## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CS171

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Enumerating Short Vectors

We would like to find a short vector in a lattice. One idea would simply be to enumerate all linear combinations of the basis vectors with some bound on the coefficients. Unfortunately, short vectors could in principle come from linear combinations with large coefficients. Instead, we shall use the Gram-Schmidt basis to bound the size of the coefficients.

We shall find all points $\mathbf{u}$ in a lattice with $|\mathbf{u}|^2 \leq A^2$ for some bound $A^2$. Let $\mathbf{b}_1, \mathbf{b}_2, \ldots, \mathbf{b}_n$ be a basis for $\Lambda$, and let $\mathbf{b}_1^, \ldots, \mathbf{b}_n^$ be the corresponding Gram-Schmidt basis. Note that for any vector $\mathbf{u} \in \Lambda$, we can write it as a linear combination of the Gram-Schmidt basis vectors $\mathbf{u}=\sum_i \alpha_i \mathbf{b}i^$ and then $$|\mathbf{u}|^2=\sum{i=1}^n \alpha_i^2\left|\mathbf{b}_i^\right|^2$$
Recall that $\mathbf{b}_n^$ is the part of $\mathbf{b}_n$ that is orthogonal to all the earlier basis vectors. This means when $\mathbf{u}=\sum_i a_i \mathbf{b}_i=\sum_i \alpha_i \mathbf{b}_i^$, then $a_n=\alpha_n$. Therefore, if $\alpha\left|\mathbf{b}_n^*\right|>A$ then $|\mathbf{u}|>A$.

We therefore begin by enumerating vectors with $n$-th coordinate $a_n$ between $-\left\lfloor A /\left|\mathbf{b}_n^\right|\right\rfloor$ and $+\left\lfloor A /\left|\mathbf{b}_n^\right|\right\rfloor$.

Given $a_n$, we can now consider the possibilities for $a_{n-1}$. Of course, this time, the contribution in the direction of $\mathbf{b}{n-1}^$ is that given by $a{n-1} \mathbf{b}{n-1}$ and $a_n \mathbf{b}_n$, where the latter’s contribution is $a_n \mu{n, n-1}\left|\mathbf{b}{n-1}^\right|$. So given $a_n$, we want to enumerate all the $(n-1)$-th coordinates $a{n-1}$ such that
$$\left(a_{n-1}+a_n \mu_{n, n-1}\right)^2\left|\mathbf{b}{n-1}^\right|^2+a_n^2\left|\mathbf{b}_n^\right|^2 \leq A^2{ }^2$$
In general, given $a{i+1}, \ldots, a_n$, we consider the possibilities for $a_i$. Again, we want to enumerate all $a_i$ such that
$$\left(a_i+\sum_{j=i+1}^n a_j \mu_{j i}\right)^2\left|\mathbf{b}i^\right|^2+\sum{j=i+1}^n\left(a_j+\sum_{k=j+1}^n a_k \mu_{k, j}\right)^2\left|\mathbf{b}j^\right|^2 \leq A^2$$
For some choices of $a{i+1}, \ldots, a_n$ there may be no possible choices for $a_i$, in which case we stop and continue with other choices for $a_{i+1}, \ldots, a_n$.

Whenever we find a non-empty region for $a_1$ and enumerate those values, we enumerate lattice vectors of length less than $A$. It is clear that for any lattice point $\mathbf{u}$ of length less than $A$, this point must be among the lattice point eventually enumerated.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Digital Signatures

We shall now consider a variant of the original cryptographic problem. Alice wants to send messages to Bob via some channel. Eve has access to the channel, and she may tamper with anything sent over the channel, and even introduce her own messages. Alice wants her messages to Bob to arrive without modification, or if it they have been tampered with, Bob should notice.
The obvious solution is for Alice and Bob to have a shared secret and use a message authentication code. But Bob may have many correspondents, and may not want to manage shared secrets with each of them.

What if Alice wants to make her message public and let anyone, even people Alice has never met, convince themselves that Alice sent the message?
The solution is digital signatures, which resemble message authentication codes. As for public key encryption, we have two keys, one key for creating tags and another key for verifying them. The tags are called signatures and creating them is called signing. Alice makes the verification key public key, allowing anyone to verify, and keeps the signing key secret.

Before we begin the design of signature schemes, we shall discuss hash functions, a tool that we can use to extend the plaintext space for signatures, simplifying the design of signature schemes.

The first class of signature schemes we study are based on the famous RSA cryptosystem. At first sight, this system looks like a “dual” of the textbook RSA public key encryption scheme, but this similarity is superficial.

The second class of signature schemes we study is based on a much deeper theory, namely how to argue convincingly that something is true without revealing the evidence for why it is true.

We shall discuss few new computational algorithms in this chapter, since we are in effect reusing analysis we did in the previous two chapters.

Before we end, we briefly discuss signatures that are not based on numbertheoretic problems, as well as how to use signatures to protect key exchange.

# 密码学代写

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Enumerating Short Vectors

left(a_{n-1}+a_n $\backslash m u_{-}{n, n-1} \backslash$ right $)^{\wedge} 2 \backslash$ left $\left.\left|\backslash m a t h b f{b}{n-1}^{\wedge} \backslash r i g h t\right|\right|^{\wedge} 2+a_{-} n^{\wedge} 2 \backslash l$ eft $\left.\mid \backslash m a t h b f f b\right}\left.{-} n^{\wedge} \backslash r i g h t\right|^{\wedge} 2 \backslash$ leq $A^{\wedge} 2{}^{\wedge} 2$ 一般来说，给定 $a i+1, \ldots, a_n$ ，我们考虑的可能性 $a_i$. 同样，我们要枚举所有 $a_i$ 这样 对于某些选择 $a i+1, \ldots, a_n$ 可能没有可能的选择 $a_i$ ，在这种情况下我们停止并继续其他选择 $a{i+1}, \ldots, a_n$.

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CS709

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Enumerating Short Vectors

We would like to find a short vector in a lattice. One idea would simply be to enumerate all linear combinations of the basis vectors with some bound on the coefficients. Unfortunately, short vectors could in principle come from linear combinations with large coefficients. Instead, we shall use the Gram-Schmidt basis to bound the size of the coefficients.

We shall find all points $\mathbf{u}$ in a lattice with $|\mathbf{u}|^2 \leq A^2$ for some bound $A^2$. Let $\mathbf{b}_1, \mathbf{b}_2, \ldots, \mathbf{b}_n$ be a basis for $\Lambda$, and let $\mathbf{b}_1^, \ldots, \mathbf{b}_n^$ be the corresponding Gram-Schmidt basis. Note that for any vector $\mathbf{u} \in \Lambda$, we can write it as a linear combination of the Gram-Schmidt basis vectors $\mathbf{u}=\sum_i \alpha_i \mathbf{b}i^$ and then $$|\mathbf{u}|^2=\sum{i=1}^n \alpha_i^2\left|\mathbf{b}_i^\right|^2$$
Recall that $\mathbf{b}_n^$ is the part of $\mathbf{b}_n$ that is orthogonal to all the earlier basis vectors. This means when $\mathbf{u}=\sum_i a_i \mathbf{b}_i=\sum_i \alpha_i \mathbf{b}_i^$, then $a_n=\alpha_n$. Therefore, if $\alpha\left|\mathbf{b}_n^*\right|>A$ then $|\mathbf{u}|>A$.

We therefore begin by enumerating vectors with $n$-th coordinate $a_n$ between $-\left\lfloor A /\left|\mathbf{b}_n^\right|\right\rfloor$ and $+\left\lfloor A /\left|\mathbf{b}_n^\right|\right\rfloor$.

Given $a_n$, we can now consider the possibilities for $a_{n-1}$. Of course, this time, the contribution in the direction of $\mathbf{b}{n-1}^$ is that given by $a{n-1} \mathbf{b}{n-1}$ and $a_n \mathbf{b}_n$, where the latter’s contribution is $a_n \mu{n, n-1}\left|\mathbf{b}{n-1}^\right|$. So given $a_n$, we want to enumerate all the $(n-1)$-th coordinates $a{n-1}$ such that
$$\left(a_{n-1}+a_n \mu_{n, n-1}\right)^2\left|\mathbf{b}{n-1}^\right|^2+a_n^2\left|\mathbf{b}_n^\right|^2 \leq A^2{ }^2$$
In general, given $a{i+1}, \ldots, a_n$, we consider the possibilities for $a_i$. Again, we want to enumerate all $a_i$ such that
$$\left(a_i+\sum_{j=i+1}^n a_j \mu_{j i}\right)^2\left|\mathbf{b}i^\right|^2+\sum{j=i+1}^n\left(a_j+\sum_{k=j+1}^n a_k \mu_{k, j}\right)^2\left|\mathbf{b}j^\right|^2 \leq A^2$$
For some choices of $a{i+1}, \ldots, a_n$ there may be no possible choices for $a_i$, in which case we stop and continue with other choices for $a_{i+1}, \ldots, a_n$.

Whenever we find a non-empty region for $a_1$ and enumerate those values, we enumerate lattice vectors of length less than $A$. It is clear that for any lattice point $\mathbf{u}$ of length less than $A$, this point must be among the lattice point eventually enumerated.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Algorithm

As we saw, if we have an orthogonal basis, we can solve the closest vector problem, and if we have a nearly orthogonal basis, we can solve closest vector problem if the closest vector is close enough to a lattice point.

The natural question is how to find a reasonably good basis that will allow us to solve the closest vector problem. The first goal should be to be precise about what we mean by “reasonably good”.

Definition 3.9. Let $\mathbf{b}1, \mathbf{b}_2, \ldots, \mathbf{b}_n$ be a lattice basis, with Gram-Schmidt basis $\mathbf{b}_1^, \ldots, \mathbf{b}_n^$ and Gram-Schmidt coefficients $\mu{i j}$, as defined in (3.6). Let $\frac{1}{4}<\delta<1$ be a real number. We say that the basis is $\delta$-LLL-reduced if \begin{aligned} \left|\mu_{i j}\right| & \leq \frac{1}{2} & & \text { for all } 1 \leq j{i-1}^\right|^2 & \leq\left|\mathbf{b}_i^\right|^2+\mu{i, i-1}^2\left|\mathbf{b}{i-1}^\right|^2 & & \text { for all } 2 \leq i \leq n . \end{aligned} When a basis satisfies (3.8) we cannot easily make the basis vectors more orthogonal. When the basis satisfies (3.9), the basis vectors of the GramSchmidt orthogonalisation will be ordered roughly according to length. Exercise 3.62. A common choice for $\delta$ is $3 / 4$. Show that (3.9) then implies $$\left|\mathbf{b}{i-1}^\right|^2 \leq 2\left|\mathbf{b}_i^*\right|^2 \text { for all } 2 \leq i \leq n .$$
Hint: You may use the fact that (3.8) also must hold.
That an LLL-reduced basis is somehow a good basis can be seen from the following fact, which we state without proof.

Fact 3.22. Suppose $\mathbf{b}_1, \mathbf{b}_2, \ldots, \mathbf{b}_n$ with corresponding basis matrix $\mathbf{B}$ is a 3/4-LLL-reduced basis for a lattice $\Lambda$. Then $\left|\mathbf{b}_1\right| \leq 2^{(n-1) / 2} \lambda_1(\Lambda)$. Also, if $\mathbf{x} \in \mathbb{R}^n$, then
$$\left|\mathbf{x}-\left\lfloor\mathbf{x} \mathbf{B}^{-1}\right\rceil \mathbf{B}\right| \leq\left(1+2 n(9 / 2)^{n / 2}\right)|\mathbf{x}-\mathbf{u}| \text { for any } \mathbf{u} \in \Lambda$$
We know that $\lambda_1(\Lambda) \leq \sqrt{\gamma} \operatorname{det}(\Lambda)^{1 / n}$, which means that if we have an LLLreduced basis and use $\left|\mathbf{b}_1\right|$ as our search bound, the enumeration approach from the previous section will have to enumerate at most
$$\frac{\left(2^{(n-1) / 2} \gamma^{1 / 2} \operatorname{det}(\Lambda)^{1 / n}\right)^n}{\operatorname{det}(\Lambda)}=2^{n(n-1) / 2} \gamma^{n / 2}$$
points. While it does not affect the upper bound we deduced, having the Gram-Schmidt vectors not too small will decrease the total number of points the algorithm will iterate over.

We also note that the LLL-reduced basis will give us an estimate for the closest vector problem. (There are better ways to use the LLL-reduced basis.)

# 密码学代写

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Algorithm

LLL 缩减基在某种程度上是一个很好的基，可以从以下事实中看出，我们没有证明就陈述了这一点。

$$\left|\mathbf{x}-\left\lfloor\mathbf{x B}^{-1}\right\rceil \mathbf{B}\right| \leq\left(1+2 n(9 / 2)^{n / 2}\right)|\mathbf{x}-\mathbf{u}| \text { for any } \mathbf{u} \in \Lambda$$

$$\frac{\left(2^{(n-1) / 2} \gamma^{1 / 2} \operatorname{det}(\Lambda)^{1 / n}\right)^n}{\operatorname{det}(\Lambda)}=2^{n(n-1) / 2} \gamma^{n / 2}$$

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CS127

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|The GGH Cryptosystem

One idea for a symmetric encryption scheme based on lattices is to have a lattice $\Lambda$ with a nearly orthogonal basis B as a secret key. To encrypt we somehow encode the message as a lattice vector $\mathrm{u} \in \Lambda$ and then add random noise $\mathrm{f}$ to that vector to get a ciphertext $\mathrm{x}=\mathrm{u}+\mathrm{f}$. To decrypt, we can use our nearly orthogonal basis to find the closest vector $u$ to $\mathrm{x}$ (using the technique from Exercise 3.51), and then decode the lattice point to recover the message.
It is clear that we need to limit the magnitude of the random noise, since if it is too big, we will no longer be able to recover $\mathrm{u}$ as the closest vector. This could happen because $u$ is no longer the closest vector to $\mathrm{x}$, or because our basis is not orthogonal and so does not perfectly solve the closest vector problem.

Exercise 3.53. Let $\mathbf{B}$ be a basis for a lattice $\Lambda$. Show that with $\mathbf{u} \in \Lambda$ and $\mathbf{x}=\mathbf{u}+\mathbf{f}$, then $\left\lfloor\mathbf{x B}^{-1}\right\rceil \mathbf{B}=\mathbf{u}$ if and only if $\left\lfloor\mathbf{f B}^{-1}\right\rceil=\mathbf{0}$.

Exercise 3.54. Recall that for a real vector $\boldsymbol{\alpha}=\left(\alpha_1, \alpha_2, \ldots, \alpha_n\right)$, we have the norms $|\boldsymbol{\alpha}|_1=\sum_i\left|\alpha_i\right|$ and $|\boldsymbol{\alpha}|_{\infty}=\max _i\left|\alpha_i\right|$.

Let $\mathbf{B}$ be a basis for a lattice $\Lambda$, let $\rho$ be a bound on the $|\cdot|_1$ norm of the columns of $\mathbf{B}^{-1}$. Show that for any vector $\mathbf{f}$, we have that
$$\left|\mathbf{f B}^{-1}\right|_{\infty} \leq \rho|\mathbf{f}|_{\infty} .$$
Explain how this can be used to find a bound on the random noise when encrypting, to ensure decryption still works.

It is tempting to turn this idea into a public key encryption scheme by publishing a basis for the lattice. Obviously, we cannot publish our nearly orthogonal basis $\mathbf{B}$, since this is essentially the decryption key.

Recall that any lattice $\Lambda$ with basis matrix $\mathbf{B}$, if $\mathbf{U}$ is an integer matrix with determinant $\pm 1$, then $\mathbf{C}=\mathbf{U B}$ is another basis matrix for $\Lambda$.

One idea is then to create and publish a different basis for the lattice, one that is not nearly orthogonal, and therefore cannot be used to find the closest vector using the approach from Exercise 3.51. One possible choice is to use the Hermite normal form for $\mathbf{B}$ as $\mathbf{C}$. (The Hermite normal form is in some sense the worst possible form we can give the public basis, since any adversary could compute the Hermite normal form on his own.)

As usual, while we could attempt to embed the message in the vector $\mathbf{u}$, it makes more sense to use $\mathbf{u}$ and $\mathbf{f}$ as keys for a symmetric cryptosystem. As we did in Example 3.9, we shall use a function to derive the key from the lattice point and the noise, a so-called key derivation function.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Regev’s Cryptosystem

Let $p$ be a prime. Let $\mathrm{g}_1, \mathrm{~g}_2, \ldots, \mathrm{g}_l \in \mathbb{F}_p^n$ be a set of randomly chosen vectors that contains $n$ linearly independent vectors. Let $\mathrm{b} \in \mathbb{F}_p^n$, and let
$$\beta_i=\mathrm{g}_i \cdot \mathbf{b}, \quad i=1,2, \ldots, l .$$
If we learn the value of these dot products, we can recover the vector $\mathbf{b}$.
E Exercise 3.56. Given $\mathrm{g}_1, \ldots, \mathrm{g}_l$ and $\beta_1, \ldots, \beta_l$, show how to compute $\mathrm{b}$.
If we add a bit of randomness to the dot product, it turns out that finding the value $\mathbf{b}$ becomes much more difficult. Let $\chi$ be a probability distribution on $\mathbb{F}_p$ and let $f_1, f_2, \ldots, f_l$ be sampled independently according to $\chi$. Let
$$y_i=\mathrm{g}_i \cdot \mathrm{b}+f_i, \quad i=1,2, \ldots, l .$$
Finding $\mathbf{b}$ given $y_1, y_2, \ldots, y_l$ is known as the learning with errors (LWE) problem (we want to learn $b$ from a set of equations with errors in them).
E E Exercise 3.57. Show that if $l=n$, then the learning with errors problem is impossible to answer with (close to) certainty. (That is, any algorithm trying to solve the learning with errors problem must fail sometimes.)

We shall need one particular property for the probability distribution $\chi$. Except with small probability, when $f_1, f_2, \ldots, f_l$ have been sampled independently from $\chi$, then for almost all subsets $S \subseteq{1,2, \ldots, l}$ we have that
$$\sum_{i \in S} f_i=k+\langle p\rangle,$$
for some integer $k$ with $|k|<p / 4$. It can be shown that $\chi$ can be chosen such that this requirement is satisfied, and it still seems hard to solve the learning with errors problem.
Example 3.19. Regev’s learning with errors cryptosystem works as follows:

• The key generation algorithm $\mathcal{K}$ chooses random vectors $\mathrm{g}_1, \mathrm{~g}_2, \ldots, \mathrm{g}_l$ from $\mathbb{F}_p^n$ such that there are $n$ linearly independent vectors. It chooses a random vector $\mathbf{b} \in \mathbb{F}_p^n$, samples errors $f_1, f_2, \ldots, f_l$ independently according to $\chi$ and computes $y_i=\mathrm{g}_i \cdot \mathbf{b}+f_i$ for $i=1,2, \ldots, l$. It then outputs $e k=\left(\mathrm{g}_1, \mathrm{~g}_2, \ldots, \mathrm{g}_l, y_1, y_2, \ldots, y_l\right)$ and $d k=\mathbf{b}$.
• The encryption algorithm $\mathcal{E}$ takes as input an encryption key ek $=$ $\left(\mathrm{g}_1, \mathrm{~g}_2, \ldots, \mathrm{g}_l, y_1, y_2, \ldots, y_l\right)$ and a message $m \in{0,1}$. a

# 密码学代写

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Regev’s Cryptosystem

• 密钥生成算法 $\mathcal{K}$ 选择随机向量 $g_1, \mathrm{~g}2, \ldots, \mathrm{g}_l$ 从 $\mathbb{F}_p^n$ 这样就有 $n$ 线性无关的向量。它选择一个随机向量 $\mathbf{b} \in \mathbb{F}{p^{\prime}}^n$, 样本误差 $f_1, f_2, \ldots, f_l$ 独立地根据 $\chi$ 并计算 $y_i=\mathrm{g}_i \cdot \mathbf{b}+f_i$ 为了 $i=1,2, \ldots, l$. 然后输出 $e k=\left(\mathrm{g}_1, \mathrm{~g}_2, \ldots, \mathrm{g}_l, y_1, y_2, \ldots, y_l\right)$ 和 $d k=\mathbf{b}$.
• 加密算法 $\mathcal{E}$ 将加密密钥 ek 作为输入 $=\left(\mathrm{g}_1, \mathrm{~g}_2, \ldots, \mathrm{g}_l, y_1, y_2, \ldots, y_l\right)$ 和一条消息 $m \in 0,1$.

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CISS3341

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|q-ary Lattices and the Z-Shape

Recall that both NTRU and LWE give rise to $q$-ary lattices. These lattices always contain the vector $(q, 0, \ldots, 0)$ and all its permutations. These so-called ‘ $q$-vectors’ can be considered short, depending on the parameters of the instance being considered, and might be shorter than what we would expect to obtain following predictions such as the GSA or the TGSA. Furthermore, some of those $q$-vectors naturally appear in the typical basis construction of $q$-ary lattices. Even when this is not the case, they can be made explicit by computing the Hermite Normal Form.

To predict lattice reduction on such bases, we may observe that one of the guarantees of the LLL algorithm is that the first vector $\mathbf{b}_0$ never gets longer. For certain parameters this can contradict the GSA. In fact, if $\mathbf{b}_i^$ does not change for all $i$ cannot become longer either, which means that after the reduction algorithm has completed we may still have many such $q$-vectors at the beginning of our basis, unaffected by the reduction. It is therefore tempting to predict a piecewise linear profile, with two pieces. It should start with a flat line at $\lg q$, followed by a sloped portion following the predicted GSA slope.

In fact, the shape has three pieces, and this is easy to argue for LLL, since LLL is a self-dual algorithm. ${ }^2$ This means in particular that the last GramSchmidt vector cannot get shorter, and following the same argument, we can conclude that the basis must end with a flat piece of 1-vectors. All in all, the basis should follow a Z-shape, and this is indeed experimentally the case [280, 625], as depicted in Figure 2.5, where we picked a small $q$ to highlight the effect. We shall call such a prediction $[169,625]$ the ZGSA.

It is tempting to extend such a ZGSA model to other algorithms beyond LLL and this has been used for example in [169]. We might also attempt to refine it to a ZTGSA model, where we put an HKZ tail just before the flat section of Gram-Schmidt vectors of norm 1. However, this is a questionable way of reasoning, because BKZ, unlike LLL, is not self-dual. However, it is worth noting that it seems possible to force BKZ to behave in such a way, simply by restricting BKZ to work on the indices up $i<j$, where $j$ is carefully calibrated so that $\left|\mathbf{b}_j^{\star}\right| \approx 1$. This is not self-dual, but up to the tail of BKZ, it would produce a $Z$-shape as well.

Yet, we could also let BKZ work freely on the whole basis, and wonder what would happen. In other words, we may ask whether it is preferable to apply such a restriction to $\mathrm{BKZ}$ or not. A natural approach to answering this question would be to simply use the CN11 simulator, however, it appears that the $Z$-shape is very poorly simulated. Indeed, while the simulator can easily maintain $q$-vectors when they are shorter than the one locally predicted by the Gaussian heuristic, the phenomenon on the right end of the $Z$ seems more complicated: some 1-vectors are replaced by Gram-Schmidt vectors of norm strictly less than 1, but not all, see Figure 2.6. Thus, we see the Z-shape known from the literature but with the addition of a kink in the tail block.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Random Blocks

The heuristic analysis of $\mathrm{BKZ}$ is based on the assumption that each sublattice considered by the algorithm ‘behaves like a random lattice’ (strong version), or at least that the expectation or distribution of its shortest vector is the same as for a random lattice (weak version).

More formally, we would have to define the notion of a random lattice,invoking the Haar measure. However, we can nevertheless interrogate this heuristic without going into those details here. Indeed, as we can see in Figure $2.2$, the predicted slopes below dimension 30 are far from the actual behaviour. In fact, the predictions for small block sizes are nonsensical as they predict a flatter slope as $\beta$ decreases below 30 and even an inversion of the slope below block size $\approx 10$.

Although we can observe the prediction and the observation converging for block sizes above 50 , what level of precision do we attribute to those predictions? Given the phenomena perturbing the GSA surveyed in this chapter (heads, tails, ripples), how pertinent are the data from Figure 2.2? Pushing experimental evidence a bit further would be reassuring here: although we do not expect surprises, it would be good to replace this expectation with experimental evidence.

But, more conceptually, we note that making the strong version of the heuristic assumption (each block behaves like a random lattice) is self-contradictory. Indeed, the model leads us to conclude that the shape is essentially a line, at least when $\beta \ll d$ and the considered block $\mathbf{B}{[\kappa: \kappa+\beta]}$ is far from the head and the tail, i.e., $\kappa \gg \beta, d-\kappa \gg \beta$. But this block, like all other blocks, is fully HKZ-reduced: since $\mathbf{b}{\kappa+i}^{\star}$ is a shortest vector of $\Lambda\left(\mathbf{B}{[\kappa+i: k+i+\beta]}\right)$, it is also a shortest vector of $\Lambda\left(\mathbf{B}{[\kappa+i: k+\beta]}\right)$. Yet, HKZ-reduced bases of random lattices have a concave shape not a straight slope.

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CS388H

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Lattice Reduction: Theory

All lattices of dimension $d \geq 2$ admit infinitely many bases, and two bases B, B’ generate (or represent) the same lattice if and only if $\mathbf{B}=\mathbf{B}^{\prime} \cdot \mathbf{U}$ for some unimodular matrix $\mathbf{U} \in \mathrm{GL}_d(\mathbb{Z})$. In other words, the set of (full-rank) lattices can be viewed as the quotient $\mathrm{GL}_d(\mathbb{R}) / \mathrm{GL}_d(\mathbb{Z})$. Lattice reduction is the task of finding a good representative of a lattice, i.e., a basis $\mathbf{B} \in \mathrm{GL}_d(\mathbb{R})$ representing $\Lambda \in \mathrm{GL}_d(\mathbb{R}) / \mathrm{GL}_d(\mathbb{Z})$

While there exists a variety of formal definitions for what is a good representative, the general goal is to make the Gram-Schmidt basis $\mathbf{B}^{\star}$ as small as possible. Using the simple size-reduction algorithm (see [454, Algorithm 3]), it is possible to also enforce the shortness of the basis $\mathbf{B}$ itself.

It should be noted that because we have an invariant $\prod_i\left|\mathbf{b}i^{\star}\right|=\operatorname{vol}(\Lambda)$, we cannot make all GS vectors small at the same time, but the goal becomes to balance their lengths. More pictorially, we consider the log profile of a basis as the graph of $\left(\ell_i-\lg \left|\mathbf{b}_i^{\star}\right|\right){i=0 . . d-1}$ as a function of $i$. By the volume invariant, the area under this graph is fixed, and the goal of reduction is to make this graph flatter.

A very strong ${ }^1$ notion of reduction is the Hermite-Korkine-Zolotarev (HKZ) reduction, which requires each basis vector $\mathbf{b}i$ to be a shortest non-zero vector of the remaining projected lattice $\Lambda{[i: d]}$. The Block-Korkine-Zolotarev (BKZ) reduction relaxes $\mathrm{HKZ}$, only requiring $\mathbf{b}_i$ to be close-to-shortest in a local ‘block’. More formally, we have the following.

Definition $2.3$ ( $\mathrm{HKZ}$ and BKZ [454]). The basis $\mathbf{B}=\left(\mathbf{b}0, \ldots, \mathbf{b}{d-1}\right)$ of a lattice $\Lambda$ is said to be $\mathrm{HKZ}$ reduced if $\left|\mathbf{b}i^{\star}\right|=\lambda_1\left(\Lambda\left(\mathbf{B}{[i: d]}\right)\right)$ for all $i<d$. It is said BKZ reduced with block size $\beta$ and $\epsilon \geq 0$ if $\left|\mathbf{b}i^{\star}\right| \leq(1+\epsilon) \cdot \lambda_1\left(\Lambda\left(\mathbf{B}{[i: \min (i+\beta, d)]}\right)\right)$ for all $i<d$.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Shape Approximation

The Gaussian heuristic predicts that the number $|\Lambda \cap \mathcal{B}|$ of lattice points inside a measurable body $\mathcal{B} \subset \mathbb{R}^n$ is approximately equal to $\operatorname{vol}(\mathcal{B}) / \operatorname{vol}(\Lambda)$. Applied to Euclidean $d$-balls, it leads to the following prediction of the length of a shortest non-zero vector in a lattice.

Definition 2.6 (Gaussian heuristic). We denote by gh( $\Lambda$ ) the expected first minimum of a lattice $\Lambda$ according to the Gaussian heuristic. For a full-rank lattice $\Lambda \subset \mathbb{R}^d$, it is given by
$$\operatorname{gh}(\Lambda)=\left(\frac{\operatorname{vol}(\Lambda)}{\operatorname{vol}(\mathfrak{B})}\right)^{1 / d}=\frac{\Gamma\left(1+\frac{d}{2}\right)^{1 / d}}{\sqrt{\pi}} \cdot \operatorname{vol}(\Lambda)^{1 / d} \approx \sqrt{\frac{d}{2 \pi e}} \cdot \operatorname{vol}(\Lambda)^{1 / d},$$
where $\mathfrak{B}$ denotes the $d$-dimensional Euclidean ball. We also denote by $\operatorname{gh}(d)$ the quantity $\operatorname{gh}(\Lambda)$ of any $d$-dimensional lattice $\Lambda$ of volume 1: $\operatorname{gh}(d) \approx$ $\sqrt{d / 2 \pi e}$. For convenience we also denote $\operatorname{lgh}(x)$ for $\lg (\operatorname{gh}(x))$.

Combining the Gaussian heuristic with the definition of a BKZ reduced basis, after BKZ- $\beta$ reduction we expect
\begin{aligned} \ell_i=\lg \left(\lambda_1\left(\Lambda\left(\mathbf{B}{[i: \min (i+\beta, d)]}\right)\right)\right) & \approx \operatorname{lgh}(\min (\beta, d-i))+\frac{\lg \left(\operatorname{vol}\left(\Lambda\left(\mathbf{B}{[i \min (i+\beta, d)]}\right)\right)\right)}{\min (\beta, d-i)} \ &=\operatorname{lgh}(\min (\beta, d-i))+\frac{\sum_{j=i}^{\min (i+\beta, d)-1} \ell_j}{\min (\beta, d-i)} . \end{aligned}
If $d \gg \beta$ this linear recurrence implies a geometric series for the $\left|\mathbf{b}i^{\star}\right|$. Considering one block of dimension $\beta$ and unit volume, we expect $\ell_i=(\beta-$ $i-1) \cdot \lg \left(\alpha\beta\right)$ for $i=0, \ldots, \beta-1$ and some $\alpha_\beta$. We obtain
\begin{aligned} \ell_0=(\beta-1) \cdot \lg \left(\alpha_\beta\right) & \approx \operatorname{lgh}(\beta)+\frac{1}{\beta} \sum_{j=0}^\beta j \cdot \lg \left(\alpha_\beta\right) \ &=\operatorname{lgh}(\beta)+(\beta-1) / 2 \cdot \lg \left(\alpha_\beta\right) . \end{aligned}

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Lattice Reduction: Theory

$\left|\mathbf{b} i^{\star}\right|=\lambda_1(\Lambda(\mathbf{B}[i: d]))$ 对所有人 $i<d$. 据说 BKZ 随着区块大小的增加而减少 $\beta$ 和 $\epsilon \geq 0$ 如果
$\left|\mathbf{b} i^{\star}\right| \leq(1+\epsilon) \cdot \lambda_1(\Lambda(\mathbf{B}[i: \min (i+\beta, d)]))$ 对所有人 $i<d$.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Shape Approximation

$$\operatorname{gh}(\Lambda)=\left(\frac{\operatorname{vol}(\Lambda)}{\operatorname{vol}(\mathfrak{B})}\right)^{1 / d}=\frac{\Gamma\left(1+\frac{d}{2}\right)^{1 / d}}{\sqrt{\pi}} \cdot \operatorname{vol}(\Lambda)^{1 / d} \approx \sqrt{\frac{d}{2 \pi e}} \cdot \operatorname{vol}(\Lambda)^{1 / d}$$

$$\ell_i=\lg \left(\lambda_1(\Lambda(\mathbf{B}[i: \min (i+\beta, d)]))\right) \approx \operatorname{lgh}(\min (\beta, d-i))+\frac{\lg (\operatorname{vol}(\Lambda(\mathbf{B}[i \min (i+\beta, d)])))}{\min (\beta, d-i)}$$

$$\ell_0=(\beta-1) \cdot \lg \left(\alpha_\beta\right) \approx \operatorname{lgh}(\beta)+\frac{1}{\beta} \sum_{j=0}^\beta j \cdot \lg \left(\alpha_\beta\right) \quad=\operatorname{lgh}(\beta)+(\beta-1) / 2 \cdot \lg \left(\alpha_\beta\right)$$

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CS6260

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|LWE and NTRU

The LWE problem and the NTRU problem have proven to be versatile building blocks for cryptographic applications [104, 218, 274, 493]. For both of these problems, there exist ring and matrix variants. More precisely, the original definition of NTRU is the ring variant [274] and the matrix variant is rarely considered whereas for LWE the original definition is the matrix variant [494] with a ring variant being defined later $[401,561]$. In this chapter, we generally treat the matrix variants since our focus is on lattice reduction for general lattices.

Definition $2.1$ (LWE [494]). Let $n, q$ be positive integers, $\chi$ be a probability distribution on $\mathbb{Z}$ and $\mathbf{s}$ be a uniformly random vector in $\mathbb{Z}q^n$. We denote by $L{\mathrm{s}, \chi}$ the probability distribution on $\mathbb{Z}q^n \times \mathbb{Z}_q$ obtained by choosing $\mathbf{a} \in \mathbb{Z}_q^n$ uniformly at random, choosing $e \in \mathbb{Z}$ according to $\chi$ and considering it in $\mathbb{Z}_q$, and returning $(\mathbf{a}, c)=(\mathbf{a},\langle\mathbf{a}, \mathbf{s}\rangle+e) \in \mathbb{Z}_q^n \times \mathbb{Z}_q$ Decision-LWE is the problem of deciding whether pairs (a, $c$ ) $\in \mathbb{Z}_q^n \times \mathbb{Z}_q$ are sampled according to $L{\mathrm{s}, \chi}$ or the uniform distribution on $\mathbb{Z}q^n \times \mathbb{Z}_q$. Search-LWE is the problem of recovering s from pairs $(\mathbf{a}, c)=(\mathbf{a},\langle\mathbf{a}, \mathbf{s}\rangle+e) \in$ $\mathbb{Z}_q^n \times \mathbb{Z}_q$ sampled according to $L{\mathrm{s}, \chi}$.

We note that the above definition puts no restriction on the number of samples, i.e., LWE is assumed to be secure for any polynomial number of samples. Further, since for many choices of $n, q, \chi$ solving Decision-LWE allows solving Search-LWE [105, 494] and vice versa, it is meaningful just to speak of the LWE problem (for those choices of parameters). By rewriting the system in systematic form [23], it can be shown that the LWE problem, where each component of the secret $\mathbf{s}$ is sampled from the error distribution $\chi$, is as secure as the problem for uniformly random secrets. LWE with such a secret, following the error distribution, is known as normal form LWE. We will consider normal form LWE in this chapter. Furthermore, in this note, the exact specification of the distribution $\chi$ will not matter, and we may simply specify an LWE instance by giving the standard deviation $\sigma$ of $\chi$. We will, furthermore, implicitly assume that $\chi$ is centred, i.e., has expectation 0 . We may also write LWE in matrix form as $\mathbf{A} \cdot \mathbf{s}+\mathbf{e} \equiv \mathbf{c} \bmod q$. The NTRU problem [274] is defined as follows.

Definition $2.2$ (NTRU [274]). Let $n, q$ be positive integers, $f, g \in \mathbb{Z}_q[x]$ be polynomials of degree $n$ sampled from some distribution $\chi$, subject to $f$ being invertible modulo a polynomial $\phi$ of degree $n$, and let $h=g / f \bmod (\phi, q)$. The NTRU problem is the problem of finding $f, g$ given $h$ (or any equivalent solution $\left(x^i \cdot f, x^i \cdot g\right)$ for some $\left.i \in \mathbb{Z}\right)$.

Concretely, the reader may think of $\phi=x^n+1$ when $n$ is a power of two and $\chi$ to be some distribution producing polynomials with small coefficients. The matrix variant considers $\mathbf{F}, \mathbf{G} \in \mathbb{Z}_q^{n \times n}$ such that $\mathbf{H}=\mathbf{G} \cdot \mathbf{F}^{-1} \bmod q$.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Notation and Preliminaries

All vectors are denoted by bold lower case letters and are to be read as column vectors. Matrices are denoted by bold capital letters. We write a matrix $\mathbf{B}$ as $\mathbf{B}=\left(\mathbf{b}0, \ldots, \mathbf{b}{d-1}\right)$ where $\mathbf{b}i$ is the ith column vector of $\mathbf{B}$. If $\mathbf{B} \in \mathbb{R}^{m \times d}$ has fullcolumn rank $d$, the lattice $\Lambda$ generated by the basis $\mathbf{B}$ is denoted by $\Lambda(\mathbf{B})=$ $\left{\mathbf{B} \cdot \mathbf{x} \mid \mathbf{x} \in \mathbb{Z}^d\right}$. A lattice is $q$-ary if it contains $q \mathbb{Z}^d$ as a sublattice, e.g., $\left{\mathbf{x} \in \mathbb{Z}_q^d \mid\right.$ $\mathbf{x} \cdot \mathbf{A}=\mathbf{0}}$ for some $\mathbf{A} \subset \mathbb{Z}^{d \times d^{\prime}}$. We denote by $\left(\mathbf{b}_0^{\star}, \ldots, \mathbf{b}{d-1}^{\star}\right)$ the Gram-Schmidt (GS) orthogonalisation of the matrix $\left(\mathbf{b}0, \ldots, \mathbf{b}{d-1}\right)$. For $i \in{0, \ldots, d-1}$, we denote the orthogonal projection to the span of $\left(\mathbf{b}0, \ldots, \mathbf{b}{i-1}\right)$ by $\pi_i ; \pi_0$ denotes ‘no projection’, i.e., the identity. We write $\pi_{\mathrm{v}}$ for the projection orthogonal to the space spanned by $\mathbf{v}$. For $0 \leq i<j \leq d$, we denote by $\mathbf{B}{[i: j]}$ the local projected block $\left(\pi_i\left(\mathbf{b}_i\right), \ldots, \pi_i\left(\mathbf{b}{j-1}\right)\right)$, and when the basis is clear from context, by $\Lambda_{[i: j]}$ the lattice generated by $\mathbf{B}_{[i: j]}$. We write $\lg (\cdot)$ for the logarithm to base two.

The Euclidean norm of a vector $\mathbf{v}$ is denoted by $|\mathbf{v}|$. The volume (or determinant) of a lattice $\Lambda(\mathbf{B})$ is $\operatorname{vol}(\Lambda(\mathbf{B}))=\prod_i\left|\mathbf{b}_i^{\star}\right|$. It is an invariant of the lattice. The first minimum of a lattice $\Lambda$ is the norm of a shortest non-zero vector, denoted by $\lambda_1(\Lambda)$. We use the abbreviations $\operatorname{vol}(\mathbf{B})=\operatorname{vol}(\Lambda(\mathbf{B})$ ) and $\lambda_1(\mathbf{B})=\lambda_1(\Lambda(\mathbf{B}))$

The Hermite constant $\gamma_\beta$ is the square of the maximum norm of any shortest vector in all lattices of unit volume in dimension $\beta$ :
$$\gamma_\beta=\sup \left{\lambda_1^2(\Lambda) \mid \Lambda \in \mathbb{R}^\beta, \operatorname{vol}(\Lambda)=1\right} .$$
Minkowski’s theorem allows us to derive an upper bound $\gamma_\beta=O(\beta)$, and this bound is reached up to a constant factor: $\gamma_\beta=\Theta(\beta)$.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|LWE and NTRU

LWE 问题和 NTRU 问题已被证明是密码应用程序的通用构建块 [104、218、274、493]。对于这两个问题，都 存在环和矩阵变体。更准确地说，NTRU 的原始定义是环变体 [274]，很少考虑矩阵变体，而对于 LWE，原始定 义是矩阵变体 [494]，后来定义了环变体 $[401,561]$. 在本章中，我们通常处理矩阵变体，因为我们的重点是一 般格的格约简。

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CISS3341

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Towards Block Ciphers

One counter to frequency analysis is to permute pairs of letters, that is, our permutation acts on the set $S$ of pairs of letters, not the alphabet.

Exercise 1.15. For a substitution cipher based on permutations on pairs, write down carefully what the three sets $\mathfrak{R}, \mathfrak{P}, \mathfrak{C}$ are, and implement the two algorithms $\mathcal{E}$ and $\mathcal{D}$. Show that $(\mathfrak{R}, \mathfrak{P}, \mathfrak{C}, \mathcal{E}, \mathcal{D})$ is a symmetric cryptosystem.

Unfortunately, the frequencies of pairs are uneven, which means that frequency analysis still works, although it is less effective. A permutation on triples of letters would be better, but still not perfect.

Even better would be $L$-tuples. The number $L$ is called the block length. Unfortunately, representing a random permutation over a large set is impractical. Merely writing down a permutation requires at least $\log _2\left(|S|^{L} !\right) \approx$ $|S|^L\left(\ln |S|^L-1\right) / \ln 2$ binary digits.

One idea would be to use not a random permutation, but instead use a random member of some smaller family of permutations.

Example 1.5. The Hill cipher is an example of such a family of permutations, the permutations given by invertible matrices. We give our alphabet $R$ a ring structure, say $\mathbb{Z}_{26}$. We denote an $L$-tuple of letters as $\mathrm{m} \in R^L$. An invertible $L \times L$ matrix $\mathbf{K}$ acts on $L$-tuples through matrix multiplication, denoted by $\mathrm{Km}$.

The plaintext $m$ is a sequence of $L$-tuples of letters $\mathrm{m}_1 \mathrm{~m}_2 \ldots \mathrm{m}_l$. The key is an invertible $L \times L$ matrix $\mathbf{K}$. We encrypt the message using the formula
$$\mathrm{c}_i=\mathbf{K}_i, \quad 1 \leq i \leq l .$$
The ciphertext $c$ is the sequence of $L$-tuples $c_1 c_2 \ldots c_l$.
To decrypt a ciphertext $c=\mathrm{c}_1 \ldots \mathrm{c}_l$, we compute the $i$ th plaintext tuple using the formula
$$\mathbf{m}_i=\mathbf{K}^{-1} \mathbf{c}_i, \quad 1 \leq i \leq l .$$

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Practical Mathematical Cryptography

Choosing a good round function is difficult, especially when the goal is to find a round function that can be computed very quickly and that does not require many rounds. Again, this problem is out of scope for this book.

Padding Schemes The plaintext set for the cryptosystem from Exercise $1.24$ is the set of finite sequences of elements from $S$, where each set element is typically an $L$-tuple of letters from the alphabet. In other words, the plaintext set is the set of letter sequences whose length is divisible by $L$.

But when $L$ is large, it is unreasonable to expect message lengths to be a multiple of $L$. We usually need to encrypt arbitrary sequences of letters. Since we need to decrypt correctly, we cannot just append some fixed letter until the sequence length is a multiple of $L$.

We extend a cryptosystem to accept sequences of any length by applying a suitable injective function before encryption.

Definition 1.3. Let $\mathfrak{P}$ and $\mathfrak{P}^{\prime}$ be sets. A padding scheme for $\mathfrak{P}$ and $\mathfrak{P}^{\prime}$ consists of two functions $\iota: \mathfrak{F} \rightarrow \mathfrak{P}^{\prime}$ and $\lambda: \mathfrak{P}^{\prime} \rightarrow \mathfrak{P} \cup{\perp}$ satisfying
$$\lambda(\iota(m))=m \text { for all } m \in \mathfrak{P} \text {. }$$
Exercise 1.25. Suppose you have a cryptosystem $\left(\mathfrak{k}, \mathfrak{P}^{\prime}, \mathfrak{C}, \mathcal{E}^{\prime}, \mathcal{D}^{\prime}\right)$ and a padding scheme $(\iota, \lambda)$ for $\mathfrak{F}$ and $\mathfrak{F}^{\prime}$. Based on the padding scheme and the cryptosystem, construct a new cryptosystem $(\mathfrak{K}, \mathfrak{P}, \mathfrak{C}, \mathcal{E}, \mathcal{D})$. Show that it is indeed a cryptosystem.

Typically, the alphabet is ${0,1}$ and the set is $S={0,1}^L$, bit strings of length $L$. The plaintext set $\mathfrak{P}^{\prime}$ will then be bit strings of length divisible by $L$.

One padding scheme is the following: We first add one 1-bit, then we add 0-bits until the total length is divisible by $L$. If the block size $L$ is 8 , the bit string 10101 will become 10101100 . If the block size $L$ is 5 , the bit string 01010 becomes 0101010000 .

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Towards Block Ciphers

$$\mathrm{c}_i=\mathbf{K}_i, \quad 1 \leq i \leq l .$$

$$\mathbf{m}_i=\mathbf{K}^{-1} \mathbf{c}_i, \quad 1 \leq i \leq l$$

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CS388H

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Affine Cipher

Over a ring, the equation $Y=k_1 X+k_2$ has a unique solution if $k_1$ is invertible in the ring. We shall use this fact to construct an affine cipher.

We give our alphabet $R$ a ring structure, $\mathbb{Z}_{26}$. We add as before. We multiply $\mathrm{F}$ and $\mathrm{G}$ by applying the bijection to get 5 and 6 , multiplying them to get 30, which is 4 modulo 26, and then applying the inverse bijection to get E.

Example 1.3. The affine cipher based on a ring $R$ is the following: The set of keys is $\mathfrak{K}=R^* \times R$, the plaintext set is the set of strings of ring elements, $\mathfrak{P}=\cup_l R^l$, and the ciphertext set is the same, $\mathfrak{C}=\mathfrak{P}$.

• The encryption algorithm $\mathcal{E}$ takes as input a key $\left(k_1, k_2\right) \in R^* \times R$ and a tuple of ring elements $m_1 m_2 \ldots m_l \in R^l$ and computes the ciphertext $c_1 c_2 \ldots c_l \in R^l$ as
$$c_i=k_1 m_i+k_2, \quad 1 \leq i \leq l .$$
• The decryption algorithm $\mathcal{D}$ takes as input a key $\left(k_1, k_2\right) \in R^* \times R$ and a tuple of ring elements $c_1 c_2 \ldots c_l \in R^l$ and computes the message
• $m_1 m_2 \ldots m_l \in R^l$ as
• $$• m_i=k_1^{-1}\left(c_i-k_2\right), \quad 1 \leq i \leq l . •$$
• Exercise 1.5. Show that the affine cipher $(\mathfrak{K}, \mathfrak{P}, \mathfrak{C}, \mathcal{E}, \mathcal{D})$ is a symmetric cryptosystem. Implement the two algorithms $\mathcal{E}$ and $\mathcal{D}$ for the English alphabet.
• Exercise 1.6. How many different keys are there for the affine cipher when the alphabet has 26 elements?

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Substitution Cipher

The formulas (1.1) and (1.2) define bijections on the alphabet. We can generalise these schemes by using any bijection or permutation on our alphabet.
Example 1.4. The substitution cipher on an alphabet $S$ is the following: The set of keys is the set of permutations on $S$. The plaintext set is the set of strings of set elements, $\mathfrak{F}=\cup_l S^l$. The ciphertext set is the same, $\mathfrak{C}=\cup_l S^l$.

• The encryption algorithm $\mathcal{E}$ takes as input a key $\pi$ and a tuple of set elements $m_1 m_2 \ldots m_l \in S^l$ and computes a tuple $c_1 c_2 \ldots c_l \in S^l$ as
$$c_i=\pi\left(m_i\right), \quad 1 \leq i \leq l .$$
• The output is $c_1 c_2 \ldots c_l$.
• The decryption algorithm $\mathcal{D}$ takes as input a key $\pi$ and a tuple $c=$ $c_1 \ldots c_l \in S^l$ and computes a tuple $m_1 m_2 \ldots m_l \in S^l$ as
$$m_i=\pi^{-1}\left(c_i\right), \quad 1 \leq i \leq l .$$
Exercise 1.10. Show that the substitution cipher $(\mathfrak{h}, \mathfrak{P}, \mathfrak{C}, \mathcal{E}, \mathcal{D})$ is a symmetric cryptosystem. Implement two algorithms $\mathcal{E}$ and $\mathcal{D}$ for the English alphabet.
Exercise 1.11. How many different keys are there for the substitution cipher when the alphabet has 26 elements?
• Exercise 1.12. Explain how we can recover part of the key (a partial key) from known plaintext, but not necessarily the full key.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Affine Cipher

• 加密算法 $\mathcal{F}$ 将一个键作为输入 $\left(k_1, k_2\right) \in R^* \times R$ 和一个环形元素元组 $m_1 m_2 \ldots m_l \in R^l$ 并计算密文 $c_1 c_2 \ldots c_l \in R^l$ 作为
$$c_i=k_1 m_i+k_2, \quad 1 \leq i \leq l .$$
• 解密算法 $\mathcal{D}$ 将一个键作为输入 $\left(k_1, k_2\right) \in R^* \times R$ 和一个环形元素元组 $c_1 c_2 \ldots c_l \in R^l$ 并计算消息
• $m_1 m_2 \ldots m_l \in R^l$ 作为
• $\$ \$$• \ \$$
• 练习 1.5。表明仿射密码 $(\mathfrak{K}, \mathfrak{P}, \mathfrak{C}, \mathcal{E}, \mathcal{D})$ 是对称密码体制。实现两种算法 $\mathcal{G}$ 和 $\mathcal{D}$ 为英文字母表。
• 练习 1.6。当字母表有 26 个元素时，仿射密码有多少个不同的密钥?

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Substitution Cipher

• 加密算法 $\mathcal{E}$ 将一个键作为输入 $\pi$ 和一个集合元素的元组 $m_1 m_2 \ldots m_l \in S^l$ 并计算一个元组 $c_1 c_2 \ldots c_l \in S^l$ 作为
$$c_i=\pi\left(m_i\right), \quad 1 \leq i \leq l .$$
• 输出是 $c_1 c_2 \ldots c_l$.
• 解密算法 $\mathcal{D}$ 将一个键作为输入 $\pi$ 和一个元组 $c=c_1 \ldots c_l \in S^l$ 并计算一个元组 $m_1 m_2 \ldots m_l \in S^l$ 作为
$$m_i=\pi^{-1}\left(c_i\right), \quad 1 \leq i \leq l .$$
练习 1.10。表明替代密码 $(\mathfrak{h}, \mathfrak{P}, \mathfrak{C}, \mathcal{E}, \mathcal{D})$ 是对称密码体制。实现两种算法 $\mathcal{E}$ 和 $\mathcal{D}$ 为英文字母表。
练习 1.11。当字母表有 26 个元素时，替换密码有多少个不同的密钥?
• 练习 1.12。解释我们如何从已知明文中恢复部分密钥（部分密钥），但不一定是完整密钥。

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CS6260

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学Cryptography & Cryptanalysis方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学Cryptography & Cryptanalysis代写方面经验极为丰富，各种代写密码学Cryptography & Cryptanalysis相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|CONFIDENTIALITY AGAINST EAVESDROPPERS

The situation we shall now consider has Alice sending messages to Bob while Eve eavesdrops. Eve wants to understand what Alice is saying to Bob.

Our discussion involves historic cryptosystems because this gives us a gentle introduction to the basic concepts in cryptography and provides some insight into important attack strategies. The presentation in this section alternates between describing a cryptosystem and describing how to attack that cryptosystem until we reach systems that will provide confidentiality.

Informally. A symmetric cryptosystem provides confidentiality if it is – without knowledge of the key – hard to learn anything at all about the decryption of a ciphertext from the ciphertext itself, except possibly the length of the decryption.

Remark. It cannot be emphasised strongly enough that cryptography does not try to hide the length of the plaintext. The reason is that this would be prohibitively expensive. However, this means that applications where the length of messages must do so themselves, perhaps by using fixed-length encodings.

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Shift Cipher

The shift cipher is also known as the Cassar cipher.
We first give our alphabet $G$ a group structure. There is a natural bijection between the English alphabet ${\mathrm{A}, \mathrm{B}, \mathrm{C}, \ldots, \mathrm{Z}}$ and the group $\mathbb{Z}_{26}^{+}$, given by $0 \leftrightarrow \mathrm{A}, 1 \leftrightarrow \mathrm{B}$, etc. We add $\mathrm{F}$ and $\mathrm{G}$ by applying the bijection to get 5 and 6 , adding them to 11 , and then applying the inverse bijection to get $\mathrm{L}$.

Remark. Unless explicitly said otherwise, for any finite group we discuss, there is a canonical representation for group elements, and we always use this representation. This is important. If group elements have multiple representations, the representation could contain information about more than just the group element, such as how the group element was computed.

The plaintext $m$ is a sequence of letters $m_1 m_2 \ldots m_l$ from the alphabet. The key is an element $k$ from $G$. We encrypt the message by adding the key to each letter, that is, the $i$ th ciphertext letter is
$$c_i=m_i+k, \quad 1 \leq i \leq l .$$
The ciphertext $c$ is the sequence of letters $c_1 c_2 \ldots c_l$.
To decrypt a ciphertext $c=c_1 \ldots c_l$, we subtract the key from each ciphertext letter, that is, the $i$ th plaintext letter is
$$m_i=c_i-k, \quad 1 \leq i \leq l .$$
Example 1.1. The shift cipher based on a group $G$ is the following: The set of keys is the group, $\mathfrak{R}=G$. The plaintext set is the set of strings of group elements, $\mathfrak{}}=\cup_l G^l$. The ciphertext set is the same, $\mathfrak{C}=\cup_l G^l$.

• The encryption algorithm $\mathcal{E}$ takes as input a key $k \in G$ and a tuple of group elements $m_1 m_2 \ldots m_l \in G^l$ and computes the ciphertext $c_1 c_2 \ldots c_l \in G^l$ as
$$c_i \leftarrow m_i+k, \quad 1 \leq i \leq l .$$

## 数学代写|密码学作业代写Cryptography & Cryptanalysis代考|Shift Cipher

$$c_i=m_i+k, \quad 1 \leq i \leq l .$$

$$m_i=c_i-k, \quad 1 \leq i \leq l .$$

• 加密算法 $\mathcal{E}$ 将一个键作为输入 $\lambda \in G$ 和一组元素的元组 $m_1 m_2 \ldots m_l \in G^l$ 并计算密文 $c_1 c_2 \ldots c_l \in G^l$ 作为
$$c_i \leftarrow m_i+k, \quad 1 \leq i \leq l .$$

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。

## 数学代写|密码学代写cryptography theory代考|CISS3341

statistics-lab™ 为您的留学生涯保驾护航 在代写密码学cryptography theory方面已经树立了自己的口碑, 保证靠谱, 高质且原创的统计Statistics代写服务。我们的专家在代写密码学cryptography theory代写方面经验极为丰富，各种代写密码学cryptography theory相关的作业也就用不着说。

• Statistical Inference 统计推断
• Statistical Computing 统计计算
• (Generalized) Linear Models 广义线性模型
• Statistical Machine Learning 统计机器学习
• Longitudinal Data Analysis 纵向数据分析
• Foundations of Data Science 数据科学基础

## 数学代写|密码学代写cryptography theory代考|RC4 Key Schedule Algorithm

The key scheduling algorithm is rather simple. We begin with an internal state that is denoted by a capital $S$. This state is a 256-byte array. While most of what you have seen so far involves bits, not bytes, this is not a typo. It is a 256-byte array. There are two indexes usually simply named $i$ and $j$. These indexes are used to point to individual elements in the array. The key scheduling algorithm involves shuffling this array.

The first step in this algorithm involves simply initializing the state with what is termed the identity permutation. This simply means that the first element is initialized to 0 , the second element to 1 , the third to 0 , and so on. Now obviously this is not very random at all, in fact it is the antithesis of random. So, the next step consists of shuffling. The shuffling involves iterating 256 times performing the following actions:

• compute $j=j+S[i]+\operatorname{key}[i \bmod$ key length $]$,
• swap $S[i]$ and $S[j]$,
• increment $i$.
After 256 iterations of this the array should be shuffled rather well. If you happen to have some programming experience, then the following pseudo code may assist you in understanding the shuffling:
for $i$ from 0 to 255
$$S[i]:=i$$
end for loop
$$j:=0$$
for $i$ from 0 to 255
$j:=(j+S[i]+k e y[i \bmod$ key length $]) \bmod 256$
swap values of $S[i]$ and $S[j]$
end for loop
Now you may argue that this is too predictable, that it would generate the same key each time. And if the algorithm stopped here you would be correct. This is generating a state that will be used to create the keystream. We are not done yet.
The rest of the algorithm allows for the generation of a keystream of any size. The goal is to have a keystream that is the same size as the message you wish to encrypt.

The one-time pad is the only true uncrackable encryption, if used properly. It should be clear that this is only true if used properly. This idea was first described in 1882, but then re-discovered and even patented in the early twentieth century. The first aspect of this idea is that a random key is used that is as long as the actual message. The reason this is so useful is that if the key is sufficiently random then there will be no period in the key. Periods in keys are used as part of cryptanalysis. The second aspect of this idea is actually in the name: the key is used for one single message then discarded and never used again. Should the encryption somehow be broken, and the key discovered (and this has never been done) it would cause minimal damage as that key will never be used again.

The patented version of this was invented in 1917 by Gilbert Vernam working at AT\&T. It was patented in 1919 (U.S. Patent 1,310,719). This was called a Vernam cipher. It worked with tele-printer technology (the state of the art at that time). It combined each character of the message with a character on a paper tape key.
One-time pads are often described as being “information-theoretically secure.” This is because the ciphertext provides no information about the original plain text. Claude Shannon, the father of information theory, provided that a one-time pad provided what he termed perfect secrecy. It should be obvious, however, that there are logistical issues with the one-time pad. Each message needs a new key. As we will see in Chap. 12, generating random numbers can be computationally intensive. Then we are left with the issue of key exchange. Imagine for a moment that secure website traffic was conducted with a one-time pad. That would require a key be generated and exchanged for each and every packet sent between the web browser and the server. The overhead would make communication impractical. For this reason, one-time pads are usually only used in highly sensitive communications wherein the need for security makes the cumbersome nature of key generation and exchange worth the effort.

## 数学代写|密码学代写cryptography theory代考|密钥调度算法

• compute $j=j+S[i]+\operatorname{key}[i \bmod$ key length $]$，
• swap $S[i]$ and $S[j]$，
• increment $i$ .
经过256次迭代后，数组应该洗选得很好。如果你碰巧有一些编程经验，那么下面的pseudo代码可能会帮助你理解洗选:
for $i$ from 0 to 255
$$S[i]:=i$$
end for loop
$$j:=0$$
for $i$ from 0 to 255
$j:=(j+S[i]+k e y[i \bmod$ key length $]) \bmod 256$
$S[i]$和$S[j]$的交换值
end for loop
现在你可能会说这太可预测了，因为它每次都会生成相同的键。如果算法停在这里，你就对了。这将生成用于创建密钥流的状态。我们还没有结束。算法的其余部分允许生成任意大小的密钥流。我们的目标是拥有一个与您希望加密的消息相同大小的密钥流。

## 有限元方法代写

tatistics-lab作为专业的留学生服务机构，多年来已为美国、英国、加拿大、澳洲等留学热门地的学生提供专业的学术服务，包括但不限于Essay代写，Assignment代写，Dissertation代写，Report代写，小组作业代写，Proposal代写，Paper代写，Presentation代写，计算机作业代写，论文修改和润色，网课代做，exam代考等等。写作范围涵盖高中，本科，研究生等海外留学全阶段，辐射金融，经济学，会计学，审计学，管理学等全球99%专业科目。写作团队既有专业英语母语作者，也有海外名校硕博留学生，每位写作老师都拥有过硬的语言能力，专业的学科背景和学术写作经验。我们承诺100%原创，100%专业，100%准时，100%满意。

## MATLAB代写

MATLAB 是一种用于技术计算的高性能语言。它将计算、可视化和编程集成在一个易于使用的环境中，其中问题和解决方案以熟悉的数学符号表示。典型用途包括：数学和计算算法开发建模、仿真和原型制作数据分析、探索和可视化科学和工程图形应用程序开发，包括图形用户界面构建MATLAB 是一个交互式系统，其基本数据元素是一个不需要维度的数组。这使您可以解决许多技术计算问题，尤其是那些具有矩阵和向量公式的问题，而只需用 C 或 Fortran 等标量非交互式语言编写程序所需的时间的一小部分。MATLAB 名称代表矩阵实验室。MATLAB 最初的编写目的是提供对由 LINPACK 和 EISPACK 项目开发的矩阵软件的轻松访问，这两个项目共同代表了矩阵计算软件的最新技术。MATLAB 经过多年的发展，得到了许多用户的投入。在大学环境中，它是数学、工程和科学入门和高级课程的标准教学工具。在工业领域，MATLAB 是高效研究、开发和分析的首选工具。MATLAB 具有一系列称为工具箱的特定于应用程序的解决方案。对于大多数 MATLAB 用户来说非常重要，工具箱允许您学习应用专业技术。工具箱是 MATLAB 函数（M 文件）的综合集合，可扩展 MATLAB 环境以解决特定类别的问题。可用工具箱的领域包括信号处理、控制系统、神经网络、模糊逻辑、小波、仿真等。