3
$\begingroup$

In Fiat-Shamir protocol, the final calculation is

$$y^2=x\,v^c$$

Where $c$ is the random $\{1,0\}$, $x$ is the witness and $v$ is the public key $s^2 \bmod n$.

My questions are:

  1. What stops the attacker from reading $c$, which is never encrypted, $v$ which is public and then calculate $y^2$ correctly?
  2. How does this improve entity authentication?
Improve this question
$\endgroup$
4
  • $\begingroup$ cryptowiki.net/index.php?title=Fiat_-_Shamir_protocol $\endgroup$ – PDHide Jan 3 '19 at 16:44
  • $\begingroup$ yes, why can't attacker send the correct value y, if x and v are public, and impersonate as A $\endgroup$ – PDHide Jan 3 '19 at 17:27
  • $\begingroup$ Why don't you write more explicitly into your question? Also, you can delete the comments after that $\endgroup$ – kelalaka Jan 3 '19 at 17:48
  • $\begingroup$ The original Fiat-Shamir Paper $\endgroup$ – kelalaka Jan 3 '19 at 19:21
1
$\begingroup$

Man-in-the-Middle attacks are possible for almost all zero-knowledge proofs. Victor can copy everything sent by Alice, the prover, to Bob, the verifier, and reversely to impersonate the Alice. In short, Victor can relay every message.

To mitigate this, time limit can be used to prevent the relay. However, this may not be enough.

A better solution is first creating a secure channel that is free of MitM attack and then use the Fiat-Shamir protocol.

Improve this answer
$\endgroup$
2
  • $\begingroup$ So is there any practical use of this protocol? considering a channel to be free of MitM is not a good security practice. How can this be used for entity authentication if there isn't any way to check the authenticity of messages $\endgroup$ – PDHide Jan 3 '19 at 20:01
  • $\begingroup$ Securing channel and zero-knowledge-proofs are different subject. As in your previous question, you can use SAS to detect MitM-attacker. But can you prove something without revealing? $\endgroup$ – kelalaka Jan 3 '19 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.