While going through this paper, I came across the idea of Set Membership proofs. The proof allows a prover to prove that a value is contained in some set. The point where I am confused is, all the elements of the set are known to the prover. All three steps of the proof generation can be run by anyone including the prover. Moreover, it seems that the prover can prove the membership of some value he/wants without revealing the value itself. How does the existence of some such value help him further?
The ring signing protocol is given below. The signer/prover S is sending a membership proof to the user U trying to convince him that S is using a public key which belongs to the ring R consisting of public keys of all ring members. Point of confusion is that, the ring R is public and known to both S and U. If all the elements (i.e. the public keys) of the set (i.e. the ring R) are known to both (i.e. S and U), then what is S trying to achieve by the set membership proof?