# Fiat–Shamir: why do r and s have to be smaller than n?

I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be smaller than $n$ (the RSA-like Modulus). I am wondering why this has to be.

The verification works even if $r$ and $s$ are greater than $n$. Also, if $r$ is smaller than $n$, an observer could calculate $r$, using the equation $y=r*s^e$ mod $n$. If $e=0$, this is equal to $y=r$ mod $n$, and since $r<n$, this is the same as $y=r$, so if somebody gets to know $y$, he would also know $r$. I thought that somebody was not supposed to be able to get information out of the knowledge of $y$ or $x$.

Is there something I am getting wrong here?

Because we are working modulo $n$. There's not much more to say. There's no reason why any honest user would ever want to use a larger value. You might want to review modular arithmetic and its use in cryptography.
• Exactly. For the second part with $e=0$ you may also suggest to the OP to study what the protocol wants to achieve. I guess the slides the OP uses may not provide sufficient details for his/her level of knowledge. – DrLecter Jun 18 '14 at 21:47