Fiat-Shamir transformation

As explained in Real-World Cryptography

The Fiat-Shamir transformation converts an interactive proof into a non-interactive proof by deriving the verifier's challenge from a hash of the protocol transcript.

Interactive proofs require several messages and participants online together. The Fiat–Shamir transformation replaces the verifier’s challenge with a hash-derived value, making the proof non-interactive. section 7.2.2

The transformation follows a compact recipe:

• Collect the protocol transcript, including the prover’s messages. section 7.2.2
• Hash the transcript to derive a challenge that appears random and is not freely chosen. section 7.2.2
• Include the message being signed in the hash when converting a proof into a signature. section 7.2.2

From Schnorr proof to Dilithium signature

Schnorr replaces the verifier’s challenge with a hash of the transcript and message, producing a signature. Dilithium similarly hashes the message and commitment Ay1 + y2 to obtain its challenge. section 7.2.2 section 14.3.4

Figure 7.7 The left protocol is the Schnorr identification protocol previously discussed, which is an interactive protocol. The right protocol is a Schnorr signature, which is a non-interactive version of the left protocol (where the verifier message is replaced by a call to a hash function on the transcript).

Compare the interactive Schnorr identification protocol with its non-interactive signature form. section 7.2.2

How Real-World Cryptography covers it

How deep it goes

Explains transcript hashing and message binding, while stopping short of full signature optimizations and formal proofs.

Examples

Uses Schnorr signatures and Dilithium’s lattice-based signing protocol as concrete transformation examples.

What it assumes

Assumes familiarity with interactive zero-knowledge proofs, transcripts, hash functions, and witness-based signatures.

What you can do after

Apply the transformation by hashing protocol commitments and signed messages to derive non-interactive challenges.

How it connects

Connects interactive zero-knowledge proofs, sigma protocols, Schnorr signatures, digital signatures, and Dilithium.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• CRYSTALS-Dilithiumused by · CRYSTALS-Dilithium is a lattice-based digital signature scheme based on the learning with errors problem.
• non-interactive zero-knowledge proofproduces · A non-interactive zero-knowledge proof is a zero-knowledge proof generated and verified without online message exchange between the prover and verifier.
• Schnorr signatureproduces · A Schnorr signature is a public-key digital signature scheme based on a proof of knowledge of a discrete logarithm.
• sigma protocoluses · A sigma protocol is an interactive proof pattern consisting of a prover commitment, a verifier challenge, and a prover response.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.