💻 computer science

A Lightweight QR-assisted Zero-knowledge Identification Protocol For Secure Authentication

This paper proposes a lightweight, QR code-assisted Zero-Knowledge authentication protocol based on the Schnorr scheme that secures mobile and low-resource systems against replay attacks while maintaining millisecond-level performance and a compact 0.5 KB proof size.

Original authors: Hüseyin Bodur

Published 2026-05-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Hüseyin Bodur

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to prove to a security guard that you know a secret password, but you don't want to actually say the password out loud. If you just whisper it, anyone nearby could hear it and steal it. If you write it on a piece of paper, someone could photocopy it and use it later.

This paper proposes a clever solution to that problem using a mix of math magic, QR codes, and a time limit. Here is how it works, broken down into simple concepts:

1. The Core Idea: The "Magic Trick" (Zero-Knowledge Proof)

Think of the Zero-Knowledge Proof as a magic trick where you prove you have the secret without ever showing the secret itself.

The Old Way: You hand the guard your key. If they lose it, anyone can use it.
The New Way: You stand behind a curtain. The guard asks you to perform a specific math puzzle that only someone with the key could solve. You solve it instantly. The guard sees the solution, knows you have the key, but never sees the key itself.

2. The Secret Sauce: Schnorr Protocol

The paper uses a specific mathematical method called the Schnorr Protocol.

Analogy: Imagine a locked box (the public key) that everyone can see. Inside the box is a secret number (your private key) that only you know.
The system asks you to mix your secret number with a random number you generate on the spot. You send the result back.
The guard can check your math using the locked box. If the math works out perfectly, they know you must have the secret number. If you were guessing, the math would fail.

3. The Delivery Method: The QR Code

Instead of typing this math puzzle into a computer or connecting via Wi-Fi, the paper suggests putting the answer into a QR Code (that square barcode you scan with your phone).

How it works: Your phone generates the "proof" (the math answer), turns it into a QR code, and you show it to a camera.
Why it's good: It's like handing over a sealed envelope. The camera reads the envelope, checks the math inside, and decides if you are who you say you are. It doesn't need a complex internet connection to work.

4. The Safety Net: Stopping "Copycats" (Replay Attacks)

Here is the biggest problem with QR codes: They are easy to copy. If I take a photo of your QR code, I could scan it later and pretend to be you. This is called a "Replay Attack."

The paper solves this with two safety mechanisms:

The Timestamp (The Expiration Date): Every QR code has a "time stamp" written inside it, like "Valid only for 5 seconds." If the guard scans a code that was made 10 minutes ago, they reject it immediately. It's like a ticket that expires the moment the movie starts.
The Nonce (The One-Time Ticket): Every time you scan, the system generates a unique, random number called a "nonce." Even if you try to scan the exact same QR code twice, the system treats it as a different event. If the numbers don't match the current moment, the code is useless.

5. How Fast is it? (Performance)

The researchers tested this on a computer to see how long it takes.

Speed: It is incredibly fast. Generating the proof takes about 0.00015 seconds (faster than a blink). Checking the proof takes about 0.0005 seconds.
Size: The "proof" is very small, about 0.5 KB. This is tiny enough to fit easily into a standard QR code without making it too complex to scan.

Summary

This paper presents a system where you can prove your identity using a QR code without ever revealing your secret password. It uses advanced math (Schnorr) to do the heavy lifting, and it uses time limits and random numbers to stop bad guys from copying your code and using it later.

The authors claim this is perfect for mobile phones and low-power devices (like simple door locks or event check-ins) because it is fast, small, and doesn't need a powerful computer to work. They tested it in a simulation and found it works exactly as they hoped.

Technical Summary: A Lightweight QR-Assisted Zero-Knowledge Identification Protocol for Secure Authentication

Problem Statement
Secure authentication in mobile, distributed, and resource-constrained environments faces significant challenges. Traditional methods, such as password-based systems and certificate infrastructures, often rely on third parties and introduce risks like identity theft, data leakage, and replay attacks. While Zero-Knowledge Proof (ZKP) protocols, particularly those based on the Schnorr identification scheme, offer robust security by allowing a user to prove knowledge of a secret without revealing it, their practical deployment in lightweight mobile environments remains limited. Furthermore, existing QR code-based authentication systems often suffer from vulnerabilities where copied or reused codes can facilitate replay attacks, especially when verification relies heavily on central servers.

Methodology
The study proposes a lightweight, non-interactive authentication protocol that integrates Schnorr-based ZKP with QR code data transmission. The system operates on the computational hardness of the Discrete Logarithm Problem (DLP).

Protocol Design: The protocol utilizes the Fiat-Shamir transformation to convert the interactive Schnorr protocol into a non-interactive one.
- Prover Side: The prover, holding a private key $x$ and a corresponding public key $y = g^x \mod p$ , generates a random value $r$ to compute a commitment $t = g^r \mod p$ . A challenge $c$ is derived deterministically by hashing the commitment, public key, a nonce, and a timestamp ($c = Hash(t || y || nonce || timestamp)$). The response $s$ is calculated as $s = r + cx \mod (p-1)$ . The resulting proof tuple $\pi = (t, s, nonce, timestamp)$ is encoded into a JSON format and embedded within a QR code.
- Verifier Side: The verifier decodes the QR code, validates the timestamp to ensure freshness, recalculates the challenge $c$ , and verifies the equation $g^s = t \cdot y^c \mod p$ .
Security Mechanisms: To counter the inherent risk of replay attacks in visual QR codes, the system incorporates a timestamp and a nonce. The timestamp ensures the proof is only valid within a specific time window ( $\Delta$ ), while the nonce ensures proof diversity for each session.
Transmission Channel: The QR code serves as a one-way, contactless transmission medium. It does not provide cryptographic security itself but preserves the integrity of the proof data, relying on the underlying cryptographic protocol for security.

Key Contributions
The paper identifies three primary contributions:

The design of a lightweight, non-interactive ZKP authentication protocol specifically structured for transmission via QR codes.
The implementation of a timestamp-based verification mechanism to mitigate replay attack risks inherent in static or copyable QR codes.
An evaluation of the proof size's compatibility with standard QR code capacity constraints.

Results
The protocol was evaluated using a Python-based simulation environment with a 256-bit security level.

Performance: Both proof generation and verification times were found to be in the millisecond range. Specifically, generation times ranged from approximately 0.00014 to 0.00018 seconds, while verification times ranged from 0.00030 to 0.00078 seconds. The initial generation run showed slightly higher latency due to parameter initialization, but subsequent runs remained highly efficient.
Data Size: The size of the generated proof data, encoded in JSON, remained constant at approximately 491–495 bytes (roughly 0.5 KB). This size is well within the capacity of standard QR codes, even those of lower versions, facilitating easy transmission.

Significance and Claims
The authors claim that the proposed model offers a viable, secure authentication solution for environments with low computational resources and minimal infrastructure requirements. By combining the security of Schnorr-based ZKPs with the practicality of QR codes, the system enables verification without revealing the secret key while maintaining resilience against replay attacks.

The study positions this approach as particularly suitable for:

IoT gateway systems.
Temporary access control mechanisms.
Mobile authentication applications.

The paper concludes that the model balances strong cryptographic security with low computational overhead, making it appropriate for practical deployment in physical access control and mobile scenarios. The authors note that future work will focus on integrating this model with blockchain-based identity management, conducting scalability analyses, and performing experimental tests on real hardware.