密码算法与协议4_密钥的认证协议.ppt

* * Analysis to Schnorr’s Scheme (cont.) The point is that the prover cannot prepare for answering both cases c = 0 and c = 1, without knowing the private key x. This follows from the following observation. Suppose that after committing to value a, a prover is able to answer both c = 0 and c = 1 correctly. This means that the prover is able to produce two responses r0 and r1, which are correct for challenges c = 0 and c = 1, respectively. This implies that the values a, r0 and r1 satisfy gr0 = a, gr1 = ah, which in turn implies that h = gr1-r0 . However, this means that the prover act