Questions tagged [schnorr-identification]
The Schnorr Identification Protocol relies upon the security of the Discrete Logarithm Problem. Schnorr's protocol was introduced after, and is comparable to, the identification protocol of Fiat and Shamir and that of Guillou-Quisquater.
24
questions
0
votes
1answer
82 views
Zero-knowledge proofs vs. “Identification schemes”? (as in Katz--Lindell)
Most modern papers on zero-knowledge proofs (for example, BBB+16) recycle essentially the same list of boilerplate definitions, concerning soundness (formulated using extraction or some form of "...
1
vote
1answer
41 views
Questions regarding random values in Schnorr authentication
In Chapter 21.3 of Schneier, Applied Cryptography I read the following about the Schnorr Authentication Protocol:
To generate a key pair, first choose two primes, $p$ and $q$, such that $q$ is a ...
1
vote
1answer
91 views
Discrete logarithm problem particularly hard for Schnorr groups?
The Wikipedia article on Discrete Logarithm just states without source:
In some cases (e.g. large prime order subgroups of groups ($\mathbb{Z}_p)^×$) there is not only no efficient algorithm known ...
5
votes
2answers
176 views
The definition and origin of Schnorr groups?
Wanting to write something on Schnorr groups in a publication I realised how hard it is to find anything citable about them on the internet. Who can help me with the following questions?
What (and ...
1
vote
0answers
106 views
Schnorr authentication protocol vs Schnorr signature Scheme
As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element.
If we use the Fiat-...
3
votes
0answers
66 views
Schnorr protocol is witness-hiding?
Regular 3-steps Schnorr protocol is a proof of knowledge system for discrete logarithm.
It's honest-verifier zero-knowledge,
but not full zero-knowledge.
My question is, is it witness-hiding?
(I guess ...
4
votes
1answer
186 views
Could Diffie-Hellman protocol serve as a zero-knowledge proof of knowledge of discrete logarithm?
The Schnorr identification protocol is widely recognized as the simplest ZKPoK of the discrete logarithm (more clearly, Honest-Verifier ZKPoK).
However, I can't figure out why this simple protocol, ...
0
votes
0answers
83 views
Could any one suggest alternative Zero knowledge proof protocol to Schnorr protocol ZKP?
I read that Schnorr protocol cannot be proved zero knowledge on that link:
Perfect zero knowledge for the Schnorr protocol?
Could any one suggest alternative Zero knowledge proof protocol so a prover ...
2
votes
1answer
229 views
How to make the interactive Schnorr identification protocol become non-interactive
I am reading about ZKP and I found this interesting question about changing this protocol from interactive Schnorr identification protocol to non-interactive and I need help in solving it :
Peggy (...
4
votes
2answers
561 views
Sigma protocol for AND-composition involving the same secret
Say we have two public cyclic groups $G_1$, $G_2$ of corresponding prime orders $p_1$, $p_2$, and known generators $g_1$, $g_2$.
Say $g_3$ is also a generator of $G_2$.
For publicly known $C_1$ and $...
3
votes
1answer
279 views
What is difference between an identification scheme and a digital signature scheme?
It seems we can use every identification scheme to sign and verify a message and vice versa. I am right or not? What is difference between an identification scheme and a digital signature scheme?
0
votes
1answer
483 views
Schnorr signature using discrete logarithm / problem with python implementation [closed]
For educational purposes (by purpose with small values for the prime order q), I tried to write a small Python implementation of the Schnorr signature described in the Wikipedia article https://en....
3
votes
2answers
530 views
Schnorr identification protocol security proof
I read about security proof of Schnorr identification protocol against impersonation attack. For the sake of comprehensibility let me sum up the protocol: Given group $G$ with generator $g$. Verifier ...
0
votes
1answer
127 views
The danger of Hash collision in Schnorr NIZK
We use Fiat–Shamir heuristic to turn Schnorr ZK to NIZK. So now NIZK is secure against chosen message attacks in the random oracle model, that is, ideal hash function: every unique query leads to a ...
1
vote
0answers
86 views
Schnorr identification scheme without changing k flaws
The Schnorr identification scheme is being used to remotely log into a home computer which has stored $p$, $α$ and $β(\equiv α^a(mod p))$ - with $a$ the password. This works thusly:
1) The user ...
1
vote
1answer
185 views
Understanding the definition of Schnorrs identification protocol
I have some trouble in understanding the definition of Schnorr's Identification protocol. The is the definition that I received:
Prover and verifier agree on a cyclic group $G$ of prime order $q$ ...
2
votes
1answer
237 views
Plausible Deniability in Schnorr
How does a dishonest verifier affect plausible deniability of the interactive Schnorr protocol?
4
votes
1answer
226 views
Security proof of partially blind signature (schnorr signature based)
I read a representative paper about partially blind signature.
Abe and Okamoto - "provably secure partially blind signature".
They suggested a partially blind signature scheme based on Schnorr ...
8
votes
4answers
940 views
Schnorr protocol: how does malicious verifier win?
My question is about the challenge space size in Schnorr protocol. To be precise, I feel I've read all the Internet (twice) and I still don't understand why is it bad to allow challenge space to be ...
0
votes
1answer
130 views
How we can create a protocol using Schnorr as identification scheme and a hash function as a puzzle?
My question has to do with the creation of a PoWorK( Proof of Work or Knowledge) protocol.How we can create a protocol like this ,using Schnorr as the underlying CVZK protocol and using a hash ...
0
votes
2answers
270 views
Schnorr's identication protocol
Schnorr's identification protocol is said to be a honest verifier zero knowledge protocol. Does it imply it will not work if the verifier is dishonest?
I'm wondering if this is the case, it would ...
2
votes
1answer
503 views
Schnorr Identification protocol sometimes wrong?
I'm implementing the Schnorr Identification protocol as part of a larger protocol. In a large percentage of cases, around 20%, my test fails. I don't think it's a code problem, although possible, but ...
1
vote
1answer
1k views
Schnorr Identification Scheme under active adversary
According to the paper “GQ and Schnorr Identification Schemes: Proofs of Security against Impersonation under Active and Concurrent Attacks” by Mihir Bellare and Adriana Palacio, the Schnorr ...
6
votes
4answers
709 views
How to forge Schnorr signatures if you can guess the challenge
Underlying the Schnorr signature is an identification protocol: let $G$ be a cyclic group where discrete log is "hard" and choose $g$ as a generator of $G$. Now have Alice pick a random (secret) ...
