In cryptography, the Feige–Fiat–Shamir identification scheme is a type of parallel zero-knowledge proof developed by Uriel Feige, Amos Fiat, and Adi Shamir in 1988. Like all zero-knowledge proofs, it allows one party, the Prover, to prove to another party, the Verifier, that they possess secret information without revealing to Verifier what that secret information is. The Feige–Fiat–Shamir identification scheme, however, uses modular arithmetic and a parallel verification process that limits the number of communications between Prover and Verifier.
Setup.
Following a common convention, call the prover Peggy and the verifier Victor.
Choose two large prime integers "p" and "q" and compute the product "n = pq". Create secret numbers formula_1 coprime to "n". Compute formula_2. Peggy and Victor both receive formula_3 while formula_4 and formula_5 are kept secret. Peggy is then sent the numbers formula_6. These are her secret login numbers. Victor is sent the numbers formula_7 by Peggy when she wishes to identify herself to Victor. Victor is unable to recover Peggy's formula_6 numbers from his formula_7 numbers due to the difficulty in determining a modular square root when the modulus' factorization is unknown.
Procedure.
This procedure is repeated with different formula_10 and formula_15 values until Victor is satisfied that Peggy does indeed possess the modular square roots (formula_6) of his formula_7 numbers.
Security.
In the procedure, Peggy does not give any useful information to Victor. She merely proves to Victor that she has the secret numbers without revealing what those numbers are. Anyone who intercepts the communication between each Peggy and Victor would only learn the same information. The eavesdropper would not learn anything useful about Peggy's secret numbers.
Suppose Eve has intercepted Victor's formula_7 numbers but does not know what Peggy's formula_6 numbers are. If Eve wants to try to convince Victor that she is Peggy, she would have to correctly guess what Victor's formula_15 numbers will be. She then picks a random formula_26, calculates formula_27 and sends formula_13 to Victor. When Victor sends formula_15, Eve simply returns her formula_26. Victor is satisfied and concludes that Eve has the secret numbers. However, the probability of Eve correctly guessing what Victor's formula_15 will be is 1 in formula_32. By repeating the procedure formula_33 times, the probability drops to 1 in formula_34 . For formula_35 and formula_36 the probability of successfully posing as Peggy is less than 1 in 1 million.