Name: 名称：sIDIt will be highly suggested to use LaTeX or MS Word to type in your answer; if you have 强烈建议使用 LaTeX 或 MS Word 输入您的答案；如果您有to scan your handwriting, please make sure your handwriting is clearly recognizable. 请确保您的手写字迹清晰可辨，以便扫描。
Q1. (5 points) Give one concrete example that follows the "security via obscurity" idea, and explain why it may fail to work. Q1. (5 分) 给出一个具体的例子，说明“通过模糊性实现安全”的理念，并解释为什么它可能会失败。
Q2. (10 points) PKI provides a digital certification system. Each certification basically contains the information of valid - period algorithm metadata together with a signature of CA. (1) Could we just use an MAC to generate ? please briefly explain. (2) Root CA needs to be very careful about his secret key which is the root trust of the whole PKI system. He may choose to be offline, and introducing a bunch of intermediate CAs to interact with the users who are requesting certificates. At the system setup phase, he issues certificates for each of the and let those intermediate CAs to generate certificates. Essentially any certificate generated by any of the is considered valid. Another solution is for the CA to split his root secret into pieces and stored in different machines, and leverage a threshold certification generation procedure that only when machines respond with a valid certificate share, user can combine and obtain a valid certificate. Which of the two solutions is more vulnerable (or requiring more trust)? please briefly explain. Q2. (10 分) PKI 提供了一个数字认证系统。每个认证基本上包含 有效期 算法 元数据以及 CA 的签名 。(1) 我们能否仅使用 MAC 来生成 ？请简要解释。(2) 根 CA 需要非常小心他的秘密密钥，因为这是整个 PKI 系统的根信任。他可以选择离线，并引入一批中间 CA 与请求证书的用户进行交互。在系统设置阶段，他为每个 颁发证书，并让这些中间 CA 生成证书。实际上，任何由 中的任何一个生成的证书都被视为有效。另一种解决方案是 CA 将他的根秘密分割成 份，并存储在 台不同的机器上，并利用一个阈值认证生成程序，只有当 台机器响应有效的证书共享时，用户才能组合并获得有效证书。哪种解决方案更脆弱（或需要更多信任）？请简要解释。
Q3. (10 points) Self-referential encryption. Normally, encryption is used only on messages that are independent of the secret key, thus security guarantee implicitly assumes this. However, situations may arise due to careless key management, for example a backup system may store the backup encryption key on disk and then encrypt the entire disk, including the key, and backup the result. Another example is the BitLocker disk encryption utility (used in WindowsVista) where the disk encryption key can end up on disk and be encrypted along with the disk contents. In those cases, adversary obtains normal ciphertext that encrypting some content, as well as a special token (using the same key to encrypt the key itself as a message). It might be possible to specially design encryption and strengthen the security to handle this, but conventional encryptions may not be safe to be directly used this way. Q3.（10 分）自引用加密。通常，加密仅用于与秘密密钥无关的消息，因此安全保证隐含地假设这一点。然而，由于不当的密钥管理，可能会出现一些情况，例如备份系统可能会将备份加密密钥存储在磁盘上，然后加密整个磁盘，包括密钥，并备份结果。另一个例子是 BitLocker 磁盘加密工具（用于 Windows Vista），其中磁盘加密密钥可能会存储在磁盘上，并与磁盘内容一起加密。在这些情况下，对手获得正常的密文 ，该密文加密了一些内容，以及一个特殊的令牌 （使用相同的密钥加密密钥本身作为消息）。可能有可能特别设计加密并增强安全性以处理这种情况，但传统加密可能不安全，不能直接以这种方式使用。
Design an IND-CPA secure encryption that can be easily broken when used this way, and briefly analyze why it is IND-CPA secure when is not present, and why it is broken when is also given. (Hint: you do not need to worry about any mathematical details, just use an IND-CPA encryption as a blackbox and modify a bit). 设计一个 IND-CPA 安全的加密方案，当以这种方式使用时可以很容易被破解，并简要分析为什么在没有 的情况下它是 IND-CPA 安全的，以及为什么在给出 时它被破解。（提示：您不需要担心任何数学细节，只需将 IND-CPA 加密视为黑箱并稍作修改）。
Q4. (10 points) Searchable encryption and IND-CPA security. As you have seen in the class, the ciphertext of IND-CPA security of public key encryption does not leak any single bit of information. Now consider encrypted database entries , where for a message . The database manager still wants to support basic database operations such as search, sort and more. Suppose we design a special order preserving encryption which satisfies that