Peggy

Parameters known by Peggy:

Computes the generator \( g \):

Computes the public key \( h \):

Computes the value \( a \):

Receives the challenge \( e \):

Computes the response \( z \):

Step y/x

Before Peggy can start Schnorr's sigma protocol, she needs two prime numbers, \( p \) and \( q \):

  • \( p \)
  • \( q \)

Use the Left and Right arrow keys to navigate between steps.

Peggy receives the two prime numbers \( p \) and \( q \), as well as the generator \( g_{1} \) of the group \( \mathbb{Z}_{p} \). She uses these to compute another generator \( g \) of order \( q \) from the group \( \mathbb{Z}_{p}^{*} \).

She then sends the prime number \( p \) and the generator \( g \) to Victor.

Peggy wants to convince Victor that she is truly Peggy, meaning she knows the value of the secret key \( w \) corresponding to the public key \( h \).

She chooses \( w \), computes \( h \), and sends \( h \) to Victor.

Peggy chooses a random integer \( r \), computes the value \( a \), and sends \( a \) to Victor.

Victor randomly chooses a challenge \( e \) and sends it to Peggy.

In response to the challenge, Peggy computes the value \( z \) and sends it to Victor.

Victor verifies the received response \( z \) from Peggy by checking that the two values are equal. Only if this is the case is Victor convinced of Peggy's identity—that is, he knows she possesses the secret key \( w \) corresponding to the public key \( h \).

Victor

Parameters known by Victor:

Receives the public values.

Receives the public key \( h \).

Receives the value \( a \).

Chooses a random challenge \( e \):

Receives the response \( z \).

Verifies Peggy's identity: