Would either $\alpha$ or $r$ suffice as challenge?
I am aware that the signature and verification were to adapt. However, what is the motivation behind using two challenges?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Assume the verifier is honest so that the adversary wants to fool the verifier using a previous transcript.
$\alpha$ is necessary. If not, then let $\alpha=0$. The adversary gets $g^k, r, s = k^{-1}xr$ and computes $k^{-1}x$. Then, for some random $t$ it computes $I' = g^{tk}, u' = (tk)^{-1}x$ which can fool the verifier for any random challenge $r'$ by sending $I'$ and $s' = u'r'$.
I am unsure if $r$ is necessary. Please post the full context.
-
$\begingroup$ Without r, if Eve can get the prover to use the same k to sign two different values of alpha then she can recover k, and hence x, the private key. If r is included, this doesn't work. I am trying to find a solution for how alpha lets the private key be recovered from a single signature, or similar, but this is potentially also a good reason. $\endgroup$– whatf0xxAug 4 at 11:42
-
$\begingroup$ I agree with that the attack works when "use the same k" twice. However, this is unnatural since the prover is partly compromised and $k$ is the only randomization of the prover. $\endgroup$– xacidAug 17 at 14:50