Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be smaller than $n$ (the RSA-like Modulus). I am wondering why this has to be.

The verification works even if $r$ and $s$ are greater than $n$. Also, if $r$ is smaller than $n$, an observer could calculate $r$, using the equation $y=r*s^e$ mod $n$. If $e=0$, this is equal to $y=r$ mod $n$, and since $r<n$, this is the same as $y=r$, so if somebody gets to know $y$, he would also know $r$. I thought that somebody was not supposed to be able to get information out of the knowledge of $y$ or $x$.

Is there something I am getting wrong here?

share|improve this question

Because we are working modulo $n$. There's not much more to say. There's no reason why any honest user would ever want to use a larger value. You might want to review modular arithmetic and its use in cryptography.

share|improve this answer
Exactly. For the second part with $e=0$ you may also suggest to the OP to study what the protocol wants to achieve. I guess the slides the OP uses may not provide sufficient details for his/her level of knowledge. – DrLecter Jun 18 '14 at 21:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.