On the (In)security of the Fiat-Shamir paradigm

By Shafi Goldwasser, Yael Tauman Kalai. 44th Annual IEEE Symposium on Foundations of Computer Science, 2003. Proceedings., 2003

381 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems

View Paper: https://www.semanticscholar.org/paper/4702ad4a1cecb7a96a03944814ec586c3c2b7293

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

Citations in the corpus

Simulation-Sound NIZK Proofs for a Practical Language and Constant Size Group Signatures (2006, background): “It is well known that using the random oracle model sometimes results in insecure real life protocols [18,19,34,27,4].”
Signature Schemes and Anonymous Credentials from Bilinear Maps (2004, background): “However, ideal random functions cannot be implemented in the plain model [13, 25], and therefore in the plain model, these signature schemes are not provably secure.”
Delegating computation: interactive proofs for muggles (2008, background): “See the full version for details and theorem statements.”
Interactive Oracle Proofs (2016, background): “While this intuition fails in the general case [CGH04, BBP04, GK03, BDG + 13], the random oracle model is nonetheless a useful testbed for cryptographic primitives.”
Anonymous credentials light (2013, methodology): “Note that, it has also been shown that the digital signatures produced by the Fiat-Shamir heuristic are not secure in the standard model [25].”
An Uninstantiable Random-Oracle-Model Scheme for a Hybrid-Encryption Problem (2004, methodology): “) The same is true of the scheme of [17].”
Extending Oblivious Transfers Efficiently (2003, background): “Further research along these lines appears in [31,21,2].”
Foundations of Group Signatures: The Case of Dynamic Groups (2005, background): “Note that it may be impossible to “implement” the random oracle of the Fiat-Shamir transform with a “real” function in a way that results in a secure real-world scheme (Goldwasser and Tauman [22]).”
Sub-linear Zero-Knowledge Argument for Correctness of a Shuffle (2008, methodology): “While the Fiat-Shamir heuristic is not sound in general [19], it is still commonly believed to be a safe practice when applied to “natural” protocols.”
Merkle-Damgård Revisited: How to Construct a Hash Function (2005, background): “In fact, many recent “separation” results [12, 27, 20, 2, 13, 16] illustrated various cryptographic systems secure in the random oracle model but completely insecure for any concrete instantiation of the random oracle (even by a family of hash functions).”
Short Pairing-Based Non-interactive Zero-Knowledge Arguments (2010, background): “Particularly relevant here is Goldwasser and Kalai’s [23] demonstration of a signature scheme built from a public-coin identification scheme that is secure in the random oracle model but insecure in real life.”