In a sigma protocol, a well known transformation to a signature is Fiat-Shamir, where message derived randomness is mixed into the randomness of the challenge. A natural example is Schnorr signatures. This is also called a Signature of Knowledge.
Suppose you start with a modern, transparent ZK-SNARK to prove knowledge of R1CS or arithmetic circuit satisfiability (such as ligero/aurora/orion). I am interested whether or not it is possible to perform a similar FS-esque (or the IOP generalisation BCS) approach to construct a signature scheme.
This paper seems to indicate the issue relies on proving simulation extractability (SE) of the scheme, which implies the existential unforgeability of the signature requires. Intuitively, I believe this is related to the malleability of the underlying ZK-SNARK, and due to that fact that IOPs can have much richer structure than a sigma protocol. In their paper they discuss some other schemes that satisfy this property but they rely on trusted setup and/or non post-quantum assumptions.
Does anyone know of any major challenges to proving SE of the current state-of-the-art schemes. It seems like this would lead to good optimizations as the current approaches to zk-SNARK based signatures (such as Picnic and Banquet) use a higher level approach, by using a PRF and proving knowledge of computations on the PRF. If you could do a signature of knowledge, an OWF would suffice.