I am looking for how an adversary to special HVZK would work. In Boneh and Shoup's book (BonehShoup) they have Attack Game 20.4 for special cHVZK. Here, the adversary produces a pair (x,y) (witness and statement) and sends it to their challenger, who either uses P and V or Sim to produce the transcript.

Can I modify this game in the following ways?

  1. Can the adversary generate the challenge?
  2. Can I have the adversary ask on polynomially many challenges instead of just one? Why is he limited to a single output here?

1 Answer 1


This question requires clarifications regarding the definition of special computational Honest-Verifier-Zero-Knowledge (Special cHVZK) as introduced in the linked material by Boneh and Shoup:

  1. Can the adversary generate the challenge c of the transcript in Special cHVZK?

No, because this is meant to be a definition for a version of honest-verifier zero-knowledge, therefore challenges must be uniformly random and cannot be chosen by the adversary.

  1. Can the adversary ask the transcript for polynomially many challenge instead of just one?

Well, that is the definition. If you allow the adversary to ask transcripts of polynomially many challenges, then it is easy to see that you will end up with an equivalent definition. So in theory, you could allow the adversary to ask the transcript of polynomially-many challenges.

  • $\begingroup$ I've performed a slight rewording / reformatting of the sentence to show what I meant. Note that the question is relatively old by now, so you may not get as many reactions as an answer on a "fresh" question. Thanks for trying to answer though, I started out my SO experience by answering interesting older answers :) $\endgroup$
    – Maarten Bodewes
    Commented Jul 30, 2019 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.