Honest-verifier zero knowledge asks for a simulator when the verifier follows the prescribed challenge procedure. Security against a malicious verifier must handle an arbitrary efficient verifier that can choose messages or challenges strategically within the protocol interface. An honest-verifier simulator is valuable evidence, but it does not by itself prove the stronger statement.
This specialist guide belongs to the Zero-Knowledge Proofs root. It also connects to The Gold Standard of Education | Learning That Transfers into Life and the How X Works hub. The worked cases are original teaching examples with stated inputs so their conclusions can be checked and transferred.
eduKateSG · Zero-Knowledge Proofs
Find your next learning step
Use this guide when a Sigma protocol, identification scheme or transformed non-interactive proof is called zero knowledge without stating which verifier class, setup, composition and challenge assumptions the simulator covers.
ROUTE 1 · CHAPTERS 1–3
Set up the distinction
Define the quantities, denominators and first worked case.
ROUTE 3 · CHAPTERS 6–8
Change the context
Change one premise, rebuild the result and track what remains comparable.
ROUTE 4 · CHAPTERS 9–10
Test limits and misconceptions
Separate the focused result from nearby claims requiring different evidence.
ROUTE 5 · CHAPTERS 11–12
Verify and explain
Use an evidence receipt, a transfer check and a concise final account.
Chapter contents
Set up the distinction · Chapters 1–3
Work the calculation · Chapters 4–5
Change the context · Chapters 6–8
6. Handle challenges chosen from commitments
Test limits and misconceptions · Chapters 9–10
Verify and explain · Chapters 11–12
The short answer is that HVZK assumes the verifier samples the prescribed challenge while malicious-verifier ZK quantifies over arbitrary efficient verifier strategies. This chapter treats name the verifier class as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A three-message protocol specifies a uniform one-bit challenge; first analyse a verifier that actually samples that bit uniformly Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the simulator obligation is indexed by the verifier behaviour being modelled The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For name the verifier class, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 1, the shortcut fails because HVZK assumes the verifier samples the prescribed challenge while malicious-verifier ZK quantifies over arbitrary efficient verifier strategies Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is name the verifier class, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 1, retain the inputs and intermediate result that decide name the verifier class. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that the relevant view can include verifier randomness, auxiliary input, received messages and internal state. This chapter treats define the view to be simulated as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A transcript contains commitment a, challenge e and response z, while the verifier view also records the coins that generated e Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. matching only printed messages can omit information available to the verifier The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For define the view to be simulated, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 2, the shortcut fails because the relevant view can include verifier randomness, auxiliary input, received messages and internal state Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is define the view to be simulated, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 2, retain the inputs and intermediate result that decide define the view to be simulated. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that many Sigma protocols simulate by choosing challenge and response first and deriving a compatible commitment. This chapter treats construct an honest-verifier simulator as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Choose e and z from their prescribed domains, compute a so verification accepts, and compare the distribution with an honest transcript Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the simulator avoids the witness by generating the transcript in a different order The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For construct an honest-verifier simulator, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 3, the shortcut fails because many Sigma protocols simulate by choosing challenge and response first and deriving a compatible commitment Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is construct an honest-verifier simulator, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 3, retain the inputs and intermediate result that decide construct an honest-verifier simulator. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 4 OF 12 · Work the calculation
4. Check distribution rather than one transcript
The short answer is that zero knowledge compares ensembles or views, not whether a single simulated transcript looks plausible. This chapter treats check distribution rather than one transcript as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. List the probabilities of all transcripts in a tiny toy challenge space and verify the simulated and real probabilities agree Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. acceptance alone is weaker than distributional indistinguishability The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For check distribution rather than one transcript, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 4, the shortcut fails because zero knowledge compares ensembles or views, not whether a single simulated transcript looks plausible Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is check distribution rather than one transcript, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 4, retain the inputs and intermediate result that decide check distribution rather than one transcript. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that a verifier that selects challenges non-uniformly can create a view outside the honest-verifier proof. This chapter treats show how challenge bias changes the task as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. The honest challenge is a fair bit, but a deviating verifier always asks e=1; the original simulator argument must be re-examined for that strategy Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the prescribed challenge distribution was part of the earlier proof The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For show how challenge bias changes the task, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 5, the shortcut fails because a verifier that selects challenges non-uniformly can create a view outside the honest-verifier proof Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is show how challenge bias changes the task, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 5, retain the inputs and intermediate result that decide show how challenge bias changes the task. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that a malicious verifier can make its challenge depend on the first message or auxiliary state. This chapter treats handle challenges chosen from commitments as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Let e be a deterministic hash of selected commitment bits in a toy example; a simulator that sampled e independently no longer matches the joint distribution Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. adaptivity couples messages that the HVZK proof treated as independently sampled The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For handle challenges chosen from commitments, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 6, the shortcut fails because a malicious verifier can make its challenge depend on the first message or auxiliary state Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is handle challenges chosen from commitments, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 6, retain the inputs and intermediate result that decide handle challenges chosen from commitments. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that a general-verifier simulator may need to rerun a verifier from saved state, and expected running time and success require proof. This chapter treats understand rewinding assumptions as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A simulator guesses a challenge, rewinds after a mismatch and repeats; record the per-attempt success probability and expected trials Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. rewinding is a proof technique with timing, state and interaction assumptions The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For understand rewinding assumptions, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 7, the shortcut fails because a general-verifier simulator may need to rerun a verifier from saved state, and expected running time and success require proof Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is understand rewinding assumptions, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 7, retain the inputs and intermediate result that decide understand rewinding assumptions. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 8 OF 12 · Change the context
8. Separate special soundness from zero knowledge
The short answer is that extracting a witness from two accepting transcripts and simulating a transcript are different protocol properties. This chapter treats separate special soundness from zero knowledge as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Two accepting transcripts share commitment a but use e=0 and e=1; an extractor can combine responses even though a simulator uses no witness Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. knowledge extraction constrains provers while zero knowledge protects against verifiers The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For separate special soundness from zero knowledge, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 8, the shortcut fails because extracting a witness from two accepting transcripts and simulating a transcript are different protocol properties Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is separate special soundness from zero knowledge, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 8, retain the inputs and intermediate result that decide separate special soundness from zero knowledge. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 9 OF 12 · Test limits and misconceptions
9. Treat composition as a new claim
The short answer is that a protocol secure in one stand-alone interaction may need stronger properties under concurrent or resettable execution. This chapter treats treat composition as a new claim as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Two sessions interleave commitments and challenges; a simulator that rewinds one session can disturb the other Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the scheduling environment changes the verifier view and the simulation strategy The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For treat composition as a new claim, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 9, the shortcut fails because a protocol secure in one stand-alone interaction may need stronger properties under concurrent or resettable execution Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is treat composition as a new claim, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 9, retain the inputs and intermediate result that decide treat composition as a new claim. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 10 OF 12 · Test limits and misconceptions
10. State transformation assumptions
The short answer is that Fiat–Shamir or compiler steps produce a new protocol whose security depends on model and instantiation assumptions. This chapter treats state transformation assumptions as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Replace a random challenge with a hash-derived challenge and name the random-oracle or other assumption used in the proof Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. a transformation does not inherit every interactive property by vocabulary alone The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For state transformation assumptions, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 10, the shortcut fails because Fiat–Shamir or compiler steps produce a new protocol whose security depends on model and instantiation assumptions Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is state transformation assumptions, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 10, retain the inputs and intermediate result that decide state transformation assumptions. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that a proof can be zero knowledge in its model while timing, errors or randomness failures leak information in code. This chapter treats keep implementation leakage separate as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Two responses are mathematically distributed correctly but nonce generation repeats or runtime depends on witness bits Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. protocol simulation does not certify side-channel resistance or random-number quality The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For keep implementation leakage separate, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 11, the shortcut fails because a proof can be zero knowledge in its model while timing, errors or randomness failures leak information in code Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is keep implementation leakage separate, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 11, retain the inputs and intermediate result that decide keep implementation leakage separate. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that a defensible claim names verifier class, view, simulator, distribution notion, setup, running time and composition scope. This chapter treats build a proof-property receipt as a defined comparison. Keep statement, witness, commitment, challenge distribution, response, verifier state, auxiliary input, simulator access, transcript distribution, rewinding assumption and composition setting in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Prepare a receipt saying HVZK for the interactive protocol and list the additional theorem needed for malicious verifiers Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the receipt prevents one simulator sketch from becoming an unlimited security claim The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge distribution, verifier state, interaction schedule or transformation one at a time. For build a proof-property receipt, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to see a simulator for prescribed random challenges and announce security against every verifier and composition. In chapter 12, the shortcut fails because a defensible claim names verifier class, view, simulator, distribution notion, setup, running time and composition scope Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Formal security depends on the exact protocol, model and computational assumptions; toy transcripts illustrate logic rather than parameter security. The present boundary is build a proof-property receipt, so adjacent claims need their own observations. The examples explain definitions and proof obligations; they are not production cryptographic parameters or a substitute for review of a concrete protocol and implementation. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the protocol specification, domains, setup, verifier algorithm, simulator, reduction, distribution notion, runtime bound and composition theorem. For chapter 12, retain the inputs and intermediate result that decide build a proof-property receipt. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
Contents · Previous chapter · Return to the Zero-Knowledge Proofs subject guide
Frequently asked questions
Does HVZK mean the protocol is insecure?
No. It is a precise and useful property, but a stronger verifier claim needs its own proof or transformation.
Why is a valid simulated transcript insufficient?
Zero knowledge concerns the distribution of the verifier view, not acceptance of one crafted transcript.
Is special soundness the same as zero knowledge?
No. Special soundness supports extraction from provers; zero knowledge concerns what verifiers learn.
Does Fiat–Shamir automatically preserve zero knowledge?
No. The transformed claim depends on its model, hash treatment, protocol details and proof.
Continue through the verified reading routes
Start with the wider system
The Gold Standard of Zero-Knowledge Proofs · The Gold Standard of Education | Learning That Transfers into Life · How X Works hub
Compare the closest mechanisms
Recovering a Schnorr witness from a reused commitment · Checking a polynomial sum with degree bounds and fresh challenges · The Gold Standard of Cryptography
Choose the next lesson by reader job
Use the Schnorr lesson for commitment reuse and extraction, the sum-check lesson for fresh challenges, and this lesson for the boundary between honest-verifier simulation and arbitrary-verifier security.
Authoritative sources and evidence checks
IETF CFRG — Sigma Protocols · NIST — Zero-Knowledge Proofs project · Goldwasser, Micali and Rackoff — The Knowledge Complexity of Interactive Proof Systems
Definitions follow the IETF draft, NIST project context and foundational GMR paper. The bit-challenge examples are original teaching fixtures and omit production parameters.