At EUROCRYPT'88, we introduced an interactive zero-howledge protocol (G~O U and Quisquater [13]) fitted to the authentication of tamper-resistant devices (e.g. smart c a d s , Guillou and Ugon [14]). Each security device stores its secret authentication number, an RSA-like signature computed by an authority from the device identity. Any transaction between a tamperresistant security device and a verifier is limited to a unique interaction: the device sends its identity and a random test number; then the verifier teUs a random large question; and finally the device answers by a witness number. The transaction is successful when the test number is reconstructed from the witness number, the question and the identity according to numbers published by the authority and rules of redundancy possibly standardized. This protocol allows a cooperation between users in such a way that a group of cooperative users looks like a new entity, having a shadowed identity the product of the individual shadowed identities, while each member reveals nothing about its secret. In another scenario, the secret is partitioned between distinkt devices sharing the same identity. A group of cooperative users looks like a unique user having a larger public exponent which is the greater common multiple of each individual exponent. In this paper, additional features are introduced in order to provide: firstly, a mutual interactive authentication of both communicating entities and previously exchanged messages, and, secondly, a digital signature of messages, with a non-interactive zero-knowledge protocol. The problem of multiple signature is solved here in a very smart way due to the possibilities of cooperation between users. The only secret key is the factors of the composite number chosen by the authority delivering one authentication number to each smart card. This key is not known by the user. At the user level, such a scheme may be considered as a keyless identity-based integrity scheme. This integrity has a new and important property: it cannot be misused, i.e. derived into a confidentiality scheme.

Zero-knowledge interactive proofs are very promising for the problems related to the verification of identity. After their (mainly theoretical) introduction by S. Goldwasser, S. Micali and C. Rackoff (1985), A. Fiat and A. Shamir (1986) proposed a first practical solution: the scheme of Fiat-Shamir is a trade-off between the number of authentication numbers stored in each security microprocessor and the number of witness numbers to be checked at each verification. This paper proposes a new scheme which requires the storage of only one authentication number in each security microprocessor and the check of only one witness number. The needed computations are only 2 or 3 more than for the scheme of Fiat-Shamir.

Soazig in collaboration with Tom BERSON'") for the English version 0 Know, oh my children, that very long ago, in the Eastern city of Baghdad, there lived an old man named Ali Baba. Every day Ali Baba would go to the bazaar to buy or sell things. This is a story which is partly about Ali Baba, and partly also about a cave, a strange cave whose secret and wonder exist to this day. But I get ahead of myself. .. One day in the Baghdad bazaar a thief grabbed a purse from Ali Baba who right away started to run after him. The thief fled into a cave whose entryway forked into two dark winding passages: one to the left and the other to the right (The Entry of the Cave). \ Ali Baba did not see which passage the thief r into. Ali Baba had to choose which way to go, and he decided to go to the left. The left-hand passage ended in a dead end. Ali Baba searched all the way from the fork to the dead end, but he did not find the thief. Ali Baba said to himself that

Precautions taken against various potential attacks in IS0 / IEC DIS .9796 ({Digital signature scheme giving message recovery" Louis Claude GUILLOU l Jean-Jacques QUISQUATER * with the help of all the experts of ISO/IEC JTCl/SC27/WG20.2 and more specifically Mike WALKER 3 Peter LANDROCK 4 Caroline SHAER 5 ABSTRACT This paper describes a digital signature scheme giving message recovery>> in order to submit it to the public scrutiny of IACR (the International Association for Cryptologic Research). This scheme is currently prepared by Subcommittee SC27, Security Techniques, inside Joint Technical Committee JTCl, Information Technology, established by both IS0 (the International Organization for Standardization) and IEC (the International Electrotechnical Commission). The digital signature scheme specified in DIS 9796 does not involve any hash-function. It allows a minimum resource requirement for verification. And it avoids various attacks against the generic algorithms in use. Definition : An operation (addition, multiplication, power.. .) modulo n is matural>> when, being less than the modulus, the result does not involve the modulo reduction.

No abstract