# Drawbacks of Schnorr Authentication that require Fiat-Shamir and Random Oracles?

I've been going through G. Maxwell's paper on the Borromean Ring Signature, and I don't fully understand this part on Schnorr Signature. If some could explain it more intuitively thank you.

"Intuitively, this is zero knowledge because if the verifier had slipped the prover pre-knowledge of what $$e$$ would be, the prover could have produced a legitimate $$s$$ without knowing $$x$$ at all. (Specifically, she would choose $$s$$ randomly and then choose “$$kG$$” as $$sG−exG$$.) The transcript of the prover/verifier interactions in this case would be statistically indistinguishable from a transcript in the honest game; thus if the dishonest game revealed nothing about $$x$$ (and it did not; it did not even use $$x$$!) then neither did the honest one.

Intuitively, it proves that the prover knows $$x$$, since $$e$$ was chosen uniformly at random. If she could win no matter what $$e$$ was, then it is a simple matter to “fork” her and give each fork different $$e$$ values, say $$e_1$$ and $$e_2$$. Then the two forks would produce $$s_1 = k + xe_1$$ and s_2 = k + xe_2, which expose $$x$$ as $$x = (s_1 − s_2)/(e_1 − e_2)$$. In other words, a verifier that can win regardless of $$e$$ can be used to extract the value of $$x$$, and therefore she must have knowledge of it.'

While I understand the mathematics of both parts, I don't understand how that proves zero-knowledge within the transcript, and how the verifier must have the value of $$x$$.