Errata

IND-CCA Definition, Definition 5.28 on page 247 (found by Rami Khalil)

The definition falsely inherited the winning condition from the symmetric case. Lines 3 and 4 in Dec should be removed, and Line 8 in the Experiment should read: "return b=b'" and drop the part about win.

Euclidean Algorithm, Figure 10.1, page 411 

Line 2 in the gcd algorithm should be "return b".

Herding Attack, starting on page 516

The analysis for the offline step lacks the case that within a bucket for a value y there may be a message m connecting to some bucket, but message m' in bucket y may connect to a different bucket (in which case y cannot be used). This has been discussed in the paper by Blackburn, Stinson, and Upadhyay. Luckily, this is fixable, causing an additional factor of O(sqrt(n)) in the overall run time.