# Verification of the NI-ZK Proof

I'm currently learning about ZKP and Non-interactive zero knowledge (NI-ZK) but I'm confused in the process of NI-ZK verification.

I have taken the following example to learn about NI-ZK from this link i.e

1) Anna wants to prove to Carl that she knows a value $$x$$ such that $$y = g^x$$ to a base $$g$$.

2) Anna picks a random value $$v$$ from a set of values $$Z$$, and computes $$t = g^v$$.

3) Anna computes $$c = H(g,y,t)$$ where $$H()$$ is a hash function. Anna computes $$r= v – c*x$$.

4) Carl or anyone can then check if $$t = g^r * y^c$$

From the example it is clear that verifier knows the value of $$y$$ and $$g$$, then isn't it simple to calculate the secret value ($$x$$) by the following formula:

since $$y=g^x$$

$$x = \cfrac{log_y}{log_g}$$

Or have I misunderstood something here?

• What you're missing is that the discrete logarithm is assumed to not be efficiently computable in the group being used. Jan 16, 2019 at 15:14
• Can you elaborate the factor that make it's impossible to compute ?? Jan 16, 2019 at 15:30
• What your description is missing is that the exponentiation takes place not over the integers but in some finite cyclic group. g is a generator of this group. That means also the logarithm must be taken in that group. This is called the discrete logarithm problem. There are some groups where it is believed that computing discrete logarithms is hard. If the discrete logarithm problem is hard, then the protocol you describe is ZK. Otherwise it's not. Jan 16, 2019 at 16:06