2008-02-15:

* Homework 5, solution for problem 2 added (thanks to Christian Engels
  for pointing out the missing solution).

2008-02-16:

* Lecture notes, theorem 4: The NP-relation is called R' (not
  R). (P,V) is a proof system for R, and (P',V') is a proof system for
  R'.

* Lecture notes, definition 21 (equivocal commitments), equivocality:
  In the right hand side of the computational indistinguishability,
  crs is chosen by KeyGen(1^n) (like in the lhs).

* Lecture notes, several places: "polynomial-time in its first argument"
  should be "polynomial-time in its first input".

* Lecture notes, theorem 13: \vee should be \vee_{M_1,M_2}.

* Construction 3 & theorem 14: hard-code should be hard-core.

* Theorem 15: Hamiltonian circle should be Hamiltonian cycle.

* Definition 28 & definition 29: m_n should be m_b.

* Definition 28 & definition 29: The probability should not be
  negligible, but \leq\frac12+\mu for negligible \mu.

* Definition 31 (Unbounded adaptive NICZK argument), adaptive
  computational zero-knowledge: The adversary A should get
  the CRS as an additional argument.

* Construction 4: "for messages of length" should be removed.

* Homework 1, problem 2d, solution, soundness: In the calculation,
  some (but not all) occurrences of s_1 should be s_0.

* Homework 2, problem 2, notation: S_1 fails if i\neq i^*, not if i=i^*

* Homework 5, problem 1d, solution: The domain of f is {0,1}, not {0,1}^n.

* Homework 7, problem 1: q is the order of G

* Homework 9, problem 2, second line: (P_1,V_2) should be (P_1,V_1)

Thanks to Raphael Reischuk for point out the above and many more (I
have only listed those corrections that are relevant for the
understanding of the text).