I've been going through G. Maxwell's paper on the Borromean Ring Signature, and I don't fully understand this part on Schnorr Signature. If some could explain it more intuitively thank you.

"Intuitively, this is zero knowledge because if the verifier had slipped the prover pre-knowledge of what $e$ would be, the prover could have produced a legitimate $s$ without knowing $x$ at all. (Specifically, she would choose $s$ randomly and then choose “$kG$” as $sG−exG$.) The transcript of the prover/verifier interactions in this case would be statistically indistinguishable from a transcript in the honest game; thus if the dishonest game revealed nothing about $x$ (and it did not; it did not even use $x$!) then neither did the honest one.

Intuitively, it proves that the prover knows $x$, since $e$ was chosen uniformly at random. If she could win no matter what $e$ was, then it is a simple matter to “fork” her and give each fork different $e$ values, say $e_1$ and $e_2$. Then the two forks would produce $s_1 = k + xe_1$ and s_2 = k + xe_2, which expose $x$ as $x = (s_1 − s_2)/(e_1 − e_2)$. In other words, a verifier that can win regardless of $e$ can be used to extract the value of $x$, and therefore she must have knowledge of it.'

While I understand the mathematics of both parts, I don't understand how that proves zero-knowledge within the transcript, and how the verifier must have the value of $x$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.