Sherlock Holmes zero-knowledge protocols secure against active attackers
-
George Teşeleanu
Abstract
We present two simple zero-knowledge interactive proofs that can be instantiated with many of the standard decisional or computational hardness assumptions. Compared with traditional zero-knowledge proofs, in our protocols, the verifier starts first, by emitting a challenge, and then, the prover answers the challenge.
1 Introduction
A standard interactive proof of knowledge involves a prover, usually called
In a classical zero-knowledge protocol, Peggy starts the protocol by sending a commitment to Victor, then Victor sends a challenge to Peggy, and finally, Peggy sends her answer. The verifier will accept the proof if and only if Peggy’s answer coincides with the answer he expects. In contrast with these protocols, Grigoriev and Shpilrain [1] introduced a new class of protocols[1] in which Victor starts the protocol. Once the verifier knows that Peggy wants to start the protocol[2], he issues a challenge to which Peggy answers. If the answer is correct, then the protocol ends successfully. Otherwise, it fails.
1.1 Attack models for identification protocols
When proposing novel interactive proof of knowledge protocols, we must be able to prove their security against various types of adversaries. This includes security against legitimate, but malicious users of the protocol. We say that an adversary is successful if he manages to impersonate the prover with a non-negligible probability. We usually think of the verifier as an adversary trying to cheat [2], since the zero-knowledge property should hold for any strategy employed by the verifier to gain some information about the secret knowledge held by the prover.
1.1.1 Adversaries
The weakest type of adversary is the one that simply eavesdrops on the communication between the prover and the verifier. Another type of adversary is the “honest” verifier. This attacker interacts with the prover according to the protocol, but he maintains a database with all the protocol transcripts and all the associated data[3] generated by him during the protocol.
A stronger notion is the so-called “impersonation” attacker [3]. In this model, the attacker first plays the role of the verifier and interacts with the prover in different sessions, and then, it tries to impersonate the prover. Depending on how the adversary interacts with the prover, impersonation adversaries split into three categories: sequential, parallel, and concurrent.
The last type of adversary that we consider is the active-intruder adversary [4]. This adversary is able to alter, inject, drop, and/or divert at least one message in the given session. We say that the active-intruder adversary is successful if the verifier accepts the session after the adversary becomes active.
1.1.2 Sequential attacks
In the case of sequential attacks, once an instance of the protocol is started, then that instance must be terminated before starting a new one [2]. This is the classical attack model for zero-knowledge protocols and is inspired by the smartcard communication model [5].
In the sequential attack model, the Feige-Fiat-Shamir [6] and Okamoto [7] protocols are secure as long as the square root and discrete logarithm problems are intractable. Although the Schnorr [8] and Guillou-Quisquater [9] protocols are proven secure [10,11] in the honest verifier model under the discrete logarithm and
1.1.3 Parallel attacks
Compared to sequential attacks, in the parallel case, many instances of the protocol are run at the same time and proceed at the same pace [2]. This model is inspired by the synchronous model of communication and considers a polynomial number of executions that are synchronized such that the
1.1.4 Concurrent attacks
These attacks generalize both the sequential and parallel attacks. In this case, a polynomial number of instances are run at arbitrary times and proceed at an arbitrary pace [2]. This model is inspired by the internet communication model [5].
According to previous studies [7,12], the Feige-Fiat-Shamir and Okamoto protocols remain secure in this attack model. Bellare et al. [3] showed that the Schnorr and Guillou-Quisquater protocols can be proven secure in the concurrent model if stronger non-standard assumptions hold.
In the case of two-round protocols where the verifier starts, concurrent attacks are equivalent to sequential attacks [5]. This is because once the prover receives a challenge, he immediately responds and the protocol ends. Therefore, each reply is determined only by the corresponding challenge. Hence, since our proposals are two-round protocol, it is sufficient to study their security in the sequential attack model.
1.1.5 Active-intruder attack
In the concurrent scenario, the attacker is only allowed to interact with the prover before attempting to impersonate him. But in real-life scenarios, the adversary might be able to interact with the prover at the same time that the adversary impersonates him. This is a type of man-in-the-middle attack. In this setting, we impose that the adversary alters, injects, drops, and/or diverts at least one message to avoid attackers who simply relay messages faithfully. This is an attacks model proposed by Stinson [4].
In Appendix A, we present an active-intruder attack against a family of zero-knowledge protocols. This family includes some of the most popular identification schemes [13,14]. Although it is controversial if these attacks could be categorized as “real” attacks [5], it is often desirable to design protocols that withstand the strongest possible attacks, as long as it does not result in substantial overhead.
1.1.6 Reset attacks
This class of attacks was introduced in the study of Bellare et al. [15]. In this model, the verifier can reset the prover, thus forcing him to use the same random tape in multiple concurrent executions [2]. Such attacks were inspired by smartcards that can be controlled by the attacker or are in his possession. Therefore, even if the attacker cannot read the secret content contained in the secure hardware, he can disconnect the smartcard’s battery and reset its internal state.
It is worth mentioning that most popular identification schemes, such as Schnorr, Guillou-Quisquater, Feige-Fiat-Shamir, and Okamoto protocols are not secure in this model [15].
According to Stinson and Wu [5] if the prover is stateless and deterministic, then the corresponding protocol is secure in this setting. Since our proposals use exactly this type of prover, it follows that they are secure against reset attacks. The most powerful security model is the combination of active-intruder attacks and reset attacks [16]. According to the aforementioned arguments, in the case of our proposals, all we need to prove is that they are secure against active-intruder attacks.
1.2 Our contributions
Although Grigoriev and Shpilrain’s protocol [1] is very interesting, the authors only claim that their protocol is zero-knowledge in the honest verifier scenario without actually proving it. To fill this gap, we re-formalize and generalize Grigoriev and Shpilrain’s protocol, and then, we prove its security in the same scenario. Moreover, we provide active-intruder attacks that can be mounted against this protocol. A downside of this formalization is that Victor must iterate the protocol a number of times in order to fulfill the soundness property. By vectorizing the protocol, we manage to reduce the number of iteration to one. Additionally, we provide a variation of the vectorized protocol that is secure in the sequential and active-intruder attack scenarios.
To further improve our protocol, we modified it by changing the underlying assumption from a decisional one to a computational one. This was necessary in order to reduce the bandwidth requirements necessary for the decisional version. Note that if Peggy and Victor choose the right parameters, the new protocol will provide the same security assurances. Furthermore, we introduce two variations that are secure in the sequential and active-intruder attack scenarios.
Finally, we offer the reader several concrete realizations of our protocols and compare them with classical zero-knowledge protocols such as Schnorr [8], Guillou-Quisquater [9], and Fiat-Shamir [17]. Note that one can devise new instantiations of our protocols.
We remark that in the case of our protocols, the verifier knows with overwhelming probability the answer given by the prover. This is not the case for classical protocols, since the verifier does not know the reply in advance.
1.2.1 Previous work
Note that a preliminary version of this article was presented in the study of Teşeleanu [18].
1.2.2 Structure of this article
We introduce notations and definitions used throughout this article in Section 2. Inspired by Grigoriev and Shpilrain’s protocol, in Section 3, we formalize and analyze the Multi-Decisional Sherlock Holmes (MDSH) protocol. A vectorized version of MDSH and a variant of it are presented in Sections 4 and 5. The computational version and its variants are tackled in Sections 6–8. Section 9 contains a comparison with classical zero-knowledge protocols. We conclude in Section 10.
2 Preliminaries
Notations
Throughout this article, the notation
2.1 Hardness assumptions
Inspired by the computational and decisional hardness assumptions described in the study of Bellare and Rogaway [19] and the one-way function definitions found in previous studies [20,21], we further provide the reader with the following two definitions. The first one captures the idea of a generic computational hardness assumption, while the second the decisional version. We do not claim to capture all the generic hardness assumptions, but for our purpose, these definitions suffice. Note that when we define an advantage, we use “
Definition 2.1
(Computational hardness assumption) Let
for every key
for every PPT algorithm
is negligible;
there exists a PPT algorithm
Definition 2.2
(Decisional hardness assumption) A function
for every PPT algorithm
is negligible;
there exists a PPT algorithm
We further provide a security assumption from [19] that will be useful later on.
Definition 2.3
(Pseudo-random permutation - prp) A function
Given a key
Given a key
Let
must be negligible for any PPT algorithm
2.2 Zero-knowledge protocols
Let
We further base our reasoning on two definitions from [6,13,22] which we recall next.
Definition 2.4
(Proof of knowledge protocol) An interactive protocol
Completeness:
Soundness: there exists an efficient program
Definition 2.5
(Zero-knowledge protocol) A protocol
Remark
(Negative results) The first impossibility result for two-round zero-knowledge proofs was initially presented in the study of Goldreich and Oren [23] and subsequently refined in the study of Barak et al. [24]. More precisely, Barak et al. [24] proved that if a language
Remark
(Negative results on negative results) Based on Damgård’s knowledge-of-exponent assumption [26], Barak et al. [24] established the existence of a two-round private-coin zero-knowledge proof system for a promise problem that lies beyond
We further define impersonation under concurrent attack as presented in the study of Bellare et al. [3].
Definition 2.6
(Impersonation under concurrent attack - imp-ca) An imp-ca adversary is a pair of PPT algorithms
the initial state of clone
the operation
message
the operation
Finally, we provide a definition from [4] that captures active-intruder attacks.
Definition 2.7
(Active-intruder attack) An active-intruder is successful if the verifier accepts in a session after the adversary becomes active (i.e., injects, drops, and/or diverts at least one message) in the same session.
3 Multi-decisional protocol
3.1 Description
Based on a variation of decisional hard functions, we further describe a protocol (Figure 1) that allows Peggy to prove to Victor that she is in possession of some secrets. When Victor knows that Peggy is ready to start the protocol, he sends her a challenge and Peggy responds with her guess. If the guess is correct, then Victor accepts the answer.
MDSH protocol.
Remark
The probability of an adversary guessing the correct index
Remark
In order for the MDSH protocol to be efficient, we must assume that the decision of membership
Remark
A protocol for statistical distance was introduced in the study of Sahai and Vadhan [27]. Let
3.2 Security analysis
To ease understanding, we first introduce the notion of a multi-decisional hard function, and then, we prove the security of the MDSH protocol. At the end of this section, we show how to relate the security of a multi-decisional function to the security of a decisional function.
Definition 3.1
(Multi-decisional hardness assumption) Let
for every PPT algorithm
is negligible, where
there exists a PPT algorithm
where
Remark
Note that in the case of the multi-decisional hardness assumption, we implicitly assume that all the keys are kept secret and none of them are leaked to an adversary (dishonest prover). If, for example,
|
Algorithm 1. Algorithm
|
|
|---|---|
|
Input: An element
|
|
| 1 | Send
|
| 2 | Receive
|
| 3 |
return
|
|
Algorithm 2. Simulator
|
|
|---|---|
|
Input:
|
|
| 1 | Choose
|
| 2 | Choose
|
| 3 | Compute
|
| 4 |
return
|
Theorem 3.1
The MDSH protocol is a proof of knowledge if and only if f is a multi-decisional hard function. Moreover, the protocol is zero-knowledge in the honest verifier scenario.
Proof
If
Let
The last part of our proof consists in constructing a simulator
We further show that if
Theorem 3.2
For any PPT algorithm A, there exists a PPT algorithm B such that the following inequality holds:
Proof
Let
|
Algorithm 3. Algorithm
|
|
|---|---|
|
Input: An element
|
|
| 1 |
for
|
| 2 |
|
| 3 | Randomly shuffle
|
| 4 | Let
|
| 5 |
if
|
| 6 |
else if
|
| 7 |
else return
|
Proposition 3.3
Let
Proof
When Victor sends his first message
just as required by Victor’s verification.□
Active-intruder attack against MDSH.
Proposition 3.4
Let
Proof
When Victor sends
just as required by Victor’s verification.□
Active-intruder attack against MDSH.
Remark
Note that if the conditions of Proposition 3.4 hold, then Proposition 3.3 is automatically obtained by selecting
3.3 Examples
3.3.1 Quadratic residuosity assumption
Let
Since qra partitions
the secret keys are
the functions are defined as
The active-intruder attack from Proposition 3.4 works as follows: Mallory chooses
and the term
Remark
A similar assumption can be found in the study of Benhamouda et al. [30]. Let
3.3.2 Least significant bit of the
e
th root assumption
Let
As in the case of qr, we have
the secret keys are
the functions are defined as
The active-intruder attack from Proposition 3.3 works as follows: Mallory chooses
and thus,
3.3.3 Decisional Diffie-Hellman assumption
Let
In this case,
the secret keys are
the public parameters are
the functions are defined as
Let
and thus, we obtain the same index
Remark
When
3.3.4 Decisional bilinear Diffie-Hellman assumption
Let
Let
As in the case of ddh, we have
the secret keys are
the public parameters are
the functions are defined as
Let
and thus, we obtain the same index
4 Basic vectorized multi-decisional protocol
4.1 Description
A downside to the MDSH protocol is that Victor has to run the protocol a number of times before he can be sure that Peggy knows
Vectorized multi-decisional Sherlock Holmes (VDSH0) protocol.
Remark
The probability of an adversary guessing the correct index vector
Remark
As in the case of MDSH protocol, we must also assume that the decision of membership
4.2 Security analysis
As in Section 3.2, we first introduce the relevant hardness assumption, then we prove the security of the VDSH0 protocol, and at the end, we relate the new hardness assumption to the multi-dimensional hardness assumption.
Definition 4.1
(Vectorized multi-decisional hardness assumption) Let
for every PPT algorithm
is negligible, where
there exists a PPT algorithm
where
Theorem 4.1
The VDSH0 protocol is a proof of knowledge if and only if f is a vectorized multi-decisional hard function. Moreover, the protocol is zero-knowledge in the honest verifier scenario.
Proof
The proof is similar to Theorem 3.2, and thus, we only provide a sketch. The completeness property is satisfied due to Definition 4.1, Item 3.
|
Algorithm 4. Algorithm
|
|
|---|---|
|
Input: A vector
|
|
| 1 | Send
|
| 2 | Receive
|
| 3 |
return
|
A PPT algorithm
Finally, the simulator
|
Algorithm 5. Simulator
|
|
|---|---|
|
Input:
|
|
| 1 |
for
|
|
|
|
| 5 | Let
|
| 6 |
return
|
The next theorem proves the equivalence between the security notion associated with multi-decisional functions and the vectorized version of it. Using Theorems 3.2 and 4.2, the security of VDSH0 reduces to making sure that the decisional security notion is intractable.
Theorem 4.2
For any PPT algorithms A and C, there exist PPT algorithms B and D such that the following inequalities hold:
Proof
Let
|
Algorithm 6. Algorithm
|
|
|---|---|
|
Input: A vector of elements
|
|
| 1 |
for
|
| 2 |
|
| 3 | Let
|
| 4 |
return
|
To prove the second inequality, we assume that
|
Algorithm 7. Algorithm
|
|
|---|---|
|
Input: An element
|
|
| 1 |
for
|
|
|
|
| 5 | Let
|
| 6 | Let
|
| 7 | Parse
|
| 8 |
return
|
□
Since VDSH0 is the vectorized version of MDSH, the active-intruder attacks from Propositions 3.3 and 3.4 can be easily adapted to VDSH0 by simply applying them for each component of the
Corollary 4.2.1
Let
Corollary 4.2.2
Let
5 Vectorized multi-decisional protocol variant
5.1 Description
We further present a variation of VDSH0 (Figure 5) that is secure against concurrent and active-intruder attacks. In order to work, the protocol uses a public string
Vectorized multi-decisional Sherlock Holmes (VDSH1) protocol.
5.2 Security analysis
We further prove that the variation of VDSH0 can protect the end users from more powerful attackers than the basic version.
Theorem 5.1
The VDSH1 protocol is secure against sequential impersonation attacks in the random oracle model.
|
Algorithm 8. Hashing oracle
|
|
|---|---|
|
Input: A hashing query
|
|
| 1 |
if
|
| 2 |
|
| 3 | else |
|
|
|
| 6 |
return
|
|
Algorithm 9. Prover
|
|
|---|---|
|
Input: A challenge query
|
|
| 1 |
if
|
| 2 |
|
| 3 | else |
| 4 |
|
Proof
Let
In the second phase of the attack,
which is non-negligible.
|
Algorithm 10. Verifier
|
|
|---|---|
|
Input: A vector
|
|
| 1 | Choose
|
| 2 | Send
|
| 3 |
if
|
|
|
|
| 7 | else |
|
|
|
□
Theorem 5.2
The VDSH1 protocol is secure against active-intruder attacks in the random oracle model.
Proof
We further prove that if attacker
Since
Changing
The prover will reject as in the previous case, and thus,
Since
As in the previous case, the prover will most certainly reject. Therefore, if
In this case, the prover will reject with overwhelming probability since the probability of obtaining
According to the previous case, the prover will reject with overwhelming probability. Therefore,
To summarize, if adversary
6 Basic computational protocol
6.1 Description
Using a different security notion, we describe in Figure 6 a protocol that consumes less bandwith that the VDSH protocol, while maintaining its security, if the parameters are selected correctly.
Basic computational Sherlock Holmes (CSH0) protocol.
Remark
The probability of an adversary guessing the correct element
6.2 Security analysis
Theorem 6.1
The CSH0 protocol is a proof of knowledge if and only if f is a computational hard function. Moreover, the protocol is zero-knowledge in the honest verifier scenario.
Proof
The proof is similar to Theorem 3.2, and thus, we only provide a sketch. The completeness property is satisfied due to Theorem 2.1, Item 3.
A PPT algorithm
|
Algorithm 11. Algorithm
|
|
|---|---|
|
Input: An element
|
|
| 1 | Send
|
| 2 | Receive
|
| 3 |
return
|
Finally, the simulator
|
Algorithm 12. Simulator
|
|
|---|---|
|
Input: A function
|
|
| 1 | Choose
|
| 2 | Compute
|
| 3 |
return
|
Proposition 6.2
Let
Proof
When Victor sends
and thus, Peggy computes
□
Active-intruder attack against CSH0.
6.3 Examples
6.3.1
e
th root assumption
Using the same parameters as in the case of lsb-er, the eth root assumption (denoted er) states that given
Using this assumption, we can instantiate the CSH0 protocol with
The active-intruder attack from Proposition 6.2 works as follows: Mallory chooses
and thus, Peggy computes
Remark
The problem can also be stated for
6.3.2 Gap
2
κ
-residuosity assumption
Using the same parameters as in Section 3.3, we can define
In this case, Proposition 6.2’s attack becomes: Mallory chooses
and thus, Peggy computes
6.3.3 Computational Diffie-Hellman
Let
Basic Diffie-Hellman version of the CSH0 (DHCSH0) protocol.
Remark
Note that the DHCSH0 protocol was used in the study of Teşeleanu [34] to develop a method that performs full network authentication for resource-constrained devices.
The active-intruder attack from Proposition 6.2 works as follows: Mallory chooses
just as desired.
6.3.4 Computational bilinear Diffie-Hellman assumption
We assume the same setup as in the case of dbdh. Let
As in the case of cdh, this assumption allows us to have a more efficient version of the protocol. We will use Figure 8 as a reference. Thus, Peggy and Victor know
The active-intruder attack from Proposition 6.2 works as follows: Mallory chooses
just as desired.
7 Computational protocol – first variant
7.1 Description
Using a different functional requirement for computational hard functions (see Definition 7.1), we describe in Figure 9 a protocol that is secure against sequential and active-intruder attacks, as long as the parameters are selected correctly.
First variant of the computational Sherlock Holmes (CSH1) protocol.
Definition 7.1
(Complete computational hardness assumption) A function
there exists a PPT algorithm
Remark
A class of computational problems that satisfy the completeness property are
Remark
Stinson and Wu [5] introduced a version of the DHCSH0 protocol (further denoted by DHCSH1) in which instead of sending
7.2 Security analysis
Theorem 7.1
The CSH1 protocol is secure against sequential impersonation attacks in the random oracle model.
Proof
The proof is similar to Theorem 5.1, and thus, we only provide a sketch. In the first phase, we must simulate the hash oracle (Algorithm 8) and the prover (Algorithm 13). We can see that simulator
|
Algorithm 13. Prover
|
|
|---|---|
|
Input: A challenge query
|
|
| 1 |
if
|
| 2 |
|
| 3 | else |
| 4 |
|
In the second phase of the attack,
which is non-negligible.
|
Algorithm 14. Verifier
|
|
|---|---|
|
Input: A element
|
|
| 1 | Choose
|
| 2 | Send
|
| 3 |
if
|
|
|
|
| 6 | else |
|
|
|
□
Theorem 7.2
The CSH1 protocol is secure against active-intruder attacks in the random oracle model.
Proof
The proof is similar to Theorem 5.2, and thus, we only point out the differences. In this case, the, strings to indicate which of
If Victor accepts the proof, that means that
The prover will not reject with the negligible probability
As in the case of Theorem 5.2,
Let
As in the case of Theorem 5.2,
In this case, the prover will reject with overwhelming probability since the probability of obtaining a correct hash is
As in the case, Theorem 5.2,
To summarize, if adversary
8 Computational protocol – second variant
8.1 Description
Using a different functional requirement (see Definition 8.1), we describe in Figure 10 a protocol that is more efficient than CSH1 for some computational problems, while remaining secure against sequential and active-intruder attacks.
Second variant of the computational Sherlock Holmes (CSH2) protocol.
Definition 8.1
(Unique computational hardness assumption) A function
there exists a PPT algorithm
Remark
Two classes of computational problems that satisfy the uniqueness property are gap
Remark
A more efficient version of the Stinson-Wu protocol [5] was introduced in previous studies [16, 28]. We further denote it by DHCSH2. In this variant, Victor sends
8.2 Security analysis
Theorem 8.1
The CSH2 protocol is secure against sequential impersonation attacks in the random oracle model.
Proof
The proof is similar to Theorem 5.1, and thus, we only provide a sketch. In the first phase, we must simulate the hash oracle (Algorithm 15) and the prover (Algorithm 16). Note that in Algorithm 16, the list
|
Algorithm 15. Hashing oracle
|
|
|---|---|
|
Input: A hashing query
|
|
| 1 |
if
|
| 2 |
|
| 3 |
else if
|
|
|
|
| 6 | else |
|
|
|
| 9 |
return
|
|
Algorithm 16. Prover
|
|
|---|---|
|
Input: A challenge query
|
|
| 1 |
if
|
| 2 |
|
| 3 | else |
|
|
|
| 6 |
return
|
In the second phase of the attack,
which is non-negligible.
|
Algorithm 17. Verifier
|
|
|---|---|
|
Input: A element
|
|
| 1 | Send
|
| 2 | Receive
|
| 3 | Search
|
| 4 |
return
|
Theorem 8.2
The CSH2 protocol is secure against active-intruder attacks in the random oracle model.□
Proof
In this case, we use two-bit strings to indicate which of
Since
Let
The prover will reject as in the previous case, and thus,
To summarize, if adversary
9 Performance of the Sherlock Holmes protocols
In this section, we compare the Sherlock Holmes protocols to some classical zero-knowledge protocols such as Schnorr [8], Guillou-Quisquater [9], and Fiat-Shamir [17].
We further assume the same setup as in the case of cdh. From Figure 11, we can see that the bandwidth requirement for Schnorr’s protocol is
Schnorr’s protocol.
Remark
Okamoto’s protocol [7] can be seen as a vectorized version of Schnorr’s protocol with
Using Figure 11 as a reference, we further describe the Guillou-Quisquater (GQ) protocol. Assuming the setup from er we set
The bandwidth requirement for the GQ protocol is
The Fiat-Shamir protocol [17] considers
10 Conclusions
Our two main zero-knowledge protocols, decisional and computational Sherlock Holmes protocols, represent two new large classes of protocols. The presented list of examples is by no means exhaustive. Our next challenge is to see how we can adapt these protocols in order to obtain new cryptographic primitives (e.g., non-interactive zero-knowledge proofs or digital signatures).
-
Funding information: Author states no funding involved.
-
Author contributions: The author confirms the sole responsibility for the conception of the study, presented results and manuscript preparation.
-
Conflict of interest: Author states no conflict of interest.
Appendix A Active-intruder attacks
In this section, we provide an active-intruder attack for the zero-knowledge protocol introduced in Maimuţ and Teşeleanu [14]. This protocol is a generalization of Maurer’s unified zero-knowledge protocol [13], which, depending on the instantiation, can be transformed into either the Schnorr protocol [8][11] or the Okamoto protocol [7] or the Fiat-Shamir protocol [17] or the Guillou-Quisquater protocol [9]. Note that the protocol from Maimuţ and Teşeleanu [14], also generalizes Feige-Fiat-Shamir’s [6] and Chaum-Everste-Van De Graaf’s [36] protocols. More instantiations can be found in previous studies [13,14,37]. A direct consequence of our attack is that it supersedes the active-intruder attacks introduced in Stinson and Wu [5] for the Schnorr, Fiat-Shamir, Okamoto, and Guillou-Quisquater protocols.
A.1 Groups
Let
Let
A.2 Protocol
Let
A unified generic zero-knowledge (UGZK) protocol.
A.3 Attack
In order to succeed, the attacker Mallory first chooses at random
just as required by Victor.
Active-intruder attack against UGZK.
References
[1] Grigoriev D, Shpilrain V. No-leak authentication by the Sherlock Holmes method. Groups Complexity Cryptol. 2012;4(1):177–89. 10.1515/gcc-2012-0009Suche in Google Scholar
[2] Goldreich O. Zero-knowledge twenty years after its invention. IACR Cryptology ePrint Archive. 2002;2002/186. Suche in Google Scholar
[3] Bellare M, Palacio A. GQ and Schnorr identification schemes: proofs of security against impersonation under active and concurrent attacks. In: CRYPTO 2002. vol. 2442 of Lecture Notes in Computer Science. Springer; 2002. p. 162–77. 10.1007/3-540-45708-9_11Suche in Google Scholar
[4] Stinson DR. Cryptography: Theory and practice. Boca Raton: Chapman and Hall/CRC; 2006. Suche in Google Scholar
[5] Stinson DR, Wu J. An efficient and secure two-flow zero-knowledge identification protocol. J Math Cryptol. 2007;1(3):201–20. 10.1515/JMC.2007.010Suche in Google Scholar
[6] Feige U, Fiat A, Shamir A. Zero-knowledge proofs of identity. J Cryptol. 1988;1(2):77–94. 10.1007/BF02351717Suche in Google Scholar
[7] Okamoto T. Provably secure and practical identification schemes and corresponding signature schemes. In: CRYPTO 1992. vol. 740 of Lecture Notes in Computer Science. Springer; 1992. p. 31–53. 10.1007/3-540-48071-4_3Suche in Google Scholar
[8] Schnorr CP. Efficient identification and signatures for smart cards. In: CRYPTO 1989. vol. 435 of Lecture Notes in Computer Science. Springer; 1989. p. 239–52. 10.1007/0-387-34805-0_22Suche in Google Scholar
[9] Guillou LC, Quisquater JJ. A practical zero-knowledge protocol fitted to security microprocessor minimizing both transmission and memory. In: EUROCRYPT 1988. vol. 330 of Lecture Notes in Computer Science. Springer; 1988. p. 123–8. 10.1007/3-540-45961-8_11Suche in Google Scholar
[10] Schnorr CP. Efficient signature generation by smart cards. J Cryptol. 1991;4(3):161–74. 10.1007/BF00196725Suche in Google Scholar
[11] Guillou LC, Quisquater JJ. A “Paradoxical” indentity-based signature scheme resulting from zero-knowledge. In: CRYPTO 1988. vol. 403 of Lecture Notes in Computer Science. Springer; 1988. p. 216–31. 10.1007/0-387-34799-2_16Suche in Google Scholar
[12] Feige U, Shamir A. Witness indistinguishable and witness hiding protocols. In: STOC 1990. ACM; 1990. p. 416–26. 10.1145/100216.100272Suche in Google Scholar
[13] Maurer U. Unifying zero-knowledge proofs of knowledge. In: AFRICACRYPT 2009. vol. 5580 of Lecture Notes in Computer Science. Springer; 2009. p. 272–86. 10.1007/978-3-642-02384-2_17Suche in Google Scholar
[14] Maimuţ D, Teşeleanu G. A generic view on the unified zero-knowledge protocol and its applications. In: WISTP 2019. vol. 12024 of Lecture Notes in Computer Science. Springer; 2019. p. 32–46. 10.1007/978-3-030-41702-4_3Suche in Google Scholar
[15] Bellare M, Fischlin M, Goldwasser S, Micali S. Identification protocols secure against reset attacks. In: EUROCRYPT 2001. vol. 2045 of Lecture Notes in Computer Science. Springer; 2001. p. 495–511. 10.1007/3-540-44987-6_30Suche in Google Scholar
[16] Wu J, Stinson DR. An efficient identification protocol and the knowledge-of-exponent assumption. IACR Cryptology ePrint Archive. 2007; 2007/479. Suche in Google Scholar
[17] Fiat A, Shamir A. How to prove yourself: practical solutions to identification and signature problems. In: CRYPTO 1986. vol. 263 of Lecture Notes in Computer Science. Springer; 1986. p. 186–94. 10.1007/3-540-47721-7_12Suche in Google Scholar
[18] Teşeleanu G. Sherlock Holmes zero-knowledge protocols. In: ISPEC 2022. vol. 13620 of Lecture Notes in Computer Science. Springer; 2022. p. 573–88. 10.1007/978-3-031-21280-2_32Suche in Google Scholar
[19] Bellare M, Rogaway P. Introduction to modern cryptography; 2005. https://web.cs.ucdavis.edu/rogaway/classes/227/spring05/book/main.pdf. Suche in Google Scholar
[20] Bellare M, Goldwasser S. Lecture notes on cryptography; 2008. https://cseweb.ucsd.edu/ mihir/papers/gb.pdf. Suche in Google Scholar
[21] Ostrovsky R. Foundations of cryptography; 2010. http://web.cs.ucla.edu/rafail/PUBLIC/OstrovskyDraftLecNotes2010.pdf. Suche in Google Scholar
[22] Feige U, Shamir A. Zero knowledge proofs of knowledge in two rounds. In: CRYPTO 1989. vol. 435 of Lecture Notes in Computer Science. Springer; 1989. p. 526–44. 10.1007/0-387-34805-0_46Suche in Google Scholar
[23] Goldreich O, Oren Y. Definitions and properties of zero-knowledge proof systems. J Cryptol. 1994;7(1):1–32. 10.1007/BF00195207Suche in Google Scholar
[24] Barak B, Lindell Y, Vadhan S. Lower bounds for non-black-box zero knowledge. J Comput Syst Sci. 2006;72(2):321–91. 10.1016/j.jcss.2005.06.010Suche in Google Scholar
[25] Goldreich O, Krawczyk H. On the composition of zero-knowledge proof systems. SIAM J Comput. 1996;25(1):169–92. 10.1137/S0097539791220688Suche in Google Scholar
[26] Damgard I. Towards practical public key systems secure against chosen ciphertext attacks. In: CRYPTO 1991. vol. 576 of Lecture Notes in Computer Science. Springer; 1991. p. 445–56. 10.1007/3-540-46766-1_36Suche in Google Scholar
[27] Sahai A, Vadhan S. A complete problem for statistical zero knowledge. J ACM. 2003;50(2):196–249. 10.1145/636865.636868Suche in Google Scholar
[28] Wu J, Stinson DR. An efficient identification protocol secure against concurrent-reset attacks. J Math Cryptol. 2009;3(4):339–52. 10.1515/JMC.2009.021Suche in Google Scholar
[29] Cocks C. An identity based encryption scheme based on quadratic residues. In: IMACC 2001. vol. 2260 of Lecture Notes in Computer Science. Springer; 2001. p. 360–3. 10.1007/3-540-45325-3_32Suche in Google Scholar
[30] Benhamouda F, Herranz J, Joye M, Libert B. Efficient cryptosystems from 2kth power residue symbols. J Cryptol. 2017;30(2):519–49. 10.1007/s00145-016-9229-5Suche in Google Scholar
[31] Okamoto T, Pointcheval D. Gap-problems: A new class of problems for the security of cryptographic schemes. In: PKC 2001. vol. 1992 of Lecture Notes in Computer Science. Springer; 2001. p. 104–18. 10.1007/3-540-44586-2_8Suche in Google Scholar
[32] Chatterjee S, Sarkar P. Practical hybrid (hierarchical) identity-based encryption schemes based on the decisional bilinear Diffie-Hellman assumption. IJACT. 2013;3(1):47–83. 10.1504/IJACT.2013.053434Suche in Google Scholar
[33] Niven I, Zuckerman HS, Montgomery HL. An introduction to the theory of numbers. Hoboken, New Jersey: John Wiley & Sons; 1991. Suche in Google Scholar
[34] Teşeleanu G. Lightweight swarm authentication. In: SecITC 2021. vol. 13195 of Lecture Notes in Computer Science. Springer; 2021. p. 248–59. 10.1007/978-3-031-17510-7_17Suche in Google Scholar
[35] Girault M. An identity-based identification scheme based on discrete logarithms Modulo a composite number. In: EUROCRYPT 1990. vol. 473 of Lecture Notes in Computer Science. Springer; 1990. p. 481–6. 10.1007/3-540-46877-3_44Suche in Google Scholar
[36] Chaum D, Evertse JH, Van De Graaf J. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In: EUROCRYPT 1987. vol. 304 of Lecture Notes in Computer Science. Springer; 1987. p. 127–41. 10.1007/3-540-39118-5_13Suche in Google Scholar
[37] Teşeleanu G. Unifying Kleptographic attacks. In: NordSec 2018. vol. 11252 of Lecture Notes in Computer Science. Springer; 2018. p. 73–87. 10.1007/978-3-030-03638-6_5Suche in Google Scholar
© 2025 the author(s), published by De Gruyter
This work is licensed under the Creative Commons Attribution 4.0 International License.
Artikel in diesem Heft
- A McEliece cryptosystem using permutation codes
- Research Articles
- The condition number associated with ideal lattices from odd prime degree cyclic number fields
- A small serving of mash: (Quantum) algorithms for SPDH-Sign with small parameters
- The least primitive roots mod p
- On the independence heuristic in the dual attack
- Sherlock Holmes zero-knowledge protocols secure against active attackers
- Inner product functional encryption based on the UOV scheme
- Review Article
- Leveled homomorphic encryption schemes for homomorphic encryption standard
- Special Issue based on CIFRIS24
- Modern techniques in somewhat homomorphic encryption
- Investigation of metabelian platform groups for protocols based on (simultaneous) conjugacy search problem
- Smaller public keys for MinRank-based schemes
- Application of Mordell–Weil lattices with large kissing numbers to acceleration of multiscalar multiplication on elliptic curves
- First-degree prime ideals of composite extensions
- Dynamic-FROST: Schnorr threshold signatures with a flexible committee
- BTLE: Atomic swaps with time-lock puzzles
- Security analysis of ZKPoK based on MQ problem in the multi-instance setting
Artikel in diesem Heft
- A McEliece cryptosystem using permutation codes
- Research Articles
- The condition number associated with ideal lattices from odd prime degree cyclic number fields
- A small serving of mash: (Quantum) algorithms for SPDH-Sign with small parameters
- The least primitive roots mod p
- On the independence heuristic in the dual attack
- Sherlock Holmes zero-knowledge protocols secure against active attackers
- Inner product functional encryption based on the UOV scheme
- Review Article
- Leveled homomorphic encryption schemes for homomorphic encryption standard
- Special Issue based on CIFRIS24
- Modern techniques in somewhat homomorphic encryption
- Investigation of metabelian platform groups for protocols based on (simultaneous) conjugacy search problem
- Smaller public keys for MinRank-based schemes
- Application of Mordell–Weil lattices with large kissing numbers to acceleration of multiscalar multiplication on elliptic curves
- First-degree prime ideals of composite extensions
- Dynamic-FROST: Schnorr threshold signatures with a flexible committee
- BTLE: Atomic swaps with time-lock puzzles
- Security analysis of ZKPoK based on MQ problem in the multi-instance setting
