A witness is secret information that lets a prover establish that a statement is true. In a proof of knowledge, revealing the witness directly proves possession but may disclose the secret. section 7.2
Proving knowledge without revealing x
Suppose Peggy claims to know x for Y = g^x. Sending x proves her claim but exposes the secret. A Schnorr-style protocol instead hides x with random k, first forming R = g^k, then lets Victor verify that g^s equals Y × R without learning x or k. The witness remains secret while possession can be checked. section 7.2.1
A witness supports several related cryptographic ideas:
- Zero-knowledge proofs establish knowledge of a witness without revealing it. section 7.2
- Schnorr identification uses randomness and exponentiation to prove knowledge interactively. section 7.2.1
- A Fiat–Shamir transformation turns the interactive proof into a non-interactive proof, and incorporating a message produces a signature. section 7.2.2
- In signatures, the witness becomes the private signing key; protect it and avoid assuming signatures are unique. section 7.2.2 section 7.5
