3 ms·
Yeah, I was looking at it in the context of PKI -- where the public key is already tied to an identity. (It is also a zkp in case of a scheme with a challenge
by Manishearth 10y ago
Yeah, I was looking at it in the context of PKI -- where the public key is already tied to an identity.
(It is also a zkp in case of a scheme with a challenge nonce)
- belovedeagle 10y ago> It is also a zkp in case of a scheme with a challenge nonce This is my point - it is not zk because as verifier you can show the transcript to a 3rd party and convince them that the thing to be proved is true, even if the thing to be proved can't let you successfully impersonate the prover thanks to a nonce. In a zkp scheme, the transcript proves nothing - it's as if you took the signing scheme transcript and made it so you couldn't determine which pubkey was being signed for: the 3rd party would have no reason to believe you hadn't faked the transcript. In short, zkp transcripts must be fakeable, as counterintuitive as that sounds.