0
$\begingroup$

enter image description here

As is known to all, the following picture depicts a sigma protocol, and to eliminate the interactivity, Prover can generate c by hashing (t, y) using Fiat Shamir transform. My question is: 1). Can c be obtained as hash(0x1234, 0x4321) by the Prover, (where 0x1234, 0x4321 are public parameters at setup)? 2). If above answer is yes, can a same c be used by different Provers at the same time in Fiat Shamir transform?

$\endgroup$
0
0
$\begingroup$

I didn't understand the question. Did you mean (0x1234,0x4321) is obtainable before producing t or not ? And sigma protocols are Honest-Verifier zero knowledge protocols where a simulator simulates the interaction with an honest verifier by first producing c and then calculating t and z in a way it would be accepted so that the released transcript would look like a real interaction. Therefore, knowing c beforehand would allow the prover to generate fake proof easily.

$\endgroup$
2
$\begingroup$

No. Since 0x1234, 0x4321 is public and thus known ahead of the execution, the prover knows the challenge c before sending t. This violet the requirement of the sigma protocol: c is sent to P after t is received.

$\endgroup$
0
$\begingroup$

In the Fiat-Shamir transform, the challenge $c$ would be obtained by hashing the commitment $t$. The intuition is that in sigma protocols there is only one $c$ (or a negligible fraction, depending on who you ask) per $t$ that will allow the prover to convince the verifier of a false claim. Now if the hash function is perfect, each challenge $H(t)$ generated by the prover will be random and will fail to convince the verifier with high probability. When you hash public parameters, the challenge is the same at every execution, so the prover can choose $t$ based on this challenge.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.