Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$.
As found in the literature, $P$ can use a $\Sigma$-protocol for the relation $R$, defined as a 3-move protocol that satisfies the following properties:
- Completeness.
- Special soundness.
- Special-honest verifier zero-knowledge.
My question is concerning the definition of the third property, which is the following:
Definition of Special-honest verifier zero-knowledge (as in the literature): There exists a polynomial-time simulator $M$, which on input $x$ and a challenge $e$, outputs an accepting conversation of the form $(a,e,z)$, with the same probability distribution as conversations between the honest $P,V$ on input $x$.
Clearly, the special-honest verifier zero-knowledge has a probabilistic interpretation (as noted in the part ``...with the same probability distribution as...'') and I wonder what the implications are of omitting it.
In other words, what would be wrong or how this could affect the protocol if the special-honest verifier zero-knowledge property was defined as follows instead?
Alternative (and possibly wrong, but I’d like to understand why) definition of Special-honest verifier zero-knowledge: There exists a polynomial-time simulator $M$, which on input $x$ and a challenge $e$, outputs an accepting conversation of the form $(a,e,z)$.
This other definition doesn't mention probabilities distributions, just the fact that the transcript generated by the simulator should be accepted by the verifier. To me, this implicitly implies that the generated transcript will have to have the same probability distribution as a real transcript (the one obtained from a conversation between a honest prover $P$ and a honest verifier $V$), otherwise the verifier wouldn't be accepting it. Or am I wrong? Do you know of any example in which this is not the case, i.e. the transcript generated by the simulator is accepted by the verifier but still it doesn't have the same distribution as a real transcript?
Any help or clarification with this will be very much appreciated.