Re: [Cfrg] Internet Drafts on J-PAKE and Schnorr signature

On Tue, May 21, 2013 at 08:33:43PM +0100, Feng Hao wrote:
> Hi,
> 
> I just submitted two internet drafts for J-PAKE and Schnorr signature. The latter is a building block for the former, but I separated it out as the technique could be generally useful to other applications as well. 
> 
> I appreciate any comments or suggestions.
> 
> Regards,
> Feng

"..is a zero-knowledge proof primitive"
"It has been proven secure assuming that
       the verifier is honest and that the discrete logarithm problem is
       intractable"
"3.  Zero-knowledge: a prover leaks no more than one bit information
       to the verifier: whether the prover knows the discrete logarithm."

Simulator algorithm is not mentioned in zero knowledge definition is section 3.
Extractor algorithm and formal definition of proof of knowledge is missing.
"Replay attack" considerations may need be updated.

Honest verifier zero knowledge is a property of simulated transcript
indistinguishable from all session transcripts with verifiers
that honestly follow the protocol and choose the challenge at random (not as a hash).

Goldreich, O., Micali, S., Wigderson, A.
Proofs that yield nothing but their validity or all languages in {NP} have zero-knowledge proof systems
J. ACM 38(1) (1991) 691--729

Bellare, M., Goldreich, O.
On Defining Proofs of Knowledge

It may be reasonable to also mention DAA, Idemix, U-Prove
that treat user attributes just like private keys.

Regards,
Vadym

> ...
> Filename:	 draft-hao-schnorr
> Revision:	 00
> Title:		 Schnorr Signature: Non-interactive Zero Knowledge Proof for Discrete Logarithm
> Creation date:	 2013-05-21
> Group:		 Individual Submission
> Number of pages: 11
> URL:             http://www.ietf.org/internet-drafts/draft-hao-schnorr-00.txt
> Status:          http://datatracker.ietf.org/doc/draft-hao-schnorr
> Htmlized:        http://tools.ietf.org/html/draft-hao-schnorr-00
> 
> Abstract:
>    This document describes the Schnorr signature, a non-interactive
>    variant of the three-pass Schnorr identification scheme.  The Schnorr
>    signature allows one to prove the knowledge of a discrete logarithm
>    without leaking its value.  It can serve as a useful building block
>    for many cryptographic protocols to ensure the participants follow
>    the protocol specification honestly.
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg