Past exam of the mathematics course of the University of Cambridge 2019 ii Paper 4 3G b Solution Created 2026-09-24 Updated 2026-10-03
No. The procedure exposes a square-root oracle for the Rabin cryptosystem. The verifier chooses , sends , and receives another square root . Ifthen the factorization from distinct square roots modulo a semiprime givesFor a product of two odd primes, a square normally has four roots, and a returned root lies outside the pair with probability about . Repeating chosen-square challenges therefore factors with overwhelming probability. The attacker can then compute square roots and impersonate Alice. This is the chosen-square attack on Rabin authentication, so the proposed protocol is insecure.