0
$\begingroup$

Schnorr's identification protocol is said to be a honest verifier zero knowledge protocol. Does it imply it will not work if the verifier is dishonest? I'm wondering if this is the case, it would mean that a honest prover will always be denied authorization by the misbehaved verifier.

$\endgroup$
2
$\begingroup$

No, this is not the case. We can't guarantee an honest prover is verified by a dishonest verifier (they could always lie and say "no, you failed"), but they could very well be authorized by the dishonest verifier (in addition to lying and saying "you passed" for everyone, they could act like the honest verifier if it's to their advantage). A dishonest verifier can generally do anything, so it's impossible to say anything about whether the prover will be verified by them. In addition, the most likely sort of dishonest verifier (the one who seems to be following the protocol, such that a third party seeing the messages doesn't know they're dishonest) will always authenticate honest provers.

What "honest verifier" refers to is not the authentication bit; it's about zero-knowledge. We can't stop a dishonest verifier from refusing to authenticate an honest prover; however, we might be able to keep them from learning about the secret. For honest verifiers, who select the challenge at random, we can prove that the honest verifier cannot be learning anything about the secret. But this proof doesn't work with a verifier who selects the challenges very carefully; there's no known proof that they can't learn about the secret (other protocols have proofs that a cheating verifier can't learn anything, but Schnorr does not). That doesn't mean we know they can learn something; we don't know one way or the other.

$\endgroup$
0
$\begingroup$

In such a context, one would name a protocol participant honest if it follows the protocol. Honest Verifier means he picks his challenge at random, as specified, so simulated transcript will be indistinguishable from a real one. Any (meaning not honest) Verifier would calculate his challenge as a hash, so he will be unable to simulate any such transcript himself resulting in no zero knowledge property.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.