The Fiat-Shamir heuristic may be applied to transform a Sigma-Protocol on R(x,w) into a ZKPoK.

Let's call the prover's first message a and the verifier challenge e.

It is said that given a secure hash function H, one could have e = H(x,a) for Random-Oracle security.

But what happens if only a is hashed? What known attacks are made possible, or how is a proof of security made impossible?

  • $\begingroup$ I think the question you're asking was studied in this paper $\endgroup$ – Geoffroy Couteau Oct 26 '17 at 17:00
  • $\begingroup$ Thanks, it seems so. I'll read it and make an answer from it. $\endgroup$ – Arya Pourtabatabaie Oct 29 '17 at 18:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.