# Are multi move proof protocols still “sigma protocols”?

Conventionally, sigma protocols are defined as being a three-move protocol (1. commit, 2. challenge, 3. response). Reading papers like "Bulletproofs" (Bunz, Bootle, Boneh et al., 2018), it feels like the authors avoid to call their protocols "sigma protocols", although their protocols are always repeats of either 1, 2 and 3 or only 2 and 3; i.e., the verifier only issues (field element) challenges and the prover repeats a response and commit.

Is there a technical reason that the term "sigma protocol" cannot be generalised to multi-move protocols?

• (I added zero-knowledge-proofs as tag, since there is no proof-of-knowledge tag...) – Ruben De Smet May 2 '19 at 14:06

There is no technical reason while it couldn't - but the term $$\Sigma$$-protocol was specifically invented to mean three-round public-coin honest-verifier zero-knowledge proof system. Note that the very choice of the greek letter $$\Sigma$$ was made because it (kind of) picturally represents the interaction pattern in a three-move protocol (arguably, one could also kind of see a four move protocol in it :p).
For many-round generalizations of $$\Sigma$$-protocol, I'd recommend calling them by their natural name, public-coin HVZK proofs. Note that the form "commitment - challenge - response" is characteristic of public-coin proofs in general, not only of $$\Sigma$$-protocols.
• Nice answer! Now, in practice, it seems to me that those pc-hvzk-proof protocols (including $\Sigma$-protocols) are basically always used though a Fiat Shamir transformation, such that we don't require the physical communication any more. Of course, this brings us into ROM, but it makes interaction less of a big deal. – Ruben De Smet May 3 '19 at 7:49