Quoting the handbook of applied cryptography, chapter 10.3.3 (i):
Identification based on PK decryption and witness. Consider the following protocol:
- $A \leftarrow B: h(r), B, P_A(r,B)$
- $A \rightarrow B: r$
(Before “2.”, $A$ verifies that $r' = r$ and $B' = B$)
My questions are:
Why is $B$ needed in the encrypted part and in the plan part? I understand that $h(r)$ is sent as a witness to prevent $A$ from becoming a decryption oracle to $B$. But why is the public key sent? What purpose the verification $B = B'$ serve?
If $B$ has to be sent, could $h(B)$ be sent instead in the encrypted portion (or in both)?