I'm not sure how to compute the second challenge when applying FS to a 5-round protocol. I've seen TWO different formulas (with and without including the first challenge) and don't know which one is correct.
Suppose we have 5-round interactive protocol for some statement $st$:
$P$ → $V$: $x$ means prover sent $x$ to verifier.
$P$ ← $V$: $y$ means verifier sent $y$ to prover.
- $P$ → $V$: $\alpha_1$ // 1st commitment
- $P$ ← $V$: $ch_1$ // 1st challenge
- $P$ → $V$: $\alpha_2$ // 1st answer
- $P$ ← $V$: $ch_2$ // 2nd challenge
- $P$ → $V$: $\alpha_3$ // 2nd answer
Now we can apply Fiat-Shamir transform to get a non-interactive proof.
Question: how we compute $ch_2$?:
a) $ch_2 = Hash(st|\alpha_1|\alpha_2|aux)$
b) $ch_2 = Hash(st|\alpha_1|\alpha_2|ch_1| aux)$ ← includes $ch_1$
On the one hand, $ch_2$ should be independent of $ch_1$, right? An original article of Pointcheval and Stern[2], article by Kiltz et. al[1], plus some answers here use formula a.
On the other hand, there are articles [3],[4] where the formula b is used.
UPD: Will the fact of whether $ch1$ included or not matter for the Forking Lemma?
[1] Tightly-Secure Signatures from Five-Move Identification Protocols by Eike Kiltz, Julian Loss, and Jiaxin Pan https://eprint.iacr.org/2017/870.pdf
[2] Security Arguments for Digital Signatures and Blind Signatures by David Pointcheval and Jacques Stern https://www.di.ens.fr/david.pointcheval/Documents/Papers/2000_joc.pdf
[3] From 5-pass MQ-based identification to MQ-based signatures by Ming-Shing Chen, Andreas Hülsing, Joost Rijneveld, Simona Samardjiska, and Peter Schwabe https://eprint.iacr.org/2016/708.pdf
[4] Extended Security Arguments for Signature Schemes by Sidi Mohamed El Yousfi Alaoui, Özgür Dagdelen, Pascal Véron, DavidGalindo, Pierre-Louis Cayrel https://hal.inria.fr/hal-00684486/document