1
$\begingroup$

Trying to study ZKPs, I have seen that proofs qualify players (a part from -of course- simulator and extractor): so honest prover, honest verifier.

Is it needed because usually examples deal with interactive schemas which require players to act in specific ways (so it's not needed when Fiat-Shamir heuristic is used on sigma-protocols to get non-interactive flavours)? Or are there more technical, subtle reasons?

Thanks!

$\endgroup$
1
  • $\begingroup$ a self-follow-up regarding role of Fiat-Shamir heuristic in bypassing the honest verifier requirement. Reading first comment and Matthew Green reply here it seems a possible way paid by ROM introduction $\endgroup$
    – baro77
    Commented Mar 20, 2021 at 11:32

1 Answer 1

1
$\begingroup$

In the example you mentioned, you must have an honest verifier, because a dishonest verifier would be able to extract the witness (see).

It is important to remark that there are transformations from honest to dishonest protocols, therefore studying honest protocols makes sense in practice. You may find this useful.

$\endgroup$
1
  • $\begingroup$ Thanks! I think I got the point: if simulator requires an honest verifier (like Schnorr), if the verifier isn't honest we miss the ZK proof. However I find one of first examples in the provided link not completely satisfying: I mean, I can take any ZK proof and add an initial round as suggested, but it seems an artificial and not general way to construct a schema extracting witness starting form an HVZKP: it seems to me that the dishonest acting should be enough, without requiring a modified proof (if initial round is necessary doesn't it mean the original ZKP was dishonesty-resistant?) $\endgroup$
    – baro77
    Commented Mar 20, 2021 at 11:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.