In Fiat-Shamir protocol, the final calculation is


Where $c$ is the random $\{1,0\}$, $x$ is the witness and $v$ is the public key $s^2 \bmod n$.

My questions are:

  1. What stops the attacker from reading $c$, which is never encrypted, $v$ which is public and then calculate $y^2$ correctly?
  2. How does this improve entity authentication?
  • $\begingroup$ cryptowiki.net/index.php?title=Fiat_-_Shamir_protocol $\endgroup$
    – PDHide
    Jan 3, 2019 at 16:44
  • $\begingroup$ yes, why can't attacker send the correct value y, if x and v are public, and impersonate as A $\endgroup$
    – PDHide
    Jan 3, 2019 at 17:27
  • $\begingroup$ Why don't you write more explicitly into your question? Also, you can delete the comments after that $\endgroup$
    – kelalaka
    Jan 3, 2019 at 17:48
  • $\begingroup$ The original Fiat-Shamir Paper $\endgroup$
    – kelalaka
    Jan 3, 2019 at 19:21

1 Answer 1


Man-in-the-Middle attacks are possible for almost all zero-knowledge proofs. Victor can copy everything sent by Alice, the prover, to Bob, the verifier, and reversely to impersonate the Alice. In short, Victor can relay every message.

To mitigate this, time limit can be used to prevent the relay. However, this may not be enough.

A better solution is first creating a secure channel that is free of MitM attack and then use the Fiat-Shamir protocol.

  • $\begingroup$ So is there any practical use of this protocol? considering a channel to be free of MitM is not a good security practice. How can this be used for entity authentication if there isn't any way to check the authenticity of messages $\endgroup$
    – PDHide
    Jan 3, 2019 at 20:01
  • $\begingroup$ Securing channel and zero-knowledge-proofs are different subject. As in your previous question, you can use SAS to detect MitM-attacker. But can you prove something without revealing? $\endgroup$
    – kelalaka
    Jan 3, 2019 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.