I have a clarification that may help with Question 6 on the midterm. As someone else pointed out to me yesterday, E' is not in general decryptable, because the decryptor may not know the random coins used by E_pk (remember that in general E_pk might be a randomized algorithm).

To repair this, you can pick one of the following interpretations:

• Ignore the fact that the scheme on the exam isn't decryptable, and answer the question anyway. (The definitions of security all still make sense, I believe.)
• Modify the scheme so that the random coins used in computing E_{pk}(r) are also transmitted: i.e., the ciphertext will now be (r, r', E_{pk}(r) xor m), where r' are the coins used by E in this encryption.

Under the philosophy that if I write an ambiguous question, you ought to get the benefit of the doubt in interpreting it in a reasonable way, you can feel free to choose either one of those two options and answer the question with that modification.

If you have any further questions, please don't hesitate to ask us.