Schnorr identification protocol

As explained in Real-World Cryptography

The Schnorr identification protocol is an interactive proof-of-knowledge protocol in which a prover demonstrates knowledge of a discrete logarithm without revealing it.

The Schnorr identification protocol lets a prover demonstrate knowledge of a discrete logarithm without revealing the secret witness. It turns a random commitment, a verifier’s challenge, and a proof into an interactive zero-knowledge exchange. section 7.2.1

The exchange follows three movements:

• Commitment: Peggy chooses a random value k and uses the generator to form a hidden commitment such as g^k. section 7.2.1
• Challenge: Victor sends a challenge c only after receiving Peggy’s commitment. section 7.2.1
• Proof: Peggy combines k with her witness and the challenge to compute s, which Victor checks without learning the witness. section 7.2.1

This construction is complete, sound, and zero-knowledge: an honest prover can demonstrate knowledge, a prover without the witness cannot successfully prove it, and the verifier learns nothing about the witness. Its guarantee is honest-verifier zero-knowledge, so a verifier choosing challenges dishonestly may learn something. section 7.2.1

Figure 7.6 The Schnorr identification protocol is an interactive ZKP that is complete (Peggy can prove she knows some witness), sound (Peggy cannot prove anything if she doesn’t know the witness), and zero-knowledge (Victor learns nothing about the witness).

Use the protocol diagram to trace commitment, challenge, and proof while comparing completeness, soundness, and zero-knowledge. section 7.2.1

How Real-World Cryptography covers it

How deep it goes

Explains commitment, challenge, proof, and HVZK, while stopping short of detailed formal proof or implementation.

Examples

Uses Peggy and Victor, the random value k, generator exponentiation g^k, challenge c, and proof value s.

What it assumes

Assumes familiarity with commitment schemes and introduces their arithmetic alternative through generator exponentiation.

What you can do after

Evaluate/understand how commitment, challenge, and proof establish knowledge without exposing the witness.

How it connects

Connects commitment schemes, zero-knowledge proofs, Sigma protocols, and digital signatures.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• sigma protocolkind of · A sigma protocol is an interactive proof pattern consisting of a prover commitment, a verifier challenge, and a prover response.
• Schnorr signatureimplemented by · A Schnorr signature is a public-key digital signature scheme based on a proof of knowledge of a discrete logarithm.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.