253 reputation
8
bio website
location
age
visits member for 10 months
seen 15 hours ago

Apr
7
awarded  Critic
Apr
6
awarded  Editor
Apr
6
answered Difference between collision resistance and target collision resistance
Feb
12
awarded  Student
Feb
12
awarded  Scholar
Feb
12
accepted Pseudo random permutation for arbitrary size domains
Feb
11
asked Pseudo random permutation for arbitrary size domains
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
Great, that was the missing step :). So the argument goes like this: For $r=\log_g(t)$ and $x=\log_g(x)$ we have $g^s = t^c y \Rightarrow g^s=g^{rc} g^x \Rightarrow s=rc+x \Rightarrow sc^{-1}=(rc+x)c^{-1}=r+xc^{-1}$. Now suppose $V'$ (the original Schnorr protocol verifier) challenges $A$ with $c'$ then $A$ challenges $P$ with $c'^{-1}$ who returns $s$. $A$ now answers $V'$ with $sc^{-1}=r+xc^{-1}=r+xc'$ which will convince $V'$. Yes, that proof is also nice :D. Thanks for the discussion.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
You also assume $s=rc+x$ in the calculation "$sc^{-1} = (rc + x)c^{-1} = r + xc^{-1}$". My argumentation is not about $A$ knowing $r$ or $x$, but that $s\neq rc+x$ might be the case.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
Okay, I'll phrase it differently. Suppose there was some way for $P$ to cheat $V$, i.e. supply a $t$ and $s$ that fulfil $g^s = t^c y$ without knowing $x$. Since $P$ does not know $x$ there is no reason to assume $t=g^r$ and $s=r+cx$. Since we don't know that, there is also no reason to assume that $A$ is successful to impersonate $P'$ participating in the original Schnorr protocol. Everything we deduce has to be an implication of the identity $V$ actually checks, i.e. $g^s = t^c y$.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
You do not need to know the values to perform the calculation, yes. But as a verifier you do not know that $s=r+cx$ for some $r$ such that $t=g^r$ and some $x$ such that $g^x=y$. You only got some value $t$ and some value $s$ from $P$ that you know nothing about. If $V$ would trust $P$ enough to believe his statement that $s=r+cx$ for the above $r$ and $x$ then $V$ could immediately trust $P$ to know the discrete logarithm of $y$.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
The idea is correct, but you cannot argue using the structure of $s$, as it possibly comes from an attacker. But what you can do is plug it into the verification (assuming $c\neq 0$): $g^s = t^c y\Leftrightarrow (g^s)^{(c^{-1})}=(t^c y)^{(c^{-1})}\Leftrightarrow g^{s'} = t y^{(c^{-1})}$ for $s'=s\cdot c^{-1}$. Now you can use the classic proof that $P$ knows $x$ with high probability. Also, as multiplying with $c^{-1}$ is bijective the simulator needed for the zero knowledge property can be also be used with your substitution $s\leftrightarrow sc^{-1}$.
Aug
15
awarded  Commentator
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
Now I'm sure the first ($s=r+c+x$) cannot work, as $V$ can calculate $s_2$ out of $s_1$ as $s_2=s_1+c_2-c_1$. Thus being able to answer to two distinct challenges proofs nothing.
Aug
15
comment Could this be a valid variation of the Schnorr protocol?
Don't look at the structure of 3), look at the structure of 4). $V$ cannot know which structure is actually behind 3) and can only verify what he can see in step 4). Try to build a proof for the knowledge of $x$ out of the verification that $g^{s_1} = t g^{c_1} y$ and $g^{s_2} = t g^{c_2} y$ or $g^{s_1} = t^{c_1} y$ and $g^{s_1} = t^{c_1} y$. I don't see how this could work.
Aug
15
answered Could this be a valid variation of the Schnorr protocol?
Aug
14
comment What security flaw exists in MAC authentication scenario?
@chux Cryptography and IT-Security in general is a subtle field :) If these are not problematic for you then it seems fine. Depending on the use case though B-Con is right that asymmetric might be a better choice.
Aug
14
comment What security flaw exists in MAC authentication scenario?
@chux: What about selectively blocking messages? Without the associated counter B will never know if one message in-between two others was not transmitted.
Aug
14
awarded  Supporter
Aug
14
answered What security flaw exists in MAC authentication scenario?