Exercise 2 (The RSA Signature Scheme (. Consider the "textbook" RSA signature scheme as a prototype of a public-key signature scheme. 1. Describe how Bob should verify Alice's signatures on a message M. 2. Define the various security definitions for signature schemes. 3. Suppose that the hash function H used in the scheme is not preimage resistant. Describe an attack on the "textbook" RSA signature scheme. 4. Suppose now that H is not 2nd preimage resistant. Describe an attack on the "textbook" RSA signature scheme. 5. Finally, suppose that H is not collision resistant. Describe an attack on the "textbook" RSA signature scheme.

2.  Recall the concept of Physically Unclonable Functions, which are an importantcomponent of hardware based security. Here is a simple scenario and simple protocol usingPUFs for authenticating a tag. In the protocol below, the Reader stores ALL possiblecombinations of Challenge-Response pairs for every tag it needs to authenticate. Duringauthentication, the Reader broadcasts the ID of the tag, and a greeting (Gn ). Every tag maysee this message, but only the one with the right ID will process the message. The right tagwith the ID in the message will then feed the greeting to its PUF and compute the responseSn. The response is then sent to the Reader. This should be clear from the Figure below. Forthe next round of authenticating the same Tag, the process repeats with a new Greeting(G n+1 ). Since the Reader has the responses, authentication is straightforward. Recall thatChallenges and Responses are typically 128 or 256 bit strings for RFIDs.From the protocol, and class, it should be…

Find out what risks are involved with the various authentication techniques and suggest a way to deal with the following situation.Bob uses a cryptographic hash function to check a password against a cache of other hashes.Bob performs a cryptographic hash on a password and checks it against a database of previously double-hashed passwords.

1. Describe the steps of the Existential Forgery Attack against RSA Digital Signature as discussed in the class. Then answer whether it is possible for the attacker, Oscar, to create a message as he wishes with the correct signature signed by Bob. Why?

Question 1. Let H: {0,1}* → {0, 1}" be a hash function that achieves the one-way and collision resistance security properties. (b). Show that the new function H' achieves collision resistance. Suppose that we want to use H for the deployment of a password-based user authentication mechanism that is a variant of the standard password hashing mechanism as follows: when loading a new password P selected by the user with ID U, instead of choosing a random salt, the password P is hashed. Then, the n-bit digest H(P) and password P serve as inputs to produce a fixed-length hash code. Namely, the information that is stored in the password file is the triple (U, H(P), H(H(P)||P)). During password verification for user ID U, the system receives a password P* and (i) computes H(P*), (ii) computes H(H(P*)||P*), and (iii) checks if H(H(P*)||P*) matches the value H(H(P)||P) that is stored for U. 1 Does the aforementioned mechanism provide protection against offline dictionary attacks? Justify your…

Are there any differences between a Key Derivation Function (KDF) and the family of secure hash functions known as the SHA family? In order to make your message absolutely clear, include as much information as is necessary.