# Schnorr protocol - Proof or argument?

Is Schnorr's protocol for proving knowledge for a discrete logarithm, truly an interactive proof or is it an interactive argument? If we let P to be unbounded, after she generates the commitment $t$ and receives the challenge $c$ she can try all $r$ such that $h^r=t \cdot z^c$(where $h$ is the generator of the cyclic group and $z=h^x$)

In addition, how can we make any security guarantees if the prover is unbounded?

I know how to extract the witness from two transcripts. My intuition as to why this extraction argument is sufficient for proving soundness is something like this(correct me if I am wrong): If the prover can somehow cheat and produce two accepting transcripts, then she can extract $x$. This implies(by taking the contrapositive of that statement) that if she does not know $x$, then she cannot produce a transcript. Therefore, the protocol is sound.

However, in some sense we had to ignore the infinite computational power P has, while proving that statement. If she has infinite computational power, then she will always know the discrete log(because she can compute it). I guess my question is what is the purpose then for not bounding P?

• Trying all $r$ is not the only way to use computing power. Having some $t z^c$, Prover could solve for discrete logarithm $r$. Or she could solve for $x$ from $z$ before the protocol. So how would you follow argument definition? Mar 10 '18 at 19:35

Schnorr's protocol is an interactive proof of knowledge. The 'attack' that you provide does not contradict this: if the powerful prover that you describes can indeed try all $r$ such that $h^r = t\cdot z^c$, then she can as well try all $x$ and check for $z=h^x$. Put otherwise, this prover does indeed know the discrete logarithm of $z$: in fact, any 'unbounded' prover knows the discrete log of $z$.
EDIT: to answer your follow up question, yes, you got the intuition right: if the prover can produce two accepting transcripts, she must know $x$, as $x$ can be extracted from these transcripts. Your issue seems to be that a computationally unbounded prover can always compute $x$, hence he always 'knows' $x$ - so, how is that interesting to consider also unbounded provers in the security analysis?