# Why does the verifier have to send a challenge in Shnorr protocol?

In the Shnorr protocol where the prover wants to prove he has a witness $$w$$ for $$g^w$$ the following interactions happen:

• the prover chooses a random $$r$$, calculates $$y=g^r$$ and sends $$y$$

• the verifier sends a challenge $$x$$

• the prover calculates $$t=xw+r$$ and sends it to the verifier

• the verifier tests if $$g^t=(g^w)^x.y$$

My question is why the verifier sends a challenge. Would he be convinced if the prover just sends $$t=r+x$$ and the verifier tests if $$g^t=g^w.y$$? Plus $$t$$ won't reveal the witness.

my question is why the verifier sends a challenge, would he be convinced if the prover just sends $$t=r+x$$ and the verifier tests if $$g^t=g^w \cdot y$$ ?
That is, why doesn't the prover just send $$t$$ and $$y$$? Well, anyone can pick a random $$t$$ and compute $$y = g^t \cdot (g^w)^{-1}$$. Because $$g^w$$ is public, this can be computed by anyone, and so wouldn't serve as a proof of knowledge.
And, it is easy to find a solution to $$g^t=(g^w)^x \cdot y$$ (without knowing $$w$$), if you know the $$x$$ value before selecting the $$y$$ (and you suggested a constant $$x=1$$, hence the prover knows it up-front). However, if you can find a solution for $$g^t=(g^w)^x \cdot y$$ for two different $$x$$'s, that's different; it's easy to show that with solutions to two different $$x$$'s (and the same $$y$$), we can recover $$w$$ (and hence someone who can do that must know $$w$$). On the other hand, we can't just give out two solutions (as that means the verifier would then be able to deduce $$x$$).
So, what we do is get the prover to give a solution for an $$x$$ he cannot predict in advance; either he got extremely lucky (and he guessed the correct $$x$$ value when he generated $$y$$), or he does in fact know multiple solutions (and hence knows $$w$$).