I think the question was asked somewhere else but not answered very precisely.
Quoting from the "Handbook of applied cryptography":
Identification based on PK decryption and witness. Consider the following protocol:
$A \leftarrow B:h(r),B,P_A(r,B) \quad (1)$
$A \rightarrow B:r \quad \quad \quad \quad \quad \quad (2)$
$B$ chooses a random $r$, computes the witness $x=h(r)$
$P_A$ denotes the public-key encryption (e.g., RSA) algorithm of $A$
The use of the witness $x = h(r)$ precludes chosen-text attacks.
Can anyone explain to me why this precludes chosen ciphertext attacks? If $h(x)$ is a simple hash, everyone can produce a different message, encrypt it with the public key, create the hash and send it to B. Of course B will response with a correct decryption so it can be used as decryption oracle.
I don't understand why $h(r)=x$ provides any additional value.