# Challenge-response based on public-key decryption, why send public key

Quoting the handbook of applied cryptography, chapter 10.3.3 (i):

Identification based on PK decryption and witness. Consider the following protocol:

1. $$A \leftarrow B: h(r), B, P_A(r,B)$$
2. $$A \rightarrow B: r$$

(Before “2.”, $$A$$ verifies that $$r' = r$$ and $$B' = B$$)

My questions are:

1. Why is $$B$$ needed in the encrypted part and in the plan part? I understand that $$h(r)$$ is sent as a witness to prevent $$A$$ from becoming a decryption oracle to $$B$$. But why is the public key sent? What purpose the verification $$B = B'$$ serve?

2. If $$B$$ has to be sent, could $$h(B)$$ be sent instead in the encrypted portion (or in both)?

• "The public key of A is public knowledge, so the attacker could encrypt $P_A(r,B)$ again with a different B." – not if the attacker knows only $h(r)$, and not $r$. – otus Jul 30 '14 at 16:58
• @otus, you are right - it is assumed that no attacker knows $r$ (only $h(r)$, otherwise he could authenticate himself. :-) Still, what purpose does sending $B$ (plain and encrypted) serve in the first place. I removed the passage from the question. – dubadu Jul 30 '14 at 21:57