CS 161 Computer Security
Fall 2005 Joseph/Tygar/Vazirani/Wagner Notes 18
We will consider the following authentication scheme: the user selects a number N=P·Qproduct of two
large primes, and a number y=x2mod N. The server is given N,yand to login the user must prove that she
knows x:x2=ymod N. Notice the similarity between this and the RSA function — here we are squaring
instead of cubing to implement our hard to invert function. Indeed, it turns out that computing square roots
modulo Nis provably as hard as factoring N(as always, this is proved by a reduction. The reduction shows
that how to use any algorithm for square root extraction as a subroutine to implement a fast algorithm for
factoring).
Before we can state the zero-knowledge protocol and establish its properties, we must state a few facts about
numbers which are perfect squares modulo N. Let us restrict our attention to numbers 0 ≤a≤N−1 which
are relatively prime to N(i.e. gcd(a,N) = 1; note that if the gcd is not 1 then it must be Por Q, so such a’s
are rare and lucky choices that we will not consider). This set of numbers is denoted Z∗
N. For example, for
N=15, we would consider the numbers Z15 ={1,2,4,7,8,11,13,14}. Among these numbers only 1 and 4
are perfect squares. Each has four square roots, {1,4,11,14}and {2,7,8,13}respectively. The square roots
come in pairs, e.g. 13 =−2 mod 15 and 8 =−7 mod 15. In fact, for general N=P·Q, exactly one quarter
of the elements of Z∗
Nare perfect squares and every perfect square amod Nhas four square roots +
−xand
+
−y. Moreover, multiplying a square by a square gives another square, since x2·z2mod N= (xz)2mod N.
The protocol:
The prover knows x:x2=ymod N. She wishes to prove tothe verifier that she knows such a value x.
1. The prover picks a random value rmod Nand computes s=r2mod Nand sends sto the verifier.
2. The verifier randomly selects one of the following two challenges: I) He asks the prover to send him
√smod N. II) He asks the prover to send him √sy mod N.
3. The prover sends either ror rx mod Ndepending upon the challenge.
4. The verifier checks that the received number when squared satisfies the challege.
Let us prove that this protocol provides a zero-knowledge proof of knowledge of a square root of ymod N.
We will show that if the prover does not know a square root of ymod Nthen the honest verifier will catch her
cheating with probability at least 1/2. This will establish that the protocol constitutes a proof of knowledge.
And we will show that the verifier cannot extract any extra information from the prover no matter how he
deviates from protocol. To do so we will show that for every verifier (no matter how dishonest), there is a
simulator that can recreate the verifier’s view (his conversation with the prover) without any knowledge of a
square root of ymod N. This will establish that the protocol is zero-knowledge.
Knowledge extractor:
If the prover wishes not to be caught cheating, she must be able to answer both possible challenges of the
verifier. We will argue that such a prover must know a square root of ymod N. For the purposes of the
proof let us assume that there is a hypothetical knowledge extractor who can travel backward in time, and
after issuing the first challenge and receiving the answer, the knowledge extractor travels back in time and
issues the second challenge. By our assumption the prover can answer both challenges and therefore the
CS 161, Fall 2005, Notes 18 1
