implementing-zero-knowledge-proof-for-authentication

Implement the Schnorr protocol: register a public key y = g^x mod p, send commitment t = g^r mod p, answer the verifier's challenge c with s = r + c*x mod q, and verify g^s == t * y^c mod p. Use a CSPRNG for r and never reuse it.

The Schnorr protocol is an interactive zero-knowledge proof where a prover demonstrates knowledge of a discrete logarithm x without revealing it. It uses a three-move commit-challenge-response exchange based on the hardness of the discrete logarithm problem.

Fiat-Shamir replaces the verifier's random challenge with a hash of the full transcript, c = H(g, y, t, msg), producing a non-interactive proof verifiable offline. The hash must be collision-resistant and include the public key and commitment to prevent forgery.

Reusing the commitment randomness r across two challenges leaks the secret via x = (s1 - s2)/(c1 - c2). Generate r from a cryptographically secure random number generator for every proof and confirm two runs produce different t values.

Not by itself; a captured transcript can be replayed unless the proof binds to a fresh server-supplied nonce or message. Include a unique challenge per session and reject duplicate transcripts to resist replay.

ZKP authentication alone does not provide forward secrecy and must be combined with TLS for transport protection. It also requires careful group parameter selection, including safe primes and prime-order subgroups, to avoid small-subgroup attacks.