Fiat–Shamir: why do r and s have to be smaller than n? I have a question regarding the Fiat–Shamir identification protocol. In this source (pdf) for example it says on pages 9 and 10 that the random commitment $r$ and the private key $s$ have to be smaller than $n$ (the RSA-like Modulus). I am wondering why this has to be.

The verification works even if $r$ and $s$ are greater than $n$. Also, if $r$ is smaller than $n$, an observer could calculate $r$, using the equation $y=r*s^e$ mod $n$. If $e=0$, this is equal to $y=r$ mod $n$, and since $r&lt;n$, this is the same as $y=r$, so if somebody gets to know $y$, he would also know $r$. I thought that somebody was not supposed to be able to get information out of the knowledge of $y$ or $x$.

Is there something I am getting wrong here?
Because we are working modulo $n$.  There's not much more to say.  There's no reason why any honest user would ever want to use a larger value.  You might want to review modular arithmetic and its use in cryptography.