I am just reading the DAA paper (http://eprint.iacr.org/2004/205.pdf, Appendix A). A party $\mathcal{I}$ generates two group elements $g' \in \mathrm{QR}_n$ and $h = g'^r \bmod n$ with $r \in_R \left| \mathrm{QR}_n \right|$. Now $\mathcal{I}$ wants to prove in zero-knowledge that $h$ has been created correctly, i.e. that $h \in \langle g' \rangle$.
In the paper the authors use binary challenges with a non-interactive proof of knowledge. I don't get why? This is quite inefficient so I guess that there is a reason for this. Why not just proving $h = g^r \bmod n$ where $r$ is the secret and using one "big" challenge instead of using only 0/1 as the challenge and repeat the protocol?
edited
I have made some further research. Can someone please tell me, if I am right or wrong. The prover P wants to prove to a verifier V that h = g'^r, i.e. $ZKP\ [(r): g'^r]$. $g', h \in G$. The protocol is something like
P V
--------------------------------------------------
y = g'^k mod n y
---------------> choose challenge c
c
<---------------
s = k + c*r mod |G|
s
---------------> check if g^s mod n = y*h^c mod n
To prove the zero-knowledge property, we have to define a simulator S which communicates with V (instead of P). If it is an honest verifier ZKP, we can define S as $S(y, c, s) = (\frac{g'^s}{h^c}, c, s)$ with $s \in_R \{0, \dots, |G|-1\}$, right? There are no differences between real transcripts (between P and V) and faked transcripts (between V and S) => so the protocol is zero-knowledge, correct??
Now, we have an dishonest verifier, which doesn't choose the challenge randomly. To solve this problem, we use a non-interactive proof, where the challenge is created by a random oracle (for practical use we use "a hash function H"). Instead of transferring $y$ to V (and getting a challenge back) the prover sets $c = H(y)$. We can take the same simulator as in the "interactive-case", or???
What I still don't get is why the authors in the paper separate the 160-bit Hash into 160 pieces and take each bit as the challenge? Is the reason for this that maybe the prover chooses the base $g'$? In other papers they say that you can prove $ZKP\ [(w): g'^w]$ "directly" without using binary challenge, but in these cases the base $g'$ is fixed.