Clarifications on the exam

The hint for Problem 5 is missing in the problem text in Inspera. Please refer to the full text PDF to see the hint for Problem 5.

Here are some clarifications on some of the specific exam questions:

• In Problem 4, the nonce is not considered part of the ciphertext. Thus, if you send (N, C), where N is the nonce and C is the ciphertext output by Sigma, then you don't have to worry about this breaking the nAE security of the scheme. This is implicitly encoded in the nAE game given in the text, but I just wanted to make this clear.
• In Problem 5 (on Inspera) there is a missing A in the sentence: "... (assuming is not taking exponential time). ".
  The correct should be: "...(assuming A is not taking exponential time).
• Also in Problem 5, to clarify: A is only able to solve the RSA-problem on a 1%-sized subset of Z_n^*, thus, it always succeeds on this subset, and always fails if not in this subset.
• In Problem 7, the calls "CalcSHA1", "CheckServerSig", etc., all return an integer valued error code. If they fail, i.e., if the verification didn't succeed, then they return a non-zero error code. Else they return 0.