An Identification Scheme Based on KEA1 Assumption

There are three well-known identification schemes: Fiat-Shamir, GQ and Schnorr identification schemes. All of them are proven secure against passive or active attacks under number theoretic assumptions. However, the efficiencies of reductions in those proofs are not tight, since they need “rewinding.” We show an identification scheme IDKEA1. Although it needs four exchanges of messages and slightly more exponentiations, IDKEA1 is proved to be secure under KEA1 assumption with tight reduction to DLA. The idea underlying IDKEA1 is to use extractable commitment for prover’s commitment. In the proof of security, the simulator can open the commitment in two different ways: one by the non-black-box extractor of KEA1 assumption and the another through the simulated transcript. So, we don’t need to rewind and can prove the security without the loss of efficiency of the reduction.