Questions tagged [schnorr-identification]

The Schnorr Identification Protocol relies upon the security of the Discrete Logarithm Problem. Schnorr's protocol was introduced after, and is comparable to, the identification protocol of Fiat and Shamir and that of Guillou-Quisquater.

Filter by
Sorted by
Tagged with
2 votes
1 answer
195 views

In Schnorr identification protocol, what happens if the prover uses r+c+x or rx+c.. etc. rather than r+cx?

Consider the Schnorr identification protocol. Let $x$ be secret key, $u$ be public key, $r(\xleftarrow{$} \mathbb{Z}_q )$ be a random number with $u_r=g^r$ the commitment that prover uses at first ...
user avatar
4 votes
1 answer
479 views

What's the main difference between the Schnorr identification scheme and its Smart-Card implementation?

This question arises because I couldn't find any official paper for the Schnorr identification scheme, but only for the Smart-Card implementation of it. Also, it seems that everyone, when talking ...
user avatar
0 votes
1 answer
33 views

Domain parameters in the Schnorr identification scheme

I have been recently studying the Schnorr identification scheme. The book Cryptography: Theory and Practice by Stinson and Paterson states the following about the domain parameters in the Schnorr ...
user avatar
  • 43
0 votes
1 answer
29 views

Congruence in the Schnorr identification scheme

I have been looking at the Cryptography: Theory and Practice book by Stinson and Paterson and when I came to the Schnorr identification scheme, I read the sentence that goes something like this: ...
user avatar
  • 43
0 votes
2 answers
83 views

Discrete Logarithm Fiat-Shamir Parameters Selection

According to Fiat–Shamir heuristic there are two parameters of the algorithm: big prime number $p$ and primitive root $g$. Thus several questions arise: How big should the prime number $p$ be? How to ...
user avatar
4 votes
2 answers
293 views

Quantitative reduction of Schnorr's identification scheme to DLP

Question I seek a quantitatively better proof of theorem 13.11 in Katz and Lindell's Introduction to Modern Cryptography (3rd edition) (or nearly equivalently, theorem 19.1 in Dan Boneh and Victor ...
user avatar
  • 125k
4 votes
1 answer
96 views

Security proof of schnorr identification scheme

I have studied the Schnorr identification scheme, and I came across the security proof. My question is regarding the following: $$\begin{align} \text{Pr}\left[\text{DLog}_{\mathcal{A}',\mathcal{G}}\...
user avatar
  • 143
0 votes
1 answer
41 views

Case Scenarios where Identity Based identification (IBI) Scheme can be employed

I was reading about identity based Identification scheme today. There are lot of articles and research paper on it. There is active research being done in this are of IBI schemes. My question is ...
user avatar
1 vote
1 answer
108 views

Identification Schemes and Internet of Things

I was reading an article titled "A Novel Method for Polar Form of Any Degree of Multivariate Polynomials with Applications in IoT" (doi:10.3390/s19040903) I read the following statement: &...
user avatar
3 votes
1 answer
256 views

Is there any proof for ECDSA signature algorithm?

Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
user avatar
1 vote
1 answer
166 views

Proving equality of two Schnorr Signatures

Given two Schnorr Signatures that were made from the same $x$, where each $x$ is private. Is there a way to prove that they came from the same $x$ without revealing $x$? I heard about Chaum-Pedersen ...
user avatar
  • 43
0 votes
0 answers
154 views

Does Schnorr identification protocol using commitment scheme?

In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are ...
user avatar
-1 votes
1 answer
142 views

Orignal Schnorr Signature vs Discrete logarithmic Schnorr Signature

I have currently started a course on cryptography and am an absolute beginner. While reading through Schnorr's Protocol I came across several ways in which it was described. One of the approach is ...
user avatar
1 vote
1 answer
154 views

Difference between using Schnorr Protocol and just compare hash function to prove knowing something?

I am studying the Schnorr Protocol, and I just come up a case. For example, I am a Prover and have a secret $x$. By using the Schnorr Protocol, I create $h=g^x \bmod p$ and save $h$ to a public place. ...
user avatar
  • 139
3 votes
1 answer
187 views

Schnorr proof of group with unknown order (but the prover know the order)

We assume that we have $n = pq$, where $p = 2p'+1$, $q = 2q'+1$, and all $p, q, p', q'$ are large primes. Pick $g' \gets_R Z_n^*$, and compute $g = (g')^2 \bmod n$. Then we have a generator $g$ for $...
user avatar
0 votes
1 answer
87 views

How many rounds is needed to implementing Schnorr Non-Interactive zero-knowledge protocol

We can use Fiat-Shamir heuristic to replace 3-move Schnorr's protocol with 1-move non-interactive protocol. When I implement this non-interactive protocol( ref. https://en.wikipedia.org/wiki/Fiat%E2%...
user avatar
1 vote
1 answer
227 views

Zero-knowledge proofs vs. "Identification schemes"? (as in Katz--Lindell)

Most modern papers on zero-knowledge proofs (for example, BBB+16) recycle essentially the same list of boilerplate definitions, concerning soundness (formulated using extraction or some form of "...
user avatar
  • 135
1 vote
1 answer
96 views

Questions regarding random values in Schnorr authentication

In Chapter 21.3 of Schneier, Applied Cryptography I read the following about the Schnorr Authentication Protocol: To generate a key pair, first choose two primes, $p$ and $q$, such that $q$ is a ...
user avatar
  • 269
1 vote
1 answer
224 views

Discrete logarithm problem particularly hard for Schnorr groups?

The Wikipedia article on Discrete Logarithm just states without source: In some cases (e.g. large prime order subgroups of groups ($\mathbb{Z}_p)^×$) there is not only no efficient algorithm known ...
user avatar
  • 269
6 votes
2 answers
557 views

The definition and origin of Schnorr groups?

Wanting to write something on Schnorr groups in a publication I realised how hard it is to find anything citable about them on the internet. Who can help me with the following questions? What (and ...
user avatar
  • 269
1 vote
0 answers
220 views

Schnorr authentication protocol vs Schnorr signature Scheme

As I understand the schnorr authentication protocol is an interactive protocol where a prover WLOG proves to a Verifier that he possesses the discrete log to some group element. If we use the Fiat-...
user avatar
4 votes
1 answer
173 views

Schnorr protocol is witness-hiding?

Regular 3-steps Schnorr protocol is a proof of knowledge system for discrete logarithm. It's honest-verifier zero-knowledge, but not full zero-knowledge. My question is, is it witness-hiding? (I guess ...
user avatar
7 votes
1 answer
980 views

Could Diffie-Hellman protocol serve as a zero-knowledge proof of knowledge of discrete logarithm?

The Schnorr identification protocol is widely recognized as the simplest ZKPoK of the discrete logarithm (more clearly, Honest-Verifier ZKPoK). However, I can't figure out why this simple protocol, ...
user avatar
0 votes
0 answers
208 views

Could any one suggest alternative Zero knowledge proof protocol to Schnorr protocol ZKP?

I read that Schnorr protocol cannot be proved zero knowledge on that link: Perfect zero knowledge for the Schnorr protocol? Could any one suggest alternative Zero knowledge proof protocol so a prover ...
user avatar
2 votes
1 answer
384 views

How to make the interactive Schnorr identification protocol become non-interactive

I am reading about ZKP and I found this interesting question about changing this protocol from interactive Schnorr identification protocol to non-interactive and I need help in solving it : Peggy (...
user avatar
  • 21
4 votes
3 answers
1k views

Sigma protocol for AND-composition involving the same secret

Say we have two public cyclic groups $G_1$, $G_2$ of corresponding prime orders $p_1$, $p_2$, and known generators $g_1$, $g_2$. Say $g_3$ is also a generator of $G_2$. For publicly known $C_1$ and $...
user avatar
  • 367
3 votes
1 answer
643 views

What is difference between an identification scheme and a digital signature scheme?

It seems we can use every identification scheme to sign and verify a message and vice versa. I am right or not? What is difference between an identification scheme and a digital signature scheme?
user avatar
0 votes
1 answer
1k views

Schnorr signature using discrete logarithm / problem with python implementation [closed]

For educational purposes (by purpose with small values for the prime order q), I tried to write a small Python implementation of the Schnorr signature described in the Wikipedia article https://en....
user avatar
3 votes
2 answers
748 views

Schnorr identification protocol security proof

I read about security proof of Schnorr identification protocol against impersonation attack. For the sake of comprehensibility let me sum up the protocol: Given group $G$ with generator $g$. Verifier ...
user avatar
  • 85
0 votes
1 answer
147 views

The danger of Hash collision in Schnorr NIZK

We use Fiat–Shamir heuristic to turn Schnorr ZK to NIZK. So now NIZK is secure against chosen message attacks in the random oracle model, that is, ideal hash function: every unique query leads to a ...
user avatar
  • 412
1 vote
0 answers
94 views

Schnorr identification scheme without changing k flaws

The Schnorr identification scheme is being used to remotely log into a home computer which has stored $p$, $α$ and $β(\equiv α^a(mod p))$ - with $a$ the password. This works thusly: 1) The user ...
user avatar
  • 131
1 vote
1 answer
216 views

Understanding the definition of Schnorrs identification protocol

I have some trouble in understanding the definition of Schnorr's Identification protocol. The is the definition that I received: Prover and verifier agree on a cyclic group $G$ of prime order $q$ ...
user avatar
2 votes
1 answer
284 views

Plausible Deniability in Schnorr

How does a dishonest verifier affect plausible deniability of the interactive Schnorr protocol?
user avatar
4 votes
1 answer
327 views

Security proof of partially blind signature (schnorr signature based)

I read a representative paper about partially blind signature. Abe and Okamoto - "provably secure partially blind signature". They suggested a partially blind signature scheme based on Schnorr ...
user avatar
  • 509
8 votes
4 answers
2k views

Schnorr protocol: how does malicious verifier win?

My question is about the challenge space size in Schnorr protocol. To be precise, I feel I've read all the Internet (twice) and I still don't understand why is it bad to allow challenge space to be ...
user avatar
0 votes
1 answer
170 views

How we can create a protocol using Schnorr as identification scheme and a hash function as a puzzle?

My question has to do with the creation of a PoWorK( Proof of Work or Knowledge) protocol.How we can create a protocol like this ,using Schnorr as the underlying CVZK protocol and using a hash ...
user avatar
  • 101
1 vote
2 answers
344 views

Schnorr's identication protocol

Schnorr's identification protocol is said to be a honest verifier zero knowledge protocol. Does it imply it will not work if the verifier is dishonest? I'm wondering if this is the case, it would ...
user avatar
2 votes
1 answer
562 views

Schnorr Identification protocol sometimes wrong?

I'm implementing the Schnorr Identification protocol as part of a larger protocol. In a large percentage of cases, around 20%, my test fails. I don't think it's a code problem, although possible, but ...
user avatar
  • 153
1 vote
1 answer
1k views

Schnorr Identification Scheme under active adversary

According to the paper “GQ and Schnorr Identification Schemes: Proofs of Security against Impersonation under Active and Concurrent Attacks” by Mihir Bellare and Adriana Palacio, the Schnorr ...
user avatar
  • 13
6 votes
4 answers
916 views

How to forge Schnorr signatures if you can guess the challenge

Underlying the Schnorr signature is an identification protocol: let $G$ be a cyclic group where discrete log is "hard" and choose $g$ as a generator of $G$. Now have Alice pick a random (secret) ...
user avatar
  • 4,008