 2017/2018 » Exams solutions

and regarding exam 2017, should we ignore both questions about "CCA1", "CCA2",
or to answer the question only under our definition of CCA?

by student (guest), 01 Feb 2018 17:20
student (guest) 01 Feb 2018 15:57
in discussion Forum / Course Forum, Fall 2017/2018 » Exams solutions

Nir, can you please upload solution to the givens exams?

Exams solutions by student (guest), 01 Feb 2018 15:57
student (guest) 01 Feb 2018 08:49
in discussion Forum / Course Forum, Fall 2017/2018 » Question re Sim in ZKP

When proving security of the GMW protocol, we imagined an intermidiate sim S' which learns a witness. We claimed that such S' can output a view which is identically distributed as V*'s view. There was some explanation as to why this is true (conditioning on a choice of e, etc.).

My question is: assuming S' learns a witness, isn't it sufficient to claim the following general claim (not speicific to 3COL or the GMW protocol):

S' can output a view which is identically distributed as V*'s view, because it can run a full simulation of the protocol, i.e. simulate <P(w),V*>(x).

Question re Sim in ZKP by student (guest), 01 Feb 2018 08:49
31 Jan 2018 14:44
in discussion Forum / Course Forum, Fall 2017/2018 » HW6 Q1

In $[-B,B]$ as we defined in class.

by , 31 Jan 2018 14:44
Evyatar (guest) 31 Jan 2018 14:05
in discussion Forum / Course Forum, Fall 2017/2018 » HW6 Q1

Is $\chi$ between 0 and $B$ or between $-B$ and $B$?

by Evyatar (guest), 31 Jan 2018 14:05
page 1123...next »