According to Wiki there is a possibility of non-interactive Zero-Knowledge Proof of discrete logarithm if challenge $c$ is computed via a hash function. But what is the purpose of $c$? Why can not I always set $c=1$? Does it make the system vulnerable?


1 Answer 1


Does it make the system vulnerable?

Yes; if the prover knew apriori what value of $c$ that will be used, the prover could easily issue a proof (even if she didn't know the discrete log).

To prove knowledge of the discrete log of $y$ to the base $g$, the prover transmits the values $r$ and $t$, and the validator checks whether $t \equiv g^r y^c$; if the prover selected an arbitrary $r$ and computed $t = g^r y^c$, and transmitted those values, this check would validate.

In the real noninteractive protocol, this doesn't work because $c$ is a complex function of (among other things) $t$, and hence she cannot arbitrarily select $t$ without affecting the value $c$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.