In Fiat-Shamir protocol, the final calculation is


Where $c$ is the random $\{1,0\}$, $x$ is the witness and $v$ is the public key $s^2 \bmod n$.

My questions are:

  1. What stops the attacker from reading $c$, which is never encrypted, $v$ which is public and then calculate $y^2$ correctly?
  2. How does this improve entity authentication?

Man-in-the-Middle attack are possible for all almost all zero-knowledge-proofs. Victor, can copy everything sent by Alice, the prover, to the Bob, the verifier, and reversely to impersonate the Alice, . In short, Victor can relay every message.

To mitigate, one can use time limit to prevent the relay, however this may not be enough.

A better solution is first creating a secure channel that is free of MitM attack then use Fiat-Shamir Protocol.

  • $\begingroup$ So is there any practical use of this protocol? considering a channel to be free of MitM is not a good security practice. How can this be used for entity authentication if there isn't any way to check the authenticity of messages $\endgroup$ – Praveen David Mathew Jan 3 at 20:01
  • $\begingroup$ Securing channel and zero-knowledge-proofs are different subject. As in your previous question, you can use SAS to detect MitM-attacker. But can you prove something without revealing? $\endgroup$ – kelalaka Jan 3 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.