Is this DH variant a workable zero knowledge proof?

Question

I encountered the use the following protocol as a zero-knowledge proof (argument?) of knowledge of x given y=g^x for a typical DL group:

1. Verifier chooses c and sends g^c
2. Prover responds with g^(cx)

It is simpler and more efficient than Schnorr. Intuitively it seems satisfactory. It is zero-knowledge (can be simulated) and I cannot come up with a strategy for responding without knowing either x or c in advance.

That said, I cannot write an extractor for it (and if one did exist, it seems it would break DH key exchange). So it is not provably sound but let's pretend this fact isn't enough to scare me away. I am wondering if anyone can shed more light on why it might be problematic to do this in practice.

Answer 1

why it might be problematic to do this in practice.

One issue with it is that it potentially allows the attacker an Oracle to the cDH problem.

For example, suppose the Prover uses his $g^x$ value as his key share with a DH key exchange with Alice, who sends $g^a$, and both sides arrive at the $g^{ax}$ secret value.

Then, what your protocol would allow an evil Verifier to do is ask the Prover to prove that he knows $x$, and submits $g^a$ (or a blinded version) as his challenge; the Prover sends back $(g^a)^x$, and that gives away the secret value.