I've been trying for a while to understand why this paper is correct: ftp://ftp.inf.ethz.ch/pub/crypto/publications/Fischl05b.pdf.
The idea is a NIZK-POK where you require the hash of the commit-challenge-response to be small. This is supposed to force the prover to make multiple hash queries for each commit, which consequently enables an extractor to extract the witness without having to rewind. But what I can't figure out - is why not just try multiple witnesses/commits , rather than multiple challenges for a given commit?