Solution

ID: past-exam-of-the-mathematics-course-of-the-university-of-cambridge/2019/ii/paper-4/3g/b/solution

No. The procedure exposes a square-root oracle for the Rabin cryptosystem. The verifier chooses , sends , and receives another square root . If
then the factorization from distinct square roots modulo a semiprime gives
For a product of two odd primes, a square normally has four roots, and a returned root lies outside the pair with probability about . Repeating chosen-square challenges therefore factors with overwhelming probability. The attacker can then compute square roots and impersonate Alice. This is the chosen-square attack on Rabin authentication, so the proposed protocol is insecure.

New to topics? Read the docs here!