Regular 3-steps Schnorr protocol is a proof of knowledge system for discrete logarithm. It's honest-verifier zero-knowledge, but not full zero-knowledge. My question is, is it witness-hiding? (I guess it should be the most important property in many cases, rather than too strong and not required ZK, and too weak HVZK).
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
I found the answer: Schnorr protocol is witness-hiding - proved in GGM model in https://www.shoup.net/papers/dlbounds1.pdf (as part of proof that Schnorr identification protocol is secure).
At the same time, it's not possible to prove it in standard model based on discrete-log problem: http://www.cs.cornell.edu/~rafael/papers/schnorr.pdf