Quoting the handbook of applied cryptography, chapter 10.3.3 (i):

Identification based on PK decryption and witness. Consider the following protocol:

  1. $A \leftarrow B: h(r), B, P_A(r,B)$
  2. $A \rightarrow B: r$

(Before “2.”, $A$ verifies that $r' = r$ and $B' = B$)

My questions are:

  1. Why is $B$ needed in the encrypted part and in the plan part? I understand that $h(r)$ is sent as a witness to prevent $A$ from becoming a decryption oracle to $B$. But why is the public key sent? What purpose the verification $B = B'$ serve?

  2. If $B$ has to be sent, could $h(B)$ be sent instead in the encrypted portion (or in both)?

  • 1
    $\begingroup$ "The public key of A is public knowledge, so the attacker could encrypt $P_A(r,B)$ again with a different B." – not if the attacker knows only $h(r)$, and not $r$. $\endgroup$ – otus Jul 30 '14 at 16:58
  • $\begingroup$ @otus, you are right - it is assumed that no attacker knows $r$ (only $h(r)$, otherwise he could authenticate himself. :-) Still, what purpose does sending $B$ (plain and encrypted) serve in the first place. I removed the passage from the question. $\endgroup$ – dubadu Jul 30 '14 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.