In How To Prove Yourself: Practical Solutions to Identification and Signature Problems, Fiat and Shamir introduce a zero-knowledge identification scheme where
- The prover sends a commitment to the verifier
- The verifier sends a challenge to the prover (in shape of random coin tosses)
- The prover sends a response to the verifier
- The verifier checks if the response is correct
This is zero-knowledge and a Sigma protocol as described by Cramer in his PhD thesis.
My only experience with commitments is in fairly flipping a coin over telephone, in which case a commitment seems perfectly reasonable. But what is the basic intuition behind the commitment in the Fiat-Shamir case? Challenge and response are obviously part of the protocol, but why is the commitment needed? As far as I can tell, the commitment is not even revealed to the verifier in the Fiat-Shamir identification scheme!