Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to the paper “GQ and Schnorr Identification Schemes: Proofs of Security against Impersonation under Active and Concurrent Attacks” by Mihir Bellare and Adriana Palacio, the Schnorr identification scheme is secure under an active adversary who changes messages. I have been told that Schnorr is actually not secure against such an adversary but I am not able to find any new literature on it. Any ideas?

share|improve this question
Maybe security = detection of altered messages? – rath Oct 15 '13 at 0:50
Say Eve is trying to pose as Alice to Bob. If Bob can detect that the messages he is receiving have been altered then Alice cannot prove her identity to Bob. But the point is that Eve is successfully able to identify herself as Alice to Bob if she can change the messages being exchanged. I am wondering how that's possible. – TheNoob Oct 15 '13 at 1:56

It is important to consider the model in which security is proved. In this case, the attack proceeds in two phases: first a phase where the adversary as a verifier interacts with the honest prover, then a phase where the adversary as a prover interacts with an honest verifier. The adversary wins if the honest prover accepts. The paper proves, under reasonable assumptions, that the adversary cannot win in this model.

However (see the comment at the end of Section 2), this model is very restricted and not so useful. In more useful models where the adversary interacts with the honest prover and the honest verifier at the same time, the Schnorr identification protocol is absolutely hopeless, which isn't surprising since it wasn't designed with those models in mind.

share|improve this answer
Thanks. Do you know any reference for this type of an attack where the adversary interacts with the prover and verifier at the same time? – TheNoob Oct 15 '13 at 23:47
Nothing not already covered by the Bellare-Palacio paper. – K.G. Oct 16 '13 at 6:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.