Errata

Collision Resistance implies One-Wayness, Proposition 4,5, page 170 (reported by Patrick Harasser and by Daniele Micciancio) 

The proposition claims that any compressing collision-resistant hash function is also one-way. The proof first covers the case of regular hash functions (where each image has the same number of preimages) and then generalizes the claim to arbitrary hash functions.  The first part about regular hash functions is correct, but the second part does not hold. The reason is that the one-way attacker B could invert only on images with a unique preimage. In this case, the last equation in the proof,  the conditional probability for B inverting under the condition  "ManyPreimages" may be 0 and not exceed the (unconditional) probability for inverting. Indeed, one can construct a counterexample to the claim along this line for such mildly compressing hash functions (which map n+O(log n) bits to n bits).

If the hash function compresses superlogarithmically in the bit length, i.e., if the hash function maps n+\omega(log n) bits to n bits, then one can resurrect the general implication.  In this case, the probability that an image under a random input has more than one preimage is overwhelming, because there are at most 2^n inputs whose images do not have another colliding preimage. The probability of picking such an input is at most 2^n / 2^(n+\omega(log n)) and thus negligible. Hence, we can restrict B's success probabilities to cases where the hash value has multiple preimages, losing only a negligible amount in its success probability. 

IND-CCA Definition, Definition 5.28 on page 247 (reported by Rami Khalil)

The definition falsely inherited the winning condition from the symmetric case. Lines 3 and 4 in Dec should be removed, and Line 8 in the Experiment should read: "return b=b'" and drop the part about win.

Euclidean Algorithm, Figure 10.1, page 411 

Line 2 in the gcd algorithm should be "return b".

Herding Attack, starting on page 516

The analysis for the offline step lacks the case that within a bucket for a value y there may be a message m connecting to some bucket, but message m' in bucket y may connect to a different bucket (in which case y cannot be used). This has been discussed in the paper by Blackburn, Stinson, and Upadhyay. Luckily, this is fixable, causing an additional factor of O(sqrt(n)) in the overall run time.