{"id":381509,"date":"2024-06-29T03:42:32","date_gmt":"2024-06-29T03:42:32","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=381509"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2024-06-29T03:42:32","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=381509","title":{"rendered":"On Schnorr identification protocol compatibility with instant digital signature mode<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

This post describes a modification of the Schnorr identification protocol which is compatible with the instant digital signature mode.<\/p>\n

Introduction<\/strong><\/p>\n

The article<\/u><\/a> describes the interactive Schnorr identification protocol (hereinafter referred to as the Schnorr protocol) and formulates the problem of compatibility of this protocol with the instant digital signature (IDS) mode. This post shows how to modify the Schnorr protocol to provide such compatibility.<\/p>\n

IDS-compatible Schnorr protocol<\/strong><\/p>\n

Recall that some information about the arithmetic of elliptic curve points, as well as an explanation of ECDLP and DLP, was explained by our previous publication<\/u><\/a>.<\/p>\n

For the sake of simplicity, we will leave everything that concerns the Schnorr protocol unchanged, including the key pair \"\\{\\mathbf{x},\\mathsf{R}=[-\\mathbf{x}]\\mathsf{G}_1\\}\" and the certificate \"\\{D_{\\mathsf{R}},\\mathsf{R},<\/p>\n

If we interpret the necessary condition<\/u><\/a>, then IDS-compatibility is possible when \"P\" and \"V\" are able to compute some common secret component. Such a component can be expressed as a shared session secret key. We will show how to do this using the example of the Schnorr protocol. Let’s denote the cryptographic hash function as \"\\hslash(\\cdot).\"<\/p>\n

Let’s make some changes to the protocol. Let’s use the following trick: we’ll «hide» the ephemeris \"\\phi\" at a point on the curve. This causes \"\\textit also turn into a point. As a result, we get the following protocol.<\/p>\n

Protocol messages.<\/em><\/p>\n

1. \u00a0 \"P<\/p>\n

2. \u00a0 \"P<\/p>\n

3. \u00a0 \"P<\/p>\n

The actions of the parties.<\/em><\/p>\n

\"P\" demonstrates to \"V\" that he posesses (knows) \"\\mathbf{x}.\" In order to achieve this, the subsequent actions are executed:<\/p>\n

1. \u00a0 \"P\" selects \"\\upsilon\\in_R\\!(0,m-1] computes \"\\mathsf{S}=[\\upsilon]\\mathsf{G}_1 verifies the condition \"\\mathsf{S}\\stackrel{?}\\neq\\infty.\" If \"\\mathsf{S}=\\infty\" then it chooses a new \"\\upsilon\" and repeats all the necessary computations and checks;<\/p>\n

2. \u00a0 \"V\" reads an actual certificate \"\\{D_{\\mathsf{R}},\\mathsf{R}, and checks the DS \"\\mathfrak{B}\\Leftarrow{\\rm{Verify}}( where \"\\rm{P}_T\" is the trusted party’s public key \"T.\" If \"\\mathfrak{B}=False\" then the session ends. If \"\\mathfrak{B}=True\" then it selects \"\\phi\\in_R\\!(0, and computes \"\\mathsf{T}=[\\phi]\\mathsf{G}_1\" (\"\\textit{challenge}\"). If \"\\mathsf{T}=\\infty\" then it selects a new \"\\phi\" and repeats all the necessary computations and checks;<\/p>\n

3. \u00a0 \"P\" checks the condition \"\\mathsf{T}\\stackrel{?}\\neq\\infty,\" if it is true, then it computes \"\\mathsf{N}=[\\mathbf{x}]\\mathsf{T}+\\mathsf{S}=[\\mathbf{x}\\phi+\\upsilon \"(\\textit{response}\"), otherwise the session ends;<\/p>\n

4. \u00a0 \"V\" computes \"\\mathsf{Q}=\\mathsf{N}+[\\phi]\\mathsf{R}.\" Then it checks \"x_{\\mathsf{Q}}\\stackrel{?}{=}x_{\\mathsf{S}}.\" If equal then the proof is accepted, and rejected otherwise.<\/p>\n

So, suppose that the identification step was successful and \"V\" accepted the proof provided by \"P.\"<\/p>\n

At this point, \"P\" has the following set of data: \"\\upsilon\" (\"\\textit{commitment}\" by construction), \"\\mathsf{T}\" (received from \"V\" as a \"\\textit{challenge}\"). \"V\" knows \"\\mathsf{S}\" (received from \"P\" as a \"\\textit{witness}\"), \"\\phi\" (by construction), \"\\mathsf{N}\" (received from \"P\" as a \"\\textit{response}\").<\/p>\n

The parties independently compute a shared session secret key in accordance with the following rules:<\/p>\n

    \n
  1. \n

    \u00a0\"P\" computes \"\\mathsf{A}=[\\upsilon]\\mathsf{T}=[\\upsilon\\phi\\pmod \"g_1=\\hslash(x_{\\mathsf{A}}\\|y_{\\mathsf{A}}).\"<\/p>\n<\/li>\n<\/ol>\n

      \n
    1. \n

      \u00a0 \"V\" computes \"\\mathsf{B}=[\\phi]\\mathsf{S}=[\\phi\\upsilon\\pmod \"g_3=\\hslash(x_{\\mathsf{B}}\\|y_{\\mathsf{B}}).\"<\/p>\n<\/li>\n<\/ol>\n

      Obviously, \"\\mathsf{A}=\\mathsf{B}\" due to commutativity. Therefore, \"g_1=g_3.\" As for the IDS, then:<\/p>\n

      1. \u00a0 \"P\" generates a signature for the given message \"M\" using \"g_1,\" given the value of the hash function \"\\hslash(g_1\\|M\\|\\ldots).\"<\/p>\n

      2. \u00a0 \"V\" checks the signature for some message \"M'\" using \"g_3\" given the hash function value \"\\hslash(g_3\\|M'\\|\\ldots).\"<\/p>\n

      The advantage of the above mentioned solution is that the changes relate to arithmetic operations and do not affect the logic of the protocol. This is an important circumstance, since any fundamental modifications would lead to the need to study the cryptographic strength of the new design with all the ensuing consequences.<\/p>\n

      Earlier, we noted that we have a protocol with similar functionality that solves this problem, but at the same time allows us to recognize that the prover belongs to a certain local community of registered participants.<\/p>\n

      Preliminary analysis<\/strong><\/p>\n

      Let’s note that \"\\upsilon, are only known to \"P\" and \"V,\" respectively. Then an attacker can get \"\\upsilon\" or \"\\phi\" by finding an ECDLP solution given \"\\mathsf{S}\" or \"\\mathsf{T}\" respectively. It is also possible to find a DLP solution if \"e_m(\\mathsf{S}, or \"e_m(\\mathsf{T}, The purpose of the \"e_m(\\cdot, function, as well as the relationship between ECDLP and DLP, is explained in Appendix A<\/u><\/a>. Since \"g_1=g_3,\" only someone who knows \"\\upsilon\" or \"\\phi,\" as well as the secret key of an arbitrary DS scheme chosen for this goal is able to generate the IDS.<\/p>\n

      An active attacker, using interception and blocking techniques, is able to impose \"\\mathsf{S}'=[\\upsilon']\\mathsf{G}_1\" instead of \"\\mathsf{S},\" \"\\mathsf{T}'=[\\phi']\\mathsf instead of \"\\mathsf{T}\" and \"\\mathsf{N}'=[\\mathbf{x}]\\mathsf{T}'+\\mathsf{S}'\" instead of \"\\mathsf{N}\" when \"\\upsilon'\\neq For example, these may be messages from another session. However, \"V\" will overwhelmingly reject the provided proof, since \"\\mathsf{Q}'=\\mathsf{N}'+[\\phi]\\mathsf{R}=[\\mathbf{x}(\\phi'-\\phi)+ and \"x_{\\mathsf{Q}'}=x_{\\mathsf{S}'}\" with negligible probability. In addition, \"\\mathsf{A}'=[\\upsilon]\\mathsf{T}'=[\\upsilon\\phi'\\pmod \"\\mathsf{B}'=[\\phi]\\mathsf{S}'=[\\phi\\upsilon'\\pmod and \"\\mathsf{A}'=\\mathsf{B}'\" with negligible probability.<\/p>\n

      The amount of information transmitted<\/strong><\/p>\n

      We will use the compact curve point representation [Cohen_etc._2006] (section 13.2.5).<\/p>\n

      The point \"\\mathsf{Q}\" is given by a pair of coordinates \"x_{\\mathsf{Q}}, If \"\\mathsf{Q}\" belongs to the curve, then the equation \"y_{\\mathsf{Q}}^2=x_{\\mathsf{Q}}^3+ax_{\\mathsf{Q}}+b\" is true for some \"a, This equation can be interpreted as \"y_{\\mathsf{Q}}^2 where \"r\" is a quadratic residue and then there are only two solutions \"\\pm For \"y_\\mathsf{Q}<p\" the solution is \"-y_\\mathsf{Q}\\bmod If \"y_{\\mathsf{Q}}\" is even, then \"(p-y_{\\mathsf{Q}})\" is odd, and vice versa. In the general case, of two solutions, one is always even and the other is odd.<\/p>\n

      Let the point \"\\mathsf{Q}\" be represented by the coordinate \"x_{\\mathsf{Q}}.\" We will transmit over the communication channel \"(x_{\\mathsf{Q}}, where \"\\mathfrak{s}\" is a binary variable that allows us to determine the desired solution from a pair of possible ones. Let’s make it a rule that \"\\mathfrak{s}=0\" means even, and \"\\mathfrak{s}=1\" means odd. For example, for \"(x_\\mathsf{Q}, one should get a pair \"\\{y_{\\mathsf{Q}}, and then choose an odd solution from this pair.<\/p>\n

      \"\\lceil\\log_{2}p\\rceil+1\" bits of memory is required to store an arbitrary point on the curve. In \"\\mathbb{F}_p,\" the square root is computed using the Tonelli-Shanks algorithm of asymptotic computational complexity \"O(\\log_{2}^2{p})\" [Cohen_etc._2006] (section 11.1.5).<\/p>\n

      Then, to restore the \"\\mathsf{Q}\" point, it’s necessary to perform the following actions:<\/p>\n

      1. \u00a0 For a given coordinate \"x_{\\mathsf{Q}},\" a certain coordinate \"y_*\" is computed using the Tonelli-Shanks algorithm.<\/p>\n

      2. \u00a0 If \"(\\mathfrak{s}=1)\\land(y_*\\bmod then \"y_\\mathsf{Q}=y_*.\"<\/p>\n

      3. \u00a0 If \"(\\mathfrak{s}=1)\\land(y_*\\bmod then \"y_\\mathsf{Q}=p-y_*.\"<\/p>\n

      4. \u00a0 If \"(\\mathfrak{s}=0)\\land(y_*\\bmod then \"y_\\mathsf{Q}=y_*.\"<\/p>\n

      5. \u00a0 If \"(\\mathfrak{s}=0)\\land(y_*\\bmod then \"y_\\mathsf{Q}=p-y_*.\"<\/p>\n

      If the compact representation is used, then \"3(\\lceil\\log_{2}{p}\\rceil+1)\" bits would need to be transmitted to deliver \"\\mathsf{S},\" \"\\mathsf{T},\" and \"\\mathsf{N}\" in total. For comparison, in the original Schnorr protocol, under the same conditions, for the delivery of \"\\mathsf{S}, and \"\\psi\" in total, it is necessary to send \"2(\\lceil\\log_{2}m\\rceil)+\\lceil\\log_{2}p bits.<\/p>\n

      Computation optimization<\/strong><\/p>\n

      The complexity depends on the methods for computing the scalar multiplication, as well as the choice of the computing platform. Thus, for example, tests that were carried out using a test bench implemented in the Scala v2.13.6 programming language on a MacBook Pro (15-inch, 2016) hardware platform with a 4-core Intel Core i7 processor running macOS Monterey version 12.6.2 using primitives from the PBC library<\/u><\/a> show that due to the preprocessing possible for the constant \"\\mathsf{G}_1,\" the scalar product \"\\mathsf{Q}_1=[\\alpha]\\mathsf{G}_1\" is on average 85.37% more efficient than the scalar products \"\\mathsf{Q}_2=[\\alpha]\\mathsf{P},\" where \"\\mathsf{P}\\neq\\mathsf{G}_1\\neq The measurement results are summarized in Table 1.<\/p>\n

      <\/figure>\n

      IDS mode and public key certificates<\/strong><\/p>\n

      \"P\" owns the key pair \"\\{\\mathbf{x}, A corresponding certificate is issued for the public key \"\\mathsf{R}.\" The following question needs to be answered: what benefit can be gained from the IDS mode with a public key certificate?<\/p>\n

      Let the certificate \"\\{D_{\\mathsf{R}},\\mathsf{R}, be issued for the public key \"\\mathsf{R},\" where \"\\Im_{\\mathsf{R}} \u2014 DS of trusted party \"T,\" \"D_{\\mathsf{R} \u2014 personal data of \"P\" and \"\\rm{S}_T\" \u2014 secret key of \"T,\" intended for generating the certificate’s DS.<\/p>\n

      Let’s set up a thought experiment and, in the absence of the DS mode, assume that \"P\" sends \"V\" some digitally certified personal data \"D'.\" Furthermore, \"P\" claims that \"D'\" is his own personal data. It should be noted right away that this data could have been obtained in various ways, for example, as a result of collusion, the use of social engineering methods, or simply copied from publicly available long-term memory. To verify the digital signature, \"V\" must use the public key \"\\mathsf{P}'\" from the certificate \"\\{D',\\mathsf{P}', Let’s also assume that all necessary checks have confirmed the authenticity and integrity of \"\\mathsf{P}',<\/p>\n

      As a result, \"V\" has two certificates \"\\{D_{\\mathsf{R}},\\mathsf{R}, and \"\\{D',\\mathsf{P}', each issued by a trusted CA. Consider the case when \"D_{\\mathsf{R}}\\neq is treated uniquely). As a result, \"V\" is unable to make a correct choice about \"D_{\\mathsf{R}}\" or \"D'\" because there is no decision criterion. Obviously, such uncertainty is unacceptable.<\/p>\n

      If the IDS mode is enabled, then when making a decision about \"D_{\\mathsf{R}}\" or \"D',\" \"V\" relies on the proof that was provided to \"P\" at the identification stage. \"V\" reasons using the following logic.<\/p>\n

      A DS for personal data can only be generated by someone who simultaneously has access to the variables of a separate identification protocol session, both public and secret, including the secret key for generating a DS.<\/p>\n

      Let’s assume that the digital signature was obtained as a result of collusion. To do this, an attacker must force the owner of personal data to certify this data with his DS, but with the inclusion of some auxiliary data, about which the certifier does not know anything. Based on the associated risk model, such an event seems implausible. It is overwhelmingly likely that the witness will refuse to include such data fearing undesirable consequences, such as implicit debt imposition, blacklisting, account blocking, and so on.<\/p>\n

      Open verification in the Schnorr protocol<\/strong><\/p>\n

      The peculiarity of the Schnorr protocol is that anyone with access to the variables \"\\mathsf{S}, and \"\\psi\" can verify the correctness of the evaluation made by \"V\" towards the proof given by \"P.\"<\/p>\n

      Indeed, the variables mentioned above are transmitted over an insecure communication channel and, therefore, are publicly available. Since anyone can use the public key \"\\mathsf{R},\" it is not necessary to have \"V\" authority to compute \"\\mathsf{Q}=[\\psi]\\mathsf{G}_1+[\\phi]\\mathsf{R}= and then check \"x_{\\mathsf{Q}}\\stackrel{?}{=}x_{\\mathsf{S}}.\"<\/p>\n

      The practical meaning here is the ability to control the actions of both \"V\" and \"P.\" This is important in the case when disagreements may arise. For example, when \"P\" claims to have provided the correct proof, but \"V\" denies it.<\/p>\n

      Summary<\/strong><\/p>\n

      Estimates of the amount of transmitted information for the original Schnorr protocol and the modification described above differ insignificantly.<\/p>\n

      The original Schnorr protocol uses three scalar multiplications, while the modification of the protocol uses four such multiplications. Since the scalar multiplications \"\\mathsf{S}=[\\upsilon]\\mathsf{G}_1\" and \"\\mathsf{T}=[\\phi]\\mathsf{G}_1\" are computed using the generating element \"\\mathsf{G}_1,\" the optimization is possible. This optimization allows to reduce computational complexity in exchange for the allocation of additional memory for storing intermediate results (see Table 1). Note that in the original protocol, when computing the point \"\\mathsf{Q}=[\\psi]\\mathsf{G}_1+[\\phi]\\mathsf{R},\" only partial optimization is allowed. However, in the modified protocol, when computing the points \"\\mathsf{N}\" and \"\\mathsf{Q}=\\mathsf{N}+[\\phi]\\mathsf{R},\" as well as the scalar multiplications \"\\mathsf{A}=[\\upsilon]\\mathsf{T}\" and \"\\mathsf{B}=[\\phi]\\mathsf{S}\" such optimization is impossible.<\/p>\n

      In the proposed modification of the protocol, open verification is not feasible.<\/p>\n

      Conclusion<\/strong><\/p>\n

      It should be attested that we were able to solve the problem for a particular protocol in a relatively simple way. However, for an arbitrary identification protocol, the problem of compatibility with the IDS mode remains open. In the future, we will attempt to find a solution to the problem for some well-known identification protocol that is different from the Schnorr protocol.<\/p>\n

      The text of the article in pdf format can be downloaded here<\/a>.<\/p>\n

      Bibliography<\/strong><\/p>\n

      [Cohen_etc._2006] Cohen, H., Frey, G., Roberto Avanzi, R., Doche C., Lange, T., Nguyen, K. and Vercauteren, F. Handbook of Elliptic and Hyperelliptic Curve Cryptography, Chapman and Hall \/CRC, 2006.<\/p>\n<\/p>\n<\/div>\n<\/div>\n<\/div>\n

      <\/div>\n


      \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438       https:\/\/habr.com\/ru\/articles\/748354\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

      <\/div>\n
      \n
      \n
      \n
      \n

      This post describes a modification of the Schnorr identification protocol which is compatible with the instant digital signature mode.<\/p>\n

      Introduction<\/strong><\/p>\n

      The article<\/u><\/a> describes the interactive Schnorr identification protocol (hereinafter referred to as the Schnorr protocol) and formulates the problem of compatibility of this protocol with the instant digital signature (IDS) mode. This post shows how to modify the Schnorr protocol to provide such compatibility.<\/p>\n

      IDS-compatible Schnorr protocol<\/strong><\/p>\n

      Recall that some information about the arithmetic of elliptic curve points, as well as an explanation of ECDLP and DLP, was explained by our previous publication<\/u><\/a>.<\/p>\n

      For the sake of simplicity, we will leave everything that concerns the Schnorr protocol unchanged, including the key pair and the certificate <\/p>\n

      If we interpret the necessary condition<\/u><\/a>, then IDS-compatibility is possible when and are able to compute some common secret component. Such a component can be expressed as a shared session secret key. We will show how to do this using the example of the Schnorr protocol. Let’s denote the cryptographic hash function as <\/p>\n

      Let’s make some changes to the protocol. Let’s use the following trick: we’ll «hide» the ephemeris at a point on the curve. This causes also turn into a point. As a result, we get the following protocol.<\/p>\n

      Protocol messages.<\/em><\/p>\n

      1. \u00a0 <\/p>\n

      2. \u00a0 <\/p>\n

      3. \u00a0 <\/p>\n

      The actions of the parties.<\/em><\/p>\n

      demonstrates to that he posesses (knows) In order to achieve this, the subsequent actions are executed:<\/p>\n

      1. \u00a0 selects computes verifies the condition If then it chooses a new and repeats all the necessary computations and checks;<\/p>\n

      2. \u00a0 reads an actual certificate and checks the DS where is the trusted party’s public key If then the session ends. If then it selects and computes (). If then it selects a new and repeats all the necessary computations and checks;<\/p>\n

      3. \u00a0 checks the condition if it is true, then it computes ), otherwise the session ends;<\/p>\n

      4. \u00a0 computes Then it checks If equal then the proof is accepted, and rejected otherwise.<\/p>\n

      So, suppose that the identification step was successful and accepted the proof provided by <\/p>\n

      At this point, has the following set of data: ( by construction), (received from as a ). knows (received from as a ), (by construction), (received from as a ).<\/p>\n

      The parties independently compute a shared session secret key in accordance with the following rules:<\/p>\n

        \n
      1. \n

        \u00a0 computes <\/p>\n<\/li>\n<\/ol>\n

          \n
        1. \n

          \u00a0 computes <\/p>\n<\/li>\n<\/ol>\n

          Obviously, due to commutativity. Therefore, As for the IDS, then:<\/p>\n

          1. \u00a0 generates a signature for the given message using given the value of the hash function <\/p>\n

          2. \u00a0 checks the signature for some message using given the hash function value <\/p>\n

          The advantage of the above mentioned solution is that the changes relate to arithmetic operations and do not affect the logic of the protocol. This is an important circumstance, since any fundamental modifications would lead to the need to study the cryptographic strength of the new design with all the ensuing consequences.<\/p>\n

          Earlier, we noted that we have a protocol with similar functionality that solves this problem, but at the same time allows us to recognize that the prover belongs to a certain local community of registered participants.<\/p>\n

          Preliminary analysis<\/strong><\/p>\n

          Let’s note that are only known to and respectively. Then an attacker can get or by finding an ECDLP solution given or respectively. It is also possible to find a DLP solution if or The purpose of the function, as well as the relationship between ECDLP and DLP, is explained in Appendix A<\/u><\/a>. Since only someone who knows or as well as the secret key of an arbitrary DS scheme chosen for this goal is able to generate the IDS.<\/p>\n

          An active attacker, using interception and blocking techniques, is able to impose instead of instead of and instead of when For example, these may be messages from another session. However, will overwhelmingly reject the provided proof, since and with negligible probability. In addition, and with negligible probability.<\/p>\n

          The amount of information transmitted<\/strong><\/p>\n

          We will use the compact curve point representation [Cohen_etc._2006] (section 13.2.5).<\/p>\n

          The point is given by a pair of coordinates If belongs to the curve, then the equation is true for some This equation can be interpreted as where is a quadratic residue and then there are only two solutions For the solution is If is even, then is odd, and vice versa. In the general case, of two solutions, one is always even and the other is odd.<\/p>\n

          Let the point be represented by the coordinate We will transmit over the communication channel where is a binary variable that allows us to determine the desired solution from a pair of possible ones. Let’s make it a rule that means even, and means odd. For example, for one should get a pair and then choose an odd solution from this pair.<\/p>\n

          bits of memory is required to store an arbitrary point on the curve. In the square root is computed using the Tonelli-Shanks algorithm of asymptotic computational complexity [Cohen_etc._2006] (section 11.1.5).<\/p>\n

          Then, to restore the point, it’s necessary to perform the following actions:<\/p>\n

          1. \u00a0 For a given coordinate a certain coordinate is computed using the Tonelli-Shanks algorithm.<\/p>\n

          2. \u00a0 If then <\/p>\n

          3. \u00a0 If then <\/p>\n

          4. \u00a0 If then <\/p>\n

          5. \u00a0 If then <\/p>\n

          If the compact representation is used, then bits would need to be transmitted to deliver and in total. For comparison, in the original Schnorr protocol, under the same conditions, for the delivery of and in total, it is necessary to send bits.<\/p>\n

          Computation optimization<\/strong><\/p>\n

          The complexity depends on the methods for computing the scalar multiplication, as well as the choice of the computing platform. Thus, for example, tests that were carried out using a test bench implemented in the Scala v2.13.6 programming language on a MacBook Pro (15-inch, 2016) hardware platform with a 4-core Intel Core i7 processor running macOS Monterey version 12.6.2 using primitives from the PBC library<\/u><\/a> show that due to the preprocessing possible for the constant the scalar product is on average 85.37% more efficient than the scalar products where The measurement results are summarized in Table 1.<\/p>\n

          <\/figure>\n

          IDS mode and public key certificates<\/strong><\/p>\n

          owns the key pair A corresponding certificate is issued for the public key The following question needs to be answered: what benefit can be gained from the IDS mode with a public key certificate?<\/p>\n

          Let the certificate be issued for the public key where \u2014 DS of trusted party \u2014 personal data of and \u2014 secret key of intended for generating the certificate’s DS.<\/p>\n

          Let’s set up a thought experiment and, in the absence of the DS mode, assume that sends some digitally certified personal data Furthermore, claims that is his own personal data. It should be noted right away that this data could have been obtained in various ways, for example, as a result of collusion, the use of social engineering methods, or simply copied from publicly available long-term memory. To verify the digital signature, must use the public key from the certificate Let’s also assume that all necessary checks have confirmed the authenticity and integrity of <\/p>\n

          As a result, has two certificates and each issued by a trusted CA. Consider the case when is treated uniquely). As a result, is unable to make a correct choice about or because there is no decision criterion. Obviously, such uncertainty is unacceptable.<\/p>\n

          If the IDS mode is enabled, then when making a decision about or relies on the proof that was provided to at the identification stage. reasons using the following logic.<\/p>\n

          A DS for personal data can only be generated by someone who simultaneously has access to the variables of a separate identification protocol session, both public and secret, including the secret key for generating a DS.<\/p>\n

          Let’s assume that the digital signature was obtained as a result of collusion. To do this, an attacker must force the owner of personal data to certify this data with his DS, but with the inclusion of some auxiliary data, about which the certifier does not know anything. Based on the associated risk model, such an event seems implausible. It is overwhelmingly likely that the witness will refuse to include such data fearing undesirable consequences, such as implicit debt imposition, blacklisting, account blocking, and so on.<\/p>\n

          Open verification in the Schnorr protocol<\/strong><\/p>\n

          The peculiarity of the Schnorr protocol is that anyone with access to the variables and can verify the correctness of the evaluation made by towards the proof given by <\/p>\n

          Indeed, the variables mentioned above are transmitted over an insecure communication channel and, therefore, are publicly available. Since anyone can use the public key it is not necessary to have authority to compute and then check <\/p>\n

          The practical meaning here is the ability to control the actions of both and This is important in the case when disagreements may arise. For example, when claims to have provided the correct proof, but denies it.<\/p>\n

          Summary<\/strong><\/p>\n

          Estimates of the amount of transmitted information for the original Schnorr protocol and the modification described above differ insignificantly.<\/p>\n

          The original Schnorr protocol uses three scalar multiplications, while the modification of the protocol uses four such multiplications. Since the scalar multiplications and are computed using the generating element the optimization is possible. This optimization allows to reduce computational complexity in exchange for the allocation of additional memory for storing intermediate results (see Table 1). Note that in the original protocol, when computing the point only partial optimization is allowed. However, in the modified protocol, when computing the points and as well as the scalar multiplications and such optimization is impossible.<\/p>\n

          In the proposed modification of the protocol, open verification is not feasible.<\/p>\n

          Conclusion<\/strong><\/p>\n

          It should be attested that we were able to solve the problem for a particular protocol in a<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-381509","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/381509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=381509"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/381509\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=381509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=381509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=381509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}