I think the question was asked somewhere else but not answered very precisely.

Quoting from the "Handbook of applied cryptography":

Identification based on PK decryption and witness. Consider the following protocol:

$A \leftarrow B:h(r),B,P_A(r,B) \quad (1)$

$A \rightarrow B:r \quad \quad \quad \quad \quad \quad (2)$

$B$ chooses a random $r$, computes the witness $x=h(r)$

$P_A$ denotes the public-key encryption (e.g., RSA) algorithm of $A$

The use of the witness $x = h(r)$ precludes chosen-text attacks.

Can anyone explain to me why this precludes chosen ciphertext attacks? If $h(x)$ is a simple hash, everyone can produce a different message, encrypt it with the public key, create the hash and send it to B. Of course B will response with a correct decryption so it can be used as decryption oracle.

I don't understand why $h(r)=x$ provides any additional value.

  • 1
    $\begingroup$ Where else was the question asked? If you find that the answers are not sufficient, you must know the location of the question, right? If you have doubts about the answer(s), you can always devise a followup question. $\endgroup$ – Maarten Bodewes Mar 31 '18 at 15:39
  • $\begingroup$ The idea of using the hash is probably for $B$ to commit to $r$ (in a more ad-hoc way than is usual today). $\endgroup$ – SEJPM Mar 31 '18 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.