# Implementation and Security Test of Zero-Knowledge Protocols on SSI Blockchain
## 6 Security Tests and Evaluation
### Brute-Force Attack Analysis  
The application's brute-force attack functionality intends to emulate the scenario where a cybercriminal tries to impersonate a user without knowing their private information; that is, it is authenticated against the Verifier without knowing the private key. To perform this, it bases its calculations and the information sent to the Verifier on an assumption of what challenge the Verifier will send. For each of the protocols, the probability that the imposter succeeds in guessing the Verifier's challenge is:  
Feige-Fiat-Shamir: 1 in \(2^{kt}\), where \(k\) is the length of the key and \(t\) is the number of protocol rounds;  
Guillou-Quisquater: 1 in \(v^{t}\), where \(v\) is a defined parameter and \(t\) is the number of rounds of the protocol;  
Schnorr: 1 in \(2^{it}\), where \(i\) is a defined parameter and \(t\) is the number of rounds of the protocol. The tests carried out revealed a security factor that had not been considered. During the execution of the Feige-Fiat-Shamir protocol with parameters \(p=5\), \(q=3\), \(t=3\), \(k=3\), the brute-force attack succeeded in an average of less than 10 attempts. Increasing the values to \(p=17\), \(q=31\) increased the mean number of trials to 230; and for \(p=173\), \(q=233\), the mean was 633. As explained in Section 2.2.1, the security of the FFS protocol resides in the value of the variables \(k\) and \(t\), the key length and number of protocol iterations, respectively; however, these tests showed that the choice of prime numbers is also relevant. One of the main bases to guarantee the security of computational cryptography is the choice of \"large\" prime numbers, i.e., with enough bits to make the calculations computationally expensive. In this case, the choice turns out to be just as relevant, since the choice of a small \(p\), \(q\) increases the probability that the hypothetical attacker will be able to authenticate himself without even correctly guessing the verifier's challenge. Figure 6 shows an example of a trial where a FakeProver successfully verified their identity using the FFS protocol. The general parameters values were \(p=17,q=31,t=3,k=3\). The public key used was \(v=[38\;256\;9]\). The impostor guessed the Verifier's challenge in the second and third rounds, but not so in the first one. The challenge vector was \(b=[0\;0\;1]\). The FakeProver's guess was \(b_{fake}=[0\;1\;1]\). Using the other values received, \(x=93,y=310\), the Verifier's calculations are valid both for the true vector \(b\) and the guessed \(b_{fake}\):  
\[x=y^{2}*\prod_{1}^{3}v_{i}^{bi}\;mod\;527=310^{2}*9\;mod\;527=186*9\;mod\;527=93\]  
\[x^{\prime}=y^{2}*\prod_{1}^{3}v_{i}^{b_{fake}i}\;mod\;527=310^{2}*256*9\;mod\;5 27=186*256*9\;mod\;527=93\]  
As \(x=x^{\prime}\), the impostor's authentication succeeds. Another instance where the FakeProver's probability of succeeding increases is that where the private key has a repeated element. If the private key was \(v=[315\;497\;497]\) and the Verifier's challenge was \(b=[0\;0\;1]\), the FakeProver would pass the test without any trouble with the vector \(b_{fake}=[0\;1\;0]\). Finally, one last successful deception detected in the tests is that of the public key containing a one. Let the parameters be \(p=5,q=3\), the private key \(s=[11\;4\;14]\) has a matching public key equal to \(v=[1\;1\;1]\), since \(11^{2}\;mod\;15=4^{2}\;mod\;15=14^{2}\;mod\;15=1\), \(s_{i}^{-2}=1\forall i\). This fact invalidates the purpose of the challenge vector b because the equality \(x=x^{\prime}\) will hold regardless of the value of \(y\) chosen by the FakeProver. In the case of the Guillou-Quisquater protocol, something similar happens. For values \(n=65\;(p=5,q=13)\) and \(t=3\), the FakeVerifier is capable of authentication without guessing the challenge \(e\). Figure 7 shows an example where the public key is \(s=16\) and \(v=47\). Figure 6: FakeProver test—FFS. In the first two rounds, the Verifier sends challenges \(e=2\). The FakeProver's prediction is \(e_{fake}=20\).