It seems we can use every identification scheme to sign and verify a message and vice versa. I am right or not? What is difference between an identification scheme and a digital signature scheme?
1 Answer
Huh, I was just reading about this.
Quoting [1]:
Identification schemes: A can prove to B that he is A, but B cannot prove to someone
Signature schemes: A can prove to B that he is A, but B cannot prove even to himself
The distinction between identification and signature schemes is subtle, and manifests itself mainly when the proof is interactive and the verifier later wants to prove its existence to a judge: In identification schemes B can create a credible transcript of an imaginary communication by carefully choosing both the questions and the answers in the dialog, while in signature schemes only real communication with A could generate a credible transcript. However, in many commercial and military applications the main problem is to detect forgeries in real time and to deny the service, access or response that the forger wants. In these cases the transcript and judge are irrelevant, and the two types of schemes can be used interchangeably.
[1]: Fiat, A., & Shamir, A. (1986, August). How to prove yourself: Practical solutions to identification and signature problems. In Conference on the Theory and Application of Cryptographic Techniques (pp. 186-194). Springer, Berlin, Heidelberg.
-
$\begingroup$ Thank you for your reply and of course the reference. I think also have to read it. $\endgroup$ Commented May 17, 2018 at 15:57