According to Wiki there is a possibility of non-interactive Zero-Knowledge Proof of discrete logarithm if challenge $c$ is computed via a hash function. But what is the purpose of $c$? Why can not I always set $c=1$? Does it make the system vulnerable?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
Does it make the system vulnerable?
Yes; if the prover knew apriori what value of $c$ that will be used, the prover could easily issue a proof (even if she didn't know the discrete log).
To prove knowledge of the discrete log of $y$ to the base $g$, the prover transmits the values $r$ and $t$, and the validator checks whether $t \equiv g^r y^c$; if the prover selected an arbitrary $r$ and computed $t = g^r y^c$, and transmitted those values, this check would validate.
In the real noninteractive protocol, this doesn't work because $c$ is a complex function of (among other things) $t$, and hence she cannot arbitrarily select $t$ without affecting the value $c$.
