In the definition of $F_{NIZK}$ in [GOS06b], on receiving prove from a party, the functionality forwards the statement to the ideal world adversary $S$.

This ideal world adversary then creates a proof $\pi$ and replies to the ideal functionality, who forwards $\pi$ to the party.

Can someone give me an intuition why $S$ decides the proof for a given statement? Why can't the ideal functionality itself compute a proof and reply to the querying party?

Is it because you need it in the proof of security of the protocol?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.