# Weak Challenge Generation - Fiat-Shamir Heuristic

The Fiat-Shamir heuristic may be applied to transform a Sigma-Protocol on R(x,w) into a ZKPoK.

Let's call the prover's first message a and the verifier challenge e.

It is said that given a secure hash function H, one could have e = H(x,a) for Random-Oracle security.

But what happens if only a is hashed? What known attacks are made possible, or how is a proof of security made impossible?

• I think the question you're asking was studied in this paper – Geoffroy Couteau Oct 26 '17 at 17:00
• Thanks, it seems so. I'll read it and make an answer from it. – Arya Pourtabatabaie Oct 29 '17 at 18:19