Feige–Fiat–Shamir identification scheme

Procedure

1. Peggy chooses a random integer ${\displaystyle r}$, a random sign ${\displaystyle s\in \{-1,1\}}$ and computes ${\displaystyle s\cdot x\equiv r^2(\mathrm{mod}n)}$. Peggy sends ${\displaystyle x}$ to Victor.
2. Victor chooses numbers ${\displaystyle a_1,\cdots ,a_k}$ where ${\displaystyle a_i}$ equals 0 or 1. Victor sends these numbers to Peggy.
3. Peggy computes ${\displaystyle y\equiv r{s}_1^{a_1}{s}_2^{a_2}\cdots s_k^{a_k}(\mathrm{mod}n)}$. Peggy sends this number to Victor.
4. Victor checks that ${\displaystyle y^2(\mathrm{mod}n)\equiv \pm x{v}_1^{a_1}{v}_2^{a_2}\cdots v_k^{a_k}(\mathrm{mod}n)}$ and that ${\displaystyle x\ne 0.}$

This procedure is repeated with different ${\displaystyle r}$ and ${\displaystyle a_i}$ values until Victor is satisfied that Peggy does indeed possess the modular square roots (${\displaystyle s_i}$) of his ${\displaystyle v_i}$ numbers.

Security

In the procedure, Peggy does not give any useful information to Victor. She merely proves to Victor that she has the secret numbers without revealing what those numbers are.

Suppose Eve has intercepted Victor's ${\displaystyle v_i}$ numbers but does not know what Peggy's ${\displaystyle s_i}$ numbers are. If Eve wants to try to convince Victor that she is Peggy, she would have to correctly guess what Victor's ${\displaystyle a_i}$ numbers will be. She then picks a random ${\displaystyle y}$, calculates ${\displaystyle x\equiv y^2{v}_1^{-a_1}{v}_2^{-a_2}\cdots v_k^{-a_k}(\mathrm{mod}n)}$ and sends ${\displaystyle x}$ to Victor. When Victor sends ${\displaystyle a_i}$, Eve simply returns her ${\displaystyle y}$. Victor is satisfied and concludes that Eve has the secret numbers. However, the probability of Eve correctly guessing what Victor's ${\displaystyle a_i}$ will be is 1 in ${\displaystyle 2^k}$. By repeating the procedure ${\displaystyle t}$ times, the probability drops to 1 in ${\displaystyle 2^{kt}}$ . For ${\displaystyle k=5}$ and ${\displaystyle t=4}$ the probability of successfully posing as Peggy is less than 1 in 1 million.