(Sign-then-Double-Encrypt) Aldebaran computes σ = Sign(sk′ A, m), and cσ = Enc(pkC, Enc(pkB, σ)). Aldebaran sends cσ along with their usual broadcast, (pkC, cdest, cmsg). Chandra performs her usual steps, as well as decrypting to obtain c ′ σ = Dec(skC, cσ). She sends it along with her usual broadcast, (pkB, c′ msg) for Borealis. Lastly, Borealis, who will receives the message m, now also obtains σ = Dec(skB, c′ σ ). Borealis believes the message should have come from Aldebaran. He runs Verify(pk′ A, m, σ) and is satisfied only if the signature accepts

Aldebaran computes cmsg = Enc(pkC , m), cdest = Enc(pkC , pkB ) and broadcasts (pkC , cmsg, cdest). Chandra observes the broadcast containing her public key. She then computes m = Dec(skC , cmsg) and pkdest = Dec(skC , cdest). Lastly, she re-encrypts c′ = Enc(pkdest, m) and broadcasts (pkdest, c′). Borealis identifies their public key in the broadcast and obtains the message m = Dec(skB , c′). state Secure or Insecure, and explain why that approach does or does not achieve the two desired notions of confidentiality described above.

Aldebaran computes cmsg = Enc(pkC, m), cdest = Enc(pkC, pkB) and broadcasts(pkC, cmsg, cdest). Chandra observes the broadcast containing her public key. She then decrypts the destination address as pkdest = Dec(skC, cdest) and broadcasts (pkdest, cmsg). Borealis then obtains the message as m = Dec(skB, cmsg).Is it secure?

. For each approach, state Secure or Insecure, and explain why that approach does or does not achieve the two desired notions of confidentiality described above.Aldebaran computes cmsg = Enc(pkC, m), cdest = Enc(pkC, pkB) and broadcasts(pkC, cmsg, cdest). Chandra observes the broadcast containing her public key. She then computes m = Dec(skC, cmsg) and pkdest = Dec(skC, cdest) and broadcasts (pkdest, m). Borealis identi￾fies their public key in the broadcast and obtains the message m. 1 (d) Aldebaran computes cmsg = Enc(pkC, m), cdest = Enc(pkC, pkB) and broadcasts(pkC, cmsg, cdest). Chandra observes the broadcast containing her public key. She then computes m = Dec(skC, cmsg) and pkdest = Dec(skC, cdest). Lastly, she re-encrypts c ′ = Enc(pkdest, m) and broadcasts (pkdest, c′ ). Borealis identifies their public key in the broadcast and obtains the message m = Dec(skB, c′ ).

Some time later, Chandra receives a different broadcast (38, cmsg, cdest) where cdest = (55, 10) and cmsg = (c1, c2) = ((101, 28),(90, 94)). i. (2 marks) Confirm whether or not Chandra’s public key corresponds to her secret key skC = 22. ii. (5 marks) Who is the final intended recipient of the message? (Hint: compute the Elgamal decryption Dec(skC, cdest) and compare with the known public keys.) iii. (6 marks) Hence, what does Chandra broadcast? (Hint: compute the Elgamal decryptions Dec(skC, c1) and Dec(skC, c2))

(a) Aldebaran wishes to send a message m = 33 to Borealis. i. (2 marks) Confirm whether or not Aldebaran’s public key corresponds to the secret key skA = 7. ii. (5 marks) In the first step, Aldebaran must compute the Elgamal encryption (c1, c2) = Enc(pkB, m). Suppose during encryption, Aldebaran randomly samples a = 33, as in where c1 = g a . What is (c1, c2)? Note: Aldebaran will perform the rest of the steps to convey this message by themselves.