Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Quoting the handbook of applied cryptography, chapter 10.3.3 (i):

Identification based on PK decryption and witness. Consider the following protocol:

  1. $A \leftarrow B: h(r), B, P_A(r,B)$
  2. $A \rightarrow B: r$

(Before “2.”, $A$ verifies that $r' = r$ and $B' = B$)

My questions are:

  1. Why is $B$ needed in the encrypted part and in the plan part? I understand that $h(r)$ is sent as a witness to prevent $A$ from becoming a decryption oracle to $B$. But why is the public key sent? What purpose the verification $B = B'$ serve?

  2. If $B$ has to be sent, could $h(B)$ be sent instead in the encrypted portion (or in both)?

share|improve this question
"The public key of A is public knowledge, so the attacker could encrypt $P_A(r,B)$ again with a different B." – not if the attacker knows only $h(r)$, and not $r$. – otus Jul 30 '14 at 16:58
@otus, you are right - it is assumed that no attacker knows $r$ (only $h(r)$, otherwise he could authenticate himself. :-) Still, what purpose does sending $B$ (plain and encrypted) serve in the first place. I removed the passage from the question. – dubadu Jul 30 '14 at 21:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.