# Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i):

Identification based on PK decryption and witness. Consider the following protocol:

1. $A \leftarrow B: h(r), B, P_A(r,B)$
2. $A \rightarrow B: r$

(Before “2.”, $A$ verifies that $r' = r$ and $B' = B$)

My questions are:

1. Why is $B$ needed in the encrypted part and in the plan part? I understand that $h(r)$ is sent as a witness to prevent $A$ from becoming a decryption oracle to $B$. But why is the public key sent? What purpose the verification $B = B'$ serve?

2. If $B$ has to be sent, could $h(B)$ be sent instead in the encrypted portion (or in both)?

-
"The public key of A is public knowledge, so the attacker could encrypt $P_A(r,B)$ again with a different B." – not if the attacker knows only $h(r)$, and not $r$. – otus Jul 30 '14 at 16:58
@otus, you are right - it is assumed that no attacker knows $r$ (only $h(r)$, otherwise he could authenticate himself. :-) Still, what purpose does sending $B$ (plain and encrypted) serve in the first place. I removed the passage from the question. – dubadu Jul 30 '14 at 21:57