I'm trying to understand the comment in the page 103 of the book Postquantum Cryptography. about convert the identification Stern procedure for signing. Can you write an example of signature of this conversion?

The standard method to convert the identification procedure into a procedure for signing, is to replace verifier-queries by values suitably derived from the commitments and the message to be signed.


In order to convert a 3-move id-scheme to a digital signature you have to replace the request (or the challenge) by the value of a secure hash function applied to the message (this method is called Fiat-Shamir method).

In Sterns's id-scheme you have to choose a random element from the set $\{0,1,2\}$ for your message. That is $H(m)\in \{0,1,2\}.$ For instance if you have $H(m)=0$ then the signature of $m$ is $(c_1,\Pi).$

EDIT : Before you convert it, you have to run the id-protocol many times, say 64 or 80 times, and then apply Fiat-Shamir method.

| improve this answer | |
  • 1
    $\begingroup$ You are right but overlooked that the challenge should be unpredictable enough. We should make the Stern protocol pallalel, say 64 times, and then convert it to signature as you wrote. $\endgroup$ – xagawa Nov 19 '15 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.