In the classic description of Zero Knowledge Proof of Knowledge, Victor must wait outside the entrance to the cave while Peggy goes to the fork and choose a side. It's only once Peggy has entered a tunnel and is out of view that Victor comes at the fork and shout the side he wants her to come out from.
I am wondering why this setup is necessary for the proof to really be Zero Knowledge.
Let's try a much simpler experiment. Victor and Peggy walk together down the primary tunnel until the fork. Peggy goes alone in one side and come out the other. Victor did not hear the secret to open the door, but he is now convinced that she knows it. Peggy presented a proof of her knowledge without Victor learning anything apart the fact that Peggy has this knowledge.
Why is this simple setup not enough to model ZKPK?
Here are some hypotheses that I'm working with:
The analogy is crafted this way to model the fact that the attacker would always have a probability of $p=0.5$ to guess the correct answer during the interactive proof. If Victor sees Mallory enter the tunnel and not come out the other side he will instantly know that Mallory does not know the secret. To model a setup closer to reality, the indirection is added so that Mallory can fake knowledge half the time.
The analogy is crafted this way to make a point that Victor does not know some part of the mechanism. In our case, the door in fact only opens in one way, and once Peggy is at the door, she only uses her knowledge half the time. Maybe this is to model a mathematical aspect of the proof. I am dissing this one out but I've seen mentioned.
Victor must not be able to convince anyone else that Peggy has the knowledge she claims. This is often presented with the extra story where Victor taped the whole thing while still not being able to convince a third party because he could have conspired with Peggy and staged the experiment.
I feel this third point is the crucial part.
However, it departs from the usual description of simply proving you know something without revealing it.
- Hey, I'm Peggy and I can prove to you that I know a secret without telling it to you!
- Oh, and by the way, in addition to not knowing the secret you won't be able to even tell anyone else the simple fact that I know the secret, booya.
Is the concealment of this meta information about the relationship between Peggy and the secret what really makes it Zero Knowledge?
Are there practical consequences of having a scheme that discloses it? (If the proof is interactive Victor wouldn't be able to impersonate Peggy anyway, right?).
To make the point more practical and concrete, let's consider the following simple protocols:
Victor sends a plaintext to Peggy and ask her to send it back signed with her secret key. He verifies the result with Peggy's public key. Proof that Peggy has the private key.
Victor encrypts a piece of data with Peggy's public key and asks Peggy to send back the hash of the data. If the hash match, he has a proof that Peggy knows the private key.
Why are these Protocols not Zero Knowledge proof of knowledge? (or are they?)