From the lecture notes I have learned the following:

  • $P \rightarrow V$: $T=g^t$ ($t$, randomly chosen from $Z_q$)
  • $P \leftarrow V$: $c$ (randomly chosen from $Z_q$)
  • $P \rightarrow V$: $s=xc+t \mod q$
  • $V$ accepts if $g^s=A^cT$, (where $A=g^x$)

Question: Can $P$ instead of sending $g^s$ send directly $A^cT$?

In other words, $P$ has all it need to generate $A^cT$ which is the same as $g^s$. Can someone explain what I am seeing wrong?

  • 2
    $\begingroup$ $P$ sends $s$, not $g^s$. $\endgroup$
    – fkraiem
    Commented Nov 21, 2016 at 9:28

1 Answer 1


Well yes, $P$ can generate $A^cT$ and send it over, but why would it help?

The point of this protocol is that $P$ proofs to $V$ that it knows $x$, without revealing anything about $x$. The way that $P$ does this is that given some randomly chosen $t$ and a challenge $c$, it can compute an $s$ such that $g^s=A^cT$. The fact that $P$ can compute this $s$ proves knowledge of $x$ (note that $s=xc+t$). Anyone that does not know $x$, cannot compute $s$ (assuming some hard problem).

On the other hand, anyone can compute $A^cT$ given $A,c,T$, so this does not prove anything about knowledge of $x$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.