0
$\begingroup$

I had a quick question for all.

Why do we hash the random challenge in Fiat-Shamir heuristic? If we hash the public key of Prover it should be enough for the verifier to prove non-repudiation?

What is the need for hashing the first random message the prover ($x=g^y$) also?

$\endgroup$
3
  • 1
    $\begingroup$ Do you want me to link the previous related questions for you, Sam? Or do you want to merge your accounts? Let me know. Please edit the title to better indicate the question you are asking, "hashing the public key" is too generic. $\endgroup$
    – Maarten Bodewes
    Oct 20, 2019 at 0:57
  • $\begingroup$ Hello, What did you mean ? I do not understand? $\endgroup$
    – Sam
    Oct 20, 2019 at 1:38
  • 1
    $\begingroup$ This would mean that the challenge is fixed before the prover commits. Therefore the prover can simply computer the transcript "backwards". I.e., choose a random response and compute a valid commitment. $\endgroup$
    – Maeher
    Oct 20, 2019 at 12:31

0

Browse other questions tagged or ask your own question.