An Extremely Small and Efficient Identification Scheme

We present a new identification scheme which is based on Legendre symbols modulo a certain hidden prime and which is naturally suited for low power, low memory applications. 1 Overview One of the most desirable cryptographic functions is a secure, small, zero-knowledge public-key identification scheme. The applications are many and obvious – even the single application of credit/smartcard security is enough to stimulate research. In this paper, we present a scheme that requires extremely little computing power to perform a verification and to which we refer as FLIP (Fast Legendre Identification Protocol). Our scheme is unbalanced by design: the party proving his/her identity needs almost no computing power, while the party to whom the identity is being proved needs only a very small amount. Our scheme is based on the assumption that integer factorization is a “hard problem.” In fact, we believe that the only feasible attack on our scheme is via the factorization of a certain modulusM , hence the scheme is secure provided that M is reasonably large. In contrast to (say) RSA based signatures, our scheme offers the advantage that time consuming computation modulo M is required only for the verifier (it is not unreasonable to assume the verifier to be more powerful than the prover). This lends itself well to the credit/smartcard & bank paradigm. We have conducted some preliminary tests using the interpreted number theory system PARI-GP. We find that FLIP (at high security) performs an identification as fast or faster than any other identification scheme of which we are aware, although key creation in FLIP is slower than in some other schemes, see [8]. We remark that although our scheme uses constructions similar to the Feige–Fiat–Shamir scheme, see [10], both schemes seem to be independent and rely on the hardness of different number theoretic problems (although the assumption of the hardness of integer factorization is common to both of them). 2 FLIP Description Our construction is based on properties of the Legendre and Jacobi symbols. We recall that given a prime p the Legendre symbol of a with gcd(a, p) = 1 is defined as