I was reading the ZK proof of knowledge of Schnorr and fiat shamir transformation, and I figured out that replay attacks are possible. Why these protocols don't take into account this attack? That seems very strange.

Thank you.

  • $\begingroup$ You failed to mention what attack $\endgroup$ – Haris Nadeem Apr 30 '18 at 1:34
  • $\begingroup$ I think you need to provide more information. What information could be replayed to effectively attack either of these protocols? And if there is anything else to it, how would the attack look from there? $\endgroup$ – Jacob H Apr 30 '18 at 5:36
  • $\begingroup$ @JacobH I think about the Fiat Shamir non interactive protocol. The proof can be replayed. $\endgroup$ – Adam54 May 1 '18 at 6:56
  • $\begingroup$ @Adam54 Can you link this protocol? AFAIK, Fiat-Shamir is just a transformation for digitally signing a ZK proof (and making it non-interactive) but not a full protocol in itself. As for the replay-ability of it, generally ZK proofs involve some random variable, meaning that even if you record the messages, the next instance of the protocol will be entirely different, leaving your recorded message useless. $\endgroup$ – Jacob H May 1 '18 at 14:45
  • $\begingroup$ @JacobH What I mean is that a signature is replayable. If the verifier does not record the previous proofs or does not check them at each authentication, a proof can be replayed. $\endgroup$ – Adam54 May 8 '18 at 9:48

In General: ZK protocols become insecure if computed concurrently; I think this is what you are referring to. If the protocol is run in parallel, an adversary could request a proof of two relationships and produce a witness for the first with the knowledge gained from the second prover-output. When run concurrently, this attack cannot be executed because the adversary cannot receive a second commitment on the same relation to learn/produce a witness for the first. As far as I know, there is no protocol that achieves concurrent security.

|improve this answer|||||
  • 1
    $\begingroup$ That was not my question but this is really interesting. Thank you. $\endgroup$ – Adam54 May 8 '18 at 9:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.