2 ms·

I'm not quite sure I follow. What does the verifier learn after NIZK? Isn't it the point that the verifier learns nothing other than the prover has some secret

I'm not quite sure I follow. What does the verifier learn after NIZK? Isn't it the point that the verifier learns nothing other than the prover has some secret knowledge? Seems to me like it's just the same information rescheduled with the help of a PRF.

betterunix2 9y ago
The verifier learns the NIZK itself; i.e. the verifier could not have computed the NIZK independently.