1. What is the effect of a dropped ciphertext block (e.g., if the transmitted ciphertext c1; c2; c3; · · · is received as c1; c3; · · · ) when using the CBC, OFB, and CTR modes of operation? 2. Let F be a pseudorandome permutation. Consider the mode of operation in which a uniform value ctr 2 f0; 1gn is chosen, and the ith ciphertext block ci is computed as ci := Fk(ctr + i + mi). Show that this scheme does not have indistinguishable encryptions in the presence of an eavesdropper. 3. Consider a variant of CBC-mode encryption where the sender simply increment IV by 1 each time a message is encrypted (rather than choosing IV at random each time). Show that the resulting scheme is not CPA-secure. 4. Present formulas for decryption of all the different modes of encryption we have seen. For which modes can decryption be parallelized?
