I am trying to understand how signature scheme proposed to NIST, Picnic, works.
The propossal uses ZKboo and ZKboo++ as their basis. I can see how the ZKPoK works, where the witness x is some key for any block-cipher. A prover and a verifier can run a game based on MPC in the head such that they can re-encrypt some pre-define bitstring using x.
However, this is not quite intuitable translatable to Digital Signatures. For instance, the propossal suggests that I should use H(r||m) as the protocols challenge. It is not clear however, what the response (z) actually is?
In the presentations they cite easy examples such as the Fiat-Shamir transform to signal that a Signature Scheme can be easily (and naively) obtained. They even use the same terminology as when the transform is applied to the Schnorr protocol, signaling that it is enough to use the message as the challenge (e). However it is not clear to me how this can be, because I do not how to plug the challenge in. I think I am struggling to see the role of the challenge as a hash of the message during both Signing (Prove) and Verification (Verify).
How is this challenge being incorporated into z (say, as an encryption using thewitness as key?) What is actually z? And what is the equation being verified to check the validity of the signature?
Finally Kudos to the designers, I love the basic idea, I hope I manage to understand it better with your help!