I cannot find a rigorous definition of what the "proof of possession" attribute means. Different webpages seem to give conflicting definitions:

  1. Some of them say that it means, literally, proving that you possess a value (a key or a password):
    This doesn't seem like a useful definition, though, because almost every crypto operation involves a key, so by this definition, anything would constitute "proof of possession", including just giving the key out to prove you have it.

  2. Some of them say it specifically refers to proof of possession of a private key in a public-private key pair:
    but I think this is probably wrong, as more authoritative sources like https://www.rfc-editor.org/rfc/rfc7800 talk specifically about proof of possession in the context of symmetric keys.

  3. One page which is on an internal company wiki that I cannot share, which says that proof of possession means proving that you possess a value, without sending the value to the other party. Ironically, this is the definition that seems most likely to be correct, since it's most consistent with how people use it, even though I can't find any public-facing webpages giving this definition.

So is it the case that definition #3 is correct and that sources which give definition #1 or #2 are (mildly) wrong?

  • 2
    $\begingroup$ Could you edit your question to link to pages giving the definitions? $\endgroup$
    – kelalaka
    Oct 14 '20 at 22:29
  • $\begingroup$ @kelalaka when I've done that before, someone usually edits the question to take the URLs out -- the rationale being that Stack Exchange questions & answers are intended to be a knowledge repository that endures even when external links stop working. That makes sense for questions like "What is public key cryptography?", but it makes it hard to ask questions like: "This appears to be a common misconception on the Web, can you clarify if this is correct?" But in this case if you Google "proof of possession" you'll find the same pages I did. $\endgroup$
    – Bennett
    Oct 15 '20 at 18:36
  • $\begingroup$ We don't do it here. If you fear that the external link will stop, you can use the archive.org link for the archived version. That is pretty common on our site. We even use, the edit version of Wikipedia. Remember, the devil in details. Now, go on and edit. I'm pretty sure that you will get an answer to your question after that. $\endgroup$
    – kelalaka
    Oct 15 '20 at 18:40
  • $\begingroup$ OK I have rewritten it to just ask "What is a rigorous definition of 'proof of possession'?" and given links to the conflicting answers $\endgroup$
    – Bennett
    Oct 16 '20 at 19:17

The closest notion used in the literature seems to be “proof / argument of knowledge” (PoK / AoK). See [GMR, BG] as well as Wikipedia for its definition. Indeed, giving out the key would be a proof of knowledge (but it's not of much interest to cryptography).

The part about “not sending the value to the other party” seems to be related to zero-knowledge (ZK). ZK requires the interaction yields no extra effect beyond the prover convincing the verifier. For example, if a ZKPoK is used to prove possession of a secret key with respect to a public key, then the verifier does not learn any extra practical information about the secret key after being convinced. See [GMR] and Wikipedia.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.