Proof Okamoto protocol has zero knowledge if we constructing a suitable simulator

I found the following schema of Okamoto:

schema of Okamoto

But I don't really understand —how can I construct such a simulator and create proofs?


1 Answer 1


There is "zero knowledge simulator" and "honest verifier zero knowledge simulator". General idea is reversing the order of variables picked at random or cauluated. Namely, pick the simulated challenge and response first, and calculate the first message $a$. For HVZK, just pick a challenge and a response at random, calculate proper first message using verification equation. For ZK, one should get a challenge by querying the real Verifier. This means running a session with Verifier and sending some random first message. Please note I did omit minor details doable as a homework.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.