According to the paper “GQ and Schnorr Identification Schemes: Proofs of Security against Impersonation under Active and Concurrent Attacks” by Mihir Bellare and Adriana Palacio, the Schnorr identification scheme is secure under an active adversary who changes messages. I have been told that Schnorr is actually not secure against such an adversary but I am not able to find any new literature on it. Any ideas?
$\begingroup$
$\endgroup$
2
-
$\begingroup$ Maybe security = detection of altered messages? $\endgroup$– rathCommented Oct 15, 2013 at 0:50
-
$\begingroup$ Say Eve is trying to pose as Alice to Bob. If Bob can detect that the messages he is receiving have been altered then Alice cannot prove her identity to Bob. But the point is that Eve is successfully able to identify herself as Alice to Bob if she can change the messages being exchanged. I am wondering how that's possible. $\endgroup$– TheNoobCommented Oct 15, 2013 at 1:56
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
It is important to consider the model in which security is proved. In this case, the attack proceeds in two phases: first a phase where the adversary as a verifier interacts with the honest prover, then a phase where the adversary as a prover interacts with an honest verifier. The adversary wins if the honest prover accepts. The paper proves, under reasonable assumptions, that the adversary cannot win in this model.
However (see the comment at the end of Section 2), this model is very restricted and not so useful. In more useful models where the adversary interacts with the honest prover and the honest verifier at the same time, the Schnorr identification protocol is absolutely hopeless, which isn't surprising since it wasn't designed with those models in mind.
-
$\begingroup$ Thanks. Do you know any reference for this type of an attack where the adversary interacts with the prover and verifier at the same time? $\endgroup$– TheNoobCommented Oct 15, 2013 at 23:47
-
$\begingroup$ Nothing not already covered by the Bellare-Palacio paper. $\endgroup$– K.G.Commented Oct 16, 2013 at 6:44