Skip to content
CampusPrep
CS-703 (A) · Cryptography & Information Security/Quick Revision Short Notes

Cryptography & Information Security (CS-703 (A)) - Unit 2 Short Notes

How unit 2 is examined

This unit covers AES and the public-key toolkit: Diffie-Hellman, RSA, Schnorr, elliptic curves and CRT; marks sit in Diffie-Hellman, RSA, AES and CRT.

Advanced Encryption Standard (AES)

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Medium weight</span>

Definition. <mark>AES (Rijndael) is a symmetric, iterated block cipher that encrypts a 128-bit block using a 128, 192 or 256-bit key in 10, 12 or 14 rounds.</mark>

Diagram. <figure class="ds-fig" style="margin:1.4rem 0;overflow-x:auto"><svg xmlns="http://www.w3.org/2000/svg" id="dsfig-u2-01" viewBox="0 0 510 252" width="510" height="252" role="img" aria-label="AES encryption. PT plaintext, K0 initial AddRoundKey, SB SubBytes, SR ShiftRows, MC MixColumns, KR round AddRoundKey (Nr-1 rounds loop), last round has no MixColumns, CT ciphertext. Decryption runs the inverse steps in reverse order."><style>#dsfig-u2-01 .e{stroke:#454C5A;stroke-width:1.4;fill:none}#dsfig-u2-01 .e.hi{stroke:#2340B8;stroke-width:2.6}#dsfig-u2-01 .n{fill:#FFFFFF;stroke:#16181D;stroke-width:1.4}#dsfig-u2-01 .n.hi{fill:#E3E9FC;stroke:#2340B8;stroke-width:2.2}#dsfig-u2-01 .n.rb-b{fill:#16181D;stroke:#16181D}#dsfig-u2-01 .n.rb-r{fill:#BD3227;stroke:#BD3227}#dsfig-u2-01 text{font-family:"JetBrains Mono",ui-monospace,Menlo,Consolas,monospace;font-size:13px}#dsfig-u2-01 .t{fill:#16181D;font-weight:500}#dsfig-u2-01 .t.inv{fill:#FFFFFF;font-weight:700}#dsfig-u2-01 .kd{stroke:#16181D;stroke-width:1.2}#dsfig-u2-01 .dot{fill:#16181D}#dsfig-u2-01 .ann{fill:#2340B8;font-size:11px;font-weight:700}#dsfig-u2-01 .lbl{fill:#6F7787;font-family:system-ui,-apple-system,sans-serif;font-size:12px;font-weight:700}#dsfig-u2-01 .ptr{fill:#2340B8;font-size:12px;font-weight:700}#dsfig-u2-01 .ah{fill:#454C5A}#dsfig-u2-01 .ah.hi{fill:#2340B8}#dsfig-u2-01 .wl rect{fill:#FFFFFF;stroke:#DCE0E7}#dsfig-u2-01 .wl .t{font-size:12px;font-weight:700}#dsfig-u2-01 .wl.hi rect{fill:#2340B8;stroke:#2340B8}#dsfig-u2-01 .wl.hi .t{fill:#FFFFFF}html.dark #dsfig-u2-01 .e{stroke:#B1B7C3}html.dark #dsfig-u2-01 .e.hi{stroke:#8FA3FF}html.dark #dsfig-u2-01 .n{fill:#161920;stroke:#E6E8ED}html.dark #dsfig-u2-01 .n.hi{fill:#1E2748;stroke:#8FA3FF}html.dark #dsfig-u2-01 .n.rb-b{fill:#E6E8ED;stroke:#E6E8ED}html.dark #dsfig-u2-01 .n.rb-r{fill:#FF7E71;stroke:#FF7E71}html.dark #dsfig-u2-01 .t{fill:#E6E8ED}html.dark #dsfig-u2-01 .t.inv{fill:#0F1115}html.dark #dsfig-u2-01 .kd{stroke:#E6E8ED}html.dark #dsfig-u2-01 .dot{fill:#E6E8ED}html.dark #dsfig-u2-01 .ann{fill:#8FA3FF}html.dark #dsfig-u2-01 .lbl{fill:#858D9C}html.dark #dsfig-u2-01 .ptr{fill:#8FA3FF}html.dark #dsfig-u2-01 .ah{fill:#B1B7C3}html.dark #dsfig-u2-01 .ah.hi{fill:#8FA3FF}html.dark #dsfig-u2-01 .wl rect{fill:#161920;stroke:#2A2E37}html.dark #dsfig-u2-01 .wl.hi rect{fill:#8FA3FF;stroke:#8FA3FF}html.dark #dsfig-u2-01 .wl.hi .t{fill:#0F1115}</style><defs><marker id="ah5" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="ah" d="M0,1 L9,5 L0,9 z"/></marker><marker id="ahh5" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path class="ah hi" d="M0,1 L9,5 L0,9 z"/></marker></defs><path class="e" d="M59,40 L105,40" marker-end="url(#ah5)"/><path class="e" d="M145,40 L191,40" marker-end="url(#ah5)"/><path class="e" d="M231,40 L277,40" marker-end="url(#ah5)"/><path class="e" d="M317,40 L363,40" marker-end="url(#ah5)"/><path class="e" d="M403,40 L449,40" marker-end="url(#ah5)"/><path class="e" d="M451,40 L233,40" marker-end="url(#ah5)"/><path class="e" d="M454.2,50.5 L229.5,200.4" marker-end="url(#ah5)"/><path class="e" d="M231,212 L277,212" marker-end="url(#ah5)"/><path class="e" d="M317,212 L363,212" marker-end="url(#ah5)"/><path class="e" d="M403,212 L449,212" marker-end="url(#ah5)"/><g class="wl"><rect x="296.3" y="31" width="89.4" height="18" rx="9"/><text class="t" x="341" y="40" dy=".35em" text-anchor="middle">Nr-1_rounds</text></g><circle class="n" cx="40" cy="40" r="18"/><text class="t" x="40" y="40" dy=".35em" text-anchor="middle">PT</text><circle class="n" cx="126" cy="40" r="18"/><text class="t" x="126" y="40" dy=".35em" text-anchor="middle">K0</text><circle class="n" cx="212" cy="40" r="18"/><text class="t" x="212" y="40" dy=".35em" text-anchor="middle">SB</text><circle class="n" cx="298" cy="40" r="18"/><text class="t" x="298" y="40" dy=".35em" text-anchor="middle">SR</text><circle class="n" cx="384" cy="40" r="18"/><text class="t" x="384" y="40" dy=".35em" text-anchor="middle">MC</text><circle class="n" cx="470" cy="40" r="18"/><text class="t" x="470" y="40" dy=".35em" text-anchor="middle">KR</text><circle class="n" cx="212" cy="212" r="18"/><text class="t" x="212" y="212" dy=".35em" text-anchor="middle">SB2</text><circle class="n" cx="298" cy="212" r="18"/><text class="t" x="298" y="212" dy=".35em" text-anchor="middle">SR2</text><circle class="n" cx="384" cy="212" r="18"/><text class="t" x="384" y="212" dy=".35em" text-anchor="middle">KN</text><circle class="n" cx="470" cy="212" r="18"/><text class="t" x="470" y="212" dy=".35em" text-anchor="middle">CT</text></svg><figcaption style="font-size:.82em;opacity:.72;margin-top:.45rem">AES encryption. PT plaintext, K0 initial AddRoundKey, SB SubBytes, SR ShiftRows, MC MixColumns, KR round AddRoundKey (Nr-1 rounds loop), last round has no MixColumns, CT ciphertext. Decryption runs the inverse steps in reverse order.</figcaption></figure>

Key points.

  1. The 128-bit block is arranged as a $4 \times 4$ byte state array filled column by column, and all operations work on this state.
  2. Key size 128/192/256 bits gives $N_k = 4/6/8$ words and $N_r = 10/12/14$ rounds; the key schedule makes $4(N_r+1)$ words (44, 52, 60).
  3. SubBytes replaces each byte by its S-box value (multiplicative inverse in $GF(2^8)$ plus an affine map); it is the only non-linear step.
  4. ShiftRows rotates row $i$ of the state left by $i$ bytes (row 0 unchanged), which spreads bytes across columns.
  5. MixColumns multiplies each column by a fixed matrix over $GF(2^8)$, giving diffusion inside the column; it is skipped in the last round.
  6. AddRoundKey XORs the state with the 128-bit round key; it is applied once before round 1 and at the end of every round.
  7. Key expansion: the first $N_k$ words are the key; each later word is $w[i] = w[i-N_k] \oplus temp$, where for $i \bmod N_k = 0$, $temp = \text{SubWord}(\text{RotWord}(w[i-1])) \oplus Rcon$, otherwise $temp = w[i-1]$.
  8. Decryption uses the inverse transformations InvShiftRows, InvSubBytes, AddRoundKey and InvMixColumns, with the round keys in reverse order.

Answer frame. Open with the definition and the parameter table (block 128, key 128/192/256, rounds 10/12/14); draw the round diagram; develop points 1-6 in the order state, SubBytes, ShiftRows, MixColumns, AddRoundKey, then key expansion (point 7); close with decryption as the inverse (point 8) and the last round having no MixColumns.

Asked: [7 marks] (Nov 2022, Dec 2025) Give the structure of AES. Explain how Encryption/Decryption is done in AES. Write down its key expansion and round transformation steps.

Introduction to Public Key Cryptosystem

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Not asked since 2022</span>

Definition. <mark>A public key (asymmetric) cryptosystem uses a pair of keys: a public key to encrypt or verify and a private key to decrypt or sign.</mark>

Key points.

  1. It rests on trapdoor one-way functions, easy to compute forward but infeasible to invert without the private key.
  2. It solves key distribution, since only the public key is shared, and needs $2n$ keys for $n$ users against $n(n-1)/2$ for symmetric.
  3. It gives confidentiality (encrypt with the receiver's public key) and authentication (sign with own private key).
  4. It is slower than symmetric ciphers, so it usually only exchanges a session key. Examples: RSA, Diffie-Hellman, ECC.

Discrete Logarithmic Problem

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Not asked since 2022</span>

Definition. <mark>Given a prime $p$, a primitive root $g$ and $y$, the discrete logarithm problem is to find $x$ with $y \equiv g^x \pmod p$.</mark>

Key points.

  1. Computing $y = g^x \bmod p$ is fast by square-and-multiply, but finding $x$ from $y$ has no known efficient algorithm for large $p$.
  2. This one-way behaviour underlies Diffie-Hellman, ElGamal, DSA and Schnorr.
  3. Best attacks are baby-step giant-step and index calculus, so $p$ should be at least 2048 bits.
  4. The same problem on elliptic curves (ECDLP) is harder still.

Diffie-Hellman Key Exchange, CDH and DDH

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">High weight</span>

Definition. <mark>Diffie-Hellman lets two parties agree on a shared secret over an insecure channel using public values $q$ and $\alpha$, without ever sending the secret.</mark>

Steps.

Step 1: Publicly agree on prime q and a primitive root alpha of q.
Step 2: A picks private X_A < q and sends Y_A = alpha^X_A mod q.
Step 3: B picks private X_B < q and sends Y_B = alpha^X_B mod q.
Step 4: A computes K = (Y_B)^X_A mod q; B computes K = (Y_A)^X_B mod q.

Key points.

  1. Both sides get the same key because $K = (\alpha^{X_B})^{X_A} = \alpha^{X_A X_B} = (\alpha^{X_A})^{X_B} \pmod q$.
  2. An eavesdropper sees $q, \alpha, Y_A, Y_B$ but must solve the discrete logarithm problem to get $X_A$ or $X_B$.
  3. CDH (Computational DH): given $g, g^a, g^b$, compute $g^{ab}$.
  4. DDH (Decisional DH): given $g, g^a, g^b, Z$, decide whether $Z = g^{ab}$ or a random element.
  5. Solving DLP solves CDH, and solving CDH solves DDH, so DDH is the weakest assumption; the reverse implications are not known to hold.
  6. The plain protocol is unauthenticated, so a man-in-the-middle can run two exchanges with A and B; authentication with signatures or certificates prevents it.

Example (Nov 2022, Jun 2025). Given $q=11$, $\alpha=5$, $X_A=2$, $X_B=3$.

Step Working Result
$Y_A = 5^2 \bmod 11$ $25 - 22$ 3
$Y_B = 5^3 \bmod 11$ $125 - 121$ 4
$K$ at A: $Y_B^{X_A} = 4^2 \bmod 11$ $16 - 11$ 5
$K$ at B: $Y_A^{X_B} = 3^3 \bmod 11$ $27 - 22$ 5

$Y_A = 3,\ Y_B = 4,\ K = 5$. For $q=353$, $\alpha=3$, $X_A=45$, $X_B=50$: $Y_A = 3^{45} \bmod 353 = 143$, $Y_B = 3^{50} \bmod 353 = 155$, and $K = 155^{45} \bmod 353 = 143^{50} \bmod 353 = $ 197.

Answer frame. For the explain question, open with the definition, list the global parameters and the four steps, prove both keys equal, then state CDH and DDH, and close with the man-in-the-middle weakness. For the numerical, write the two formulas, substitute, check both $K$ values match and box the answer.

Pitfall: Compute $Y_B^{X_A}$ with A's private key, not B's; a mismatch means an arithmetic slip.

Asked: [14 marks] (Nov 2022, Jun 2025) User A and B exchange the key using Diffie-Hellman with $\alpha = 5, q = 11, X_A = 2, X_B = 3$. Find $Y_A, Y_B$ and $K$. Also find the shared key for $q = 353$, $\alpha = 3$, $X_A = 45$, $X_B = 50$. Asked: [7 marks] (Nov 2023, Dec 2025) How to establish a shared secret between two parties using Diffie-Hellman key exchange? Discuss it and define the Computational and Decisional Diffie-Hellman problems.

RSA Assumptions and Cryptosystem

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">High weight</span>

Definition. ==RSA is a public key cryptosystem whose security rests on the difficulty of factoring $n = pq$: encryption is $C = M^e \bmod n$ and decryption is $M = C^d \bmod n$.==

Steps.

Step 1: Choose two large primes p and q; compute n = p*q.
Step 2: Compute phi(n) = (p-1)(q-1).
Step 3: Choose e with 1 < e < phi(n) and gcd(e, phi(n)) = 1.
Step 4: Compute d = e^-1 mod phi(n), so e*d = 1 mod phi(n).
Step 5: Public key {e, n}, private key {d, n}; C = M^e mod n, M = C^d mod n.

Key points.

  1. Decryption works because $ed = 1 + k\phi(n)$, so $M^{ed} = M \cdot (M^{\phi(n)})^k \equiv M \pmod n$ by Euler's theorem.
  2. The message must satisfy $M < n$.
  3. Strength: an attacker who factors $n$ gets $\phi(n)$ and hence $d$, so $n$ must be at least 2048 bits.
  4. Brute-forcing $d$ is infeasible for a large key, and small $e$ or $d$ are avoided.
  5. Timing attacks measure decryption time to leak $d$; they are countered by blinding or constant-time code.
  6. Plain (textbook) RSA is deterministic, so real systems add padding such as OAEP.
  7. RSA assumption: computing $e$-th roots modulo $n$ without $d$ is hard.

Example 1 (Jun 2025, Dec 2025). $p=3, q=11, e=7, M=9$: $n = 33$, $\phi = 2 \times 10 = 20$, $\gcd(7,20)=1$, $d = 3$ since $7 \times 3 = 21 \equiv 1 \pmod{20}$. $9^2 = 81 \equiv 15$, $9^4 \equiv 15^2 = 225 \equiv 27$, $9^6 = 9^4 \cdot 9^2 \equiv 27 \cdot 15 = 405 \equiv 9$, so $9^7 \equiv 9 \cdot 9 = 81 \equiv 15 \pmod{33}$. Check: $15^3 \bmod 33 = 9$. $n = 33,\ \phi = 20,\ d = 3,\ C = 15$.

Example 2. $p=7, q=11, e=17, m=8$: $n = 77$, $\phi = 60$, $d = 53$ since $17 \times 53 = 901 = 15 \times 60 + 1$. $C = 8^{17} \bmod 77 = 57$; decrypt $57^{53} \bmod 77 = 8$. $C = 57$, recovered $m = 8$.

Answer frame. Open with the definition; list key generation steps, then encryption and decryption; work one example fully with the check; explain correctness by Euler's theorem; close with strength (factoring, key size, timing). For the numerical, follow Steps 1-5 with numbers and box $n, \phi, d, C$.

Asked: [7 marks] (Dec 2020, Nov 2023) Define encryption and decryption in RSA with a suitable example and say how the strength of RSA is determined. Explain the RSA algorithm with an example of encryption and decryption. Asked: [7 marks] (Jun 2025, Dec 2025) Using RSA, encrypt $M=9$ using $p=3, q=11, e=7$; compute $n, \phi(n), d, C$. Also perform encryption and decryption for $p=7, q=11, e=17, m=8$.

RSA Signatures and Schnorr Identification

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Low weight</span>

Definition. <mark>The Schnorr identification scheme is a zero-knowledge-style protocol in which a prover shows knowledge of a discrete logarithm without revealing it.</mark>

Key points.

  1. Setup: primes $p, q$ with $q \mid p-1$ and $g$ of order $q$; prover's private key $s$, public key $v = g^{-s} \bmod p$.
  2. Commitment: the prover picks random $r$ and sends $x = g^r \bmod p$.
  3. Challenge: the verifier sends random $e$; response: the prover sends $y = r + se \bmod q$.
  4. Verify: accept if $g^y v^e \equiv x \pmod p$, since $g^{r+se}g^{-se} = g^r$.
  5. Security rests on the discrete log; the transcript reveals nothing about $s$. RSA signature: sign $S = M^d \bmod n$, verify $S^e \bmod n = M$.

Asked: [7 marks] (Nov 2023) Describe the Schnorr Identification Scheme in detail.

Primality Testing

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Not asked since 2022</span>

Definition. <mark>A primality test decides whether a large odd $n$ is prime; Miller-Rabin is the standard probabilistic test.</mark>

Key points.

  1. Write $n-1 = 2^k q$ with $q$ odd and pick a random base $a$.
  2. $n$ passes if $a^q \equiv 1$ or $a^{2^j q} \equiv -1 \pmod n$ for some $0 \le j < k$; otherwise it is composite.
  3. Each round errs with probability at most $1/4$, so repeating the test drives the error to negligible.
  4. RSA and DH key generation pick random numbers and test them until one is prime.

Elliptic Curve over the Reals

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Not asked since 2022</span>

Definition. ==An elliptic curve over the reals is the set of points satisfying $y^2 = x^3 + ax + b$ with $4a^3 + 27b^2 \ne 0$, plus a point at infinity $O$.==

Key points.

  1. The condition $4a^3 + 27b^2 \ne 0$ ensures no repeated roots, so the curve is smooth.
  2. Addition: the line through $P$ and $Q$ meets the curve at a third point; its reflection in the x-axis is $P+Q$.
  3. For $P \ne Q$: $\lambda = (y_2 - y_1)/(x_2 - x_1)$; for doubling: $\lambda = (3x_1^2 + a)/(2y_1)$; then $x_3 = \lambda^2 - x_1 - x_2$, $y_3 = \lambda(x_1 - x_3) - y_1$.
  4. $O$ is the identity and $-P = (x, -y)$, so the points form an abelian group.

Elliptic Curve Modulo a Prime

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Low weight</span>

Definition. <mark>An elliptic curve over $\mathbb{Z}_p$ is the set of points $(x,y)$ with $y^2 \equiv x^3 + ax + b \pmod p$, plus $O$, with $4a^3+27b^2 \not\equiv 0$.</mark>

Key points.

  1. Point addition and doubling use the same formulas as over the reals, but every operation is done modulo $p$ and division means multiplying by the modular inverse.
  2. Scalar multiplication $kP$ is easy, but finding $k$ from $P$ and $kP$ (ECDLP) is hard with no sub-exponential attack.
  3. Applications: ECDH key exchange, ECDSA signatures and ECIES encryption.
  4. Advantage: a 256-bit ECC key gives security like a 3072-bit RSA key, so keys and computation are smaller and faster.

Asked: [7 marks] (Dec 2020) Define elliptic curves and explain their application in cryptography.

Chinese Remainder Theorem

<span style="display:inline-block;padding:.16em .6em;border:1.5px solid currentColor;border-radius:999px;font-size:.68em;font-weight:700;letter-spacing:.06em;text-transform:uppercase;opacity:.75">Medium weight</span>

Definition. ==If $m_1, \dots, m_k$ are pairwise coprime, the system $X \equiv a_i \pmod{m_i}$ has a unique solution modulo $M = m_1 m_2 \cdots m_k$.==

Formula. $M_i = M/m_i$, $y_i = M_i^{-1} \bmod m_i$, and $$X = \sum a_i M_i y_i \bmod M$$

Key points.

  1. The moduli must be pairwise coprime, otherwise a unique solution may not exist.
  2. Each $M_i$ is coprime to $m_i$, so its inverse $y_i$ exists.
  3. It speeds up RSA by computing modulo $p$ and $q$ separately.

Example (Dec 2020, Nov 2022). $X \equiv 7 \pmod{13}$, $X \equiv 11 \pmod{12}$: $M = 156$, $M_1 = 12$, $y_1 = 12^{-1} \bmod 13 = 12$; $M_2 = 13$, $y_2 = 13^{-1} \bmod 12 = 1$. $X = 7 \cdot 12 \cdot 12 + 11 \cdot 13 \cdot 1 = 1008 + 143 = 1151 \equiv 59 \pmod{156}$. Check: $59 = 4 \cdot 13 + 7$ and $59 = 4 \cdot 12 + 11$. $X = 59$.

Second system ($1 \bmod 5$, $2 \bmod 7$, $3 \bmod 9$, $4 \bmod 11$): $M = 3465$; $M_i = 693, 495, 385, 315$; $y_i = 2, 3, 4, 8$. $X = 1386 + 2970 + 4620 + 10080 = 19056 \equiv$ 1731 $\pmod{3465}$.

Answer frame. Open with the theorem and the pairwise-coprime condition; give the formula; tabulate $M, M_i, y_i$; substitute; close with the verification of each congruence.

Asked: [7 marks] (Dec 2020, Nov 2022) Explain the Chinese Remainder Theorem. Using CRT find $X$ from $X \equiv 7 \bmod 13$ and $X \equiv 11 \bmod 12$; also $X \equiv 1 \bmod 5$, $2 \bmod 7$, $3 \bmod 9$, $4 \bmod 11$.

Last-minute revision

  • AES: 128-bit block; key 128/192/256; rounds 10/12/14; last round skips MixColumns.
  • AES round steps: SubBytes, ShiftRows, MixColumns, AddRoundKey.
  • DH: $Y = \alpha^X \bmod q$, $K = Y_B^{X_A} = Y_A^{X_B} \bmod q$; $q=11$, $\alpha=5$, $X_A=2$, $X_B=3$ gives $Y_A=3$, $Y_B=4$, $K=5$.
  • DH with $q=353$, $\alpha=3$, $X_A=45$, $X_B=50$ gives $K=197$.
  • CDH computes $g^{ab}$; DDH decides whether $Z = g^{ab}$.
  • RSA: $n=pq$, $\phi=(p-1)(q-1)$, $ed \equiv 1 \bmod \phi$, $C = M^e \bmod n$, $M = C^d \bmod n$.
  • $p=3, q=11, e=7, M=9$ gives $n=33$, $\phi=20$, $d=3$, $C=15$.
  • $p=7, q=11, e=17, m=8$ gives $n=77$, $\phi=60$, $d=53$, $C=57$.
  • CRT: $X = \sum a_i M_i y_i \bmod M$; $7 \bmod 13$, $11 \bmod 12$ gives $X=59$.
  • Schnorr: $x = g^r$, $y = r + se$, check $g^y v^e = x$.
  • ECC: $y^2 = x^3 + ax + b$; 256-bit ECC is about 3072-bit RSA.

Memory hooks

  • AES round order: "Sub, Shift, Mix, Add" (SSMA).
  • DH: private exponent stays home, only $\alpha^X$ travels.
  • RSA: "e encrypts, d decrypts, factoring breaks."
  • Schnorr: Commit, Challenge, Response (CCR).
  • CRT: $M_i$ is "all moduli except mine".

Coverage checklist

  • Advanced Encryption Standard (AES): Nov 2022 and Dec 2025 structure, encryption, key expansion.
  • Introduction to Public Key Cryptosystem: not asked recently.
  • Discrete Logarithmic Problem: not asked recently.
  • Diffie-Hellman Key Exchange Computational & Decisional Diffie-Hellman Problem: both numericals and the CDH/DDH explain question.
  • RSA Assumptions & Cryptosystem: both explain and both numerical questions.
  • RSA Signatures & Schnorr Identification Schemes: Schnorr, Nov 2023.
  • Primarily Testing: not asked recently.
  • Elliptic Curve over the Reals: not asked recently.
  • Elliptic curve Modulo a Prime.: Dec 2020 definition and applications.
  • Chinese Remainder Theorem: both CRT numericals.
Go to where you left off?

Quick Add to Notes

Save questions, your own notes and screenshots into notes filed by unit. It takes a free account.

Create free account

Have an account? Log in