Feige–Fiat–Shamir identification scheme

In cryptography, the Feige–Fiat–Shamir identification scheme is a type of parallel zero-knowledge proof developed by Uriel Feige, Amos Fiat, and Adi Shamir in 1988. Like all zero-knowledge proofs, it allows one party, the Prover, to prove to another party, the Verifier, that they possess secret information without revealing to Verifier what that secret information is. The Feige–Fiat–Shamir identification scheme, however, uses modular arithmetic and a parallel verification process that limits the number of communications between Prover and Verifier.

Setup

edit

Following a common convention, call the prover Peggy and the verifier Victor.

Choose two large prime integers p and q and compute the product n = pq. Create secret numbers   coprime to n. Compute  . Peggy and Victor both receive   while   and   are kept secret. Peggy is then sent the numbers  . These are her secret login numbers. Victor is sent the numbers   by Peggy when she wishes to identify herself to Victor. Victor is unable to recover Peggy's   numbers from his   numbers due to the difficulty in determining a modular square root when the modulus' factorization is unknown.

Procedure

edit
  1. Peggy chooses a random integer  , a random sign   and computes  . Peggy sends   to Victor.
  2. Victor chooses numbers   where   equals 0 or 1. Victor sends these numbers to Peggy.
  3. Peggy computes  . Peggy sends this number to Victor.
  4. Victor checks that   and that  

This procedure is repeated with different   and   values until Victor is satisfied that Peggy does indeed possess the modular square roots ( ) of his   numbers.

Security

edit

In the procedure, Peggy does not give any useful information to Victor. She merely proves to Victor that she has the secret numbers without revealing what those numbers are. Anyone who intercepts the communication between each Peggy and Victor would only learn the same information. The eavesdropper would not learn anything useful about Peggy's secret numbers.[citation needed]

Suppose Eve has intercepted Victor's   numbers but does not know what Peggy's   numbers are. If Eve wants to try to convince Victor that she is Peggy, she would have to correctly guess what Victor's   numbers will be. She then picks a random  , calculates   and sends   to Victor. When Victor sends  , Eve simply returns her  . Victor is satisfied and concludes that Eve has the secret numbers. However, the probability of Eve correctly guessing what Victor's   will be is 1 in  . By repeating the procedure   times, the probability drops to 1 in   . For   and   the probability of successfully posing as Peggy is less than 1 in 1 million.

References

edit
  • Feige, Uriel; Fiat, Amos; Shamir, Adi (1988). "Zero-knowledge proofs of identity". Journal of Cryptology. 1 (2): 77–94. doi:10.1007/BF02351717. S2CID 2950602.
  • Trappe, Wade; Washington, Lawrence C. (2003). Introduction to Cryptography with Coding Theory. Upper Saddle River: Prentice-Hall. pp. 231–233. ISBN 0-13-061814-4.
  • Wong, Chung Kei; Lam, Simon S (August 1999). "Digital Signatures for Flows and Multicasts" (PDF). IEEE/ACM Transactions on Networking. 7 (4). (eFFS, extended Feige–Fiat–Shamir scheme)