Statement soundness limits a cheating prover’s ability to make a verifier accept a false statement. A proof of knowledge asks for more: when a prover convinces the verifier often enough, a specified extractor should be able to obtain a witness for the stated relation, subject to a knowledge error and a defined model. Acceptance of true statements alone does not establish that stronger knowledge claim.
This specialist guide belongs to the Zero-Knowledge Proofs root. It also connects to The Gold Standard of Education | Learning That Transfers into Life and the How X Works hub. The worked cases are original teaching examples with stated inputs so their conclusions can be checked and transferred.
eduKateSG · Zero-Knowledge Proofs
Find your next learning step
Use this guide when a Sigma protocol, identification scheme or non-interactive argument is described as sound and therefore as proving possession. The examples separate truth of the public relation, witness extraction, challenge space, rewinding and implementation claims.
ROUTE 1 · CHAPTERS 1–3
Set up the distinction
Define the quantities, denominators and first worked case.
ROUTE 3 · CHAPTERS 6–8
Change the context
Change one premise, rebuild the result and track what remains comparable.
ROUTE 4 · CHAPTERS 9–10
Test limits and misconceptions
Separate the focused result from nearby claims requiring different evidence.
ROUTE 5 · CHAPTERS 11–12
Verify and explain
Use an evidence receipt, a transfer check and a concise final account.
Chapter contents
Set up the distinction · Chapters 1–3
Work the calculation · Chapters 4–5
Change the context · Chapters 6–8
6. Calculate knowledge error from a challenge space
Test limits and misconceptions · Chapters 9–10
Verify and explain · Chapters 11–12
The short answer is that a proof-of-knowledge claim is tied to a relation R(x,w), not to a loose assertion that the prover knows something. This chapter treats state the public relation and witness as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. For group generator g and public y, the instance is y and a witness is w satisfying y=g^w; name that equation before analysing transcripts Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. extraction can only return an object whose required relation has been specified The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For state the public relation and witness, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 1, the shortcut fails because a proof-of-knowledge claim is tied to a relation R(x,w), not to a loose assertion that the prover knows something Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is state the public relation and witness, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 1, retain the inputs and intermediate result that decide state the public relation and witness. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that soundness bounds acceptance when the public statement is false or outside the language under the stated adversary model. This chapter treats define statement soundness as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. If no w satisfies R(x,w), a prover should make the verifier accept with probability at most ε_s Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the property is about false instances and may say nothing about how a successful prover handles witnesses for true instances The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For define statement soundness, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 2, the shortcut fails because soundness bounds acceptance when the public statement is false or outside the language under the stated adversary model Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is define statement soundness, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 2, retain the inputs and intermediate result that decide define statement soundness. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 3 OF 12 · Set up the distinction
3. Define the proof-of-knowledge obligation
The short answer is that knowledge soundness requires an extractor that obtains a valid witness from a sufficiently successful prover. This chapter treats define the proof-of-knowledge obligation as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A prover accepted with probability p above knowledge error κ is paired with extractor E that outputs w with R(x,w)=true within the definition’s runtime bound Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the quantified extractor adds a constructive witness condition beyond false-statement rejection The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For define the proof-of-knowledge obligation, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 3, the shortcut fails because knowledge soundness requires an extractor that obtains a valid witness from a sufficiently successful prover Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is define the proof-of-knowledge obligation, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 3, retain the inputs and intermediate result that decide define the proof-of-knowledge obligation. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 4 OF 12 · Work the calculation
4. Use special soundness in a Sigma protocol
The short answer is that two accepting transcripts with the same commitment and distinct challenges can algebraically reveal a witness. This chapter treats use special soundness in a sigma protocol as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. For Schnorr, responses z1=r+c1w and z2=r+c2w give w=(z1−z2)/(c1−c2) when c1 differs from c2 Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. subtracting cancels the shared nonce term and exposes the relation witness The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For use special soundness in a sigma protocol, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 4, the shortcut fails because two accepting transcripts with the same commitment and distinct challenges can algebraically reveal a witness Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is use special soundness in a sigma protocol, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 4, retain the inputs and intermediate result that decide use special soundness in a sigma protocol. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 5 OF 12 · Work the calculation
5. Separate a mathematical extractor from a normal verifier
The short answer is that the extractor may rewind or interact with a prover in ways an ordinary single-run verifier cannot. This chapter treats separate a mathematical extractor from a normal verifier as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A verifier sees one accepting transcript; an extractor resets to the saved commitment state and obtains a second challenge response Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. extractability is a theorem about controlled access, not a promise that users receive the secret The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For separate a mathematical extractor from a normal verifier, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 5, the shortcut fails because the extractor may rewind or interact with a prover in ways an ordinary single-run verifier cannot Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is separate a mathematical extractor from a normal verifier, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 5, retain the inputs and intermediate result that decide separate a mathematical extractor from a normal verifier. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 6 OF 12 · Change the context
6. Calculate knowledge error from a challenge space
The short answer is that a prover able to answer only one challenge per commitment can still guess that challenge with probability 1 over the challenge-set size. This chapter treats calculate knowledge error from a challenge space as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. With 256 equally likely challenges, a one-challenge strategy succeeds with probability 1/256, setting a natural special-soundness knowledge-error scale Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. success above the guessing baseline creates the leverage needed for a second accepting branch The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For calculate knowledge error from a challenge space, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 6, the shortcut fails because a prover able to answer only one challenge per commitment can still guess that challenge with probability 1 over the challenge-set size Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is calculate knowledge error from a challenge space, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 6, retain the inputs and intermediate result that decide calculate knowledge error from a challenge space. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 7 OF 12 · Change the context
7. Show a sound protocol that need not prove knowledge
The short answer is that ordinary soundness can hold while the protocol gives no extractor for a meaningful witness relation. This chapter treats show a sound protocol that need not prove knowledge as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A protocol proves that x belongs to a public set by revealing a precomputed membership certificate available to everyone; false x is rejected, but acceptance need not evidence private possession Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. truth of a statement and possession of a designated witness are separate claims The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For show a sound protocol that need not prove knowledge, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 7, the shortcut fails because ordinary soundness can hold while the protocol gives no extractor for a meaningful witness relation Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is show a sound protocol that need not prove knowledge, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 7, retain the inputs and intermediate result that decide show a sound protocol that need not prove knowledge. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that expected extraction time depends on prover success, challenge probability and the cost of rewinding or forking. This chapter treats account for extractor runtime as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. If a branch succeeds with probability p, repeated trials can cost on the order implied by p and the reduction; record the actual theorem rather than saying extraction is immediate Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. an existence claim without its efficiency condition is not the standard cryptographic knowledge guarantee The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For account for extractor runtime, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 8, the shortcut fails because expected extraction time depends on prover success, challenge probability and the cost of rewinding or forking Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is account for extractor runtime, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 8, retain the inputs and intermediate result that decide account for extractor runtime. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 9 OF 12 · Test limits and misconceptions
9. Bind every public input into the statement
The short answer is that extraction for one encoded instance does not prove knowledge for omitted or ambiguously bound application data. This chapter treats bind every public input into the statement as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A proof binds y but omits account identifier A; the same transcript can be relabelled across accounts even if a discrete-log witness exists Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the extracted witness must satisfy the complete application relation actually relied upon The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For bind every public input into the statement, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 9, the shortcut fails because extraction for one encoded instance does not prove knowledge for omitted or ambiguously bound application data Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is bind every public input into the statement, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 9, retain the inputs and intermediate result that decide bind every public input into the statement. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 10 OF 12 · Test limits and misconceptions
10. Treat Fiat–Shamir as a new argument
The short answer is that replacing verifier challenges with hashes changes the model and extraction proof. This chapter treats treat fiat–shamir as a new argument as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. The interactive special-soundness equation remains algebraically useful, but a non-interactive extractor may need a random-oracle forking argument or another model Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. one cannot copy the interactive extractor claim without the transformation theorem and encoded context The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For treat fiat–shamir as a new argument, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 10, the shortcut fails because replacing verifier challenges with hashes changes the model and extraction proof Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is treat fiat–shamir as a new argument, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 10, retain the inputs and intermediate result that decide treat fiat–shamir as a new argument. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
CHAPTER 11 OF 12 · Verify and explain
11. Keep possession, control and identity separate
The short answer is that extractable knowledge of a witness does not by itself establish who operated a device, why they acted or whether the witness remains exclusively controlled. This chapter treats keep possession, control and identity separate as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. A valid proof extracts a key consistent with y in the model; it does not certify legal identity, fresh human intent or absence of malware Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. application conclusions require bindings and evidence beyond the cryptographic relation The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For keep possession, control and identity separate, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 11, the shortcut fails because extractable knowledge of a witness does not by itself establish who operated a device, why they acted or whether the witness remains exclusively controlled Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is keep possession, control and identity separate, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 11, retain the inputs and intermediate result that decide keep possession, control and identity separate. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
The short answer is that a defensible claim links language soundness, relation, knowledge error, extractor, runtime, model and application binding. This chapter treats build a proof-property receipt as a defined comparison. Keep instance, relation, witness, prover strategy, verifier challenge, acceptance probability, ordinary soundness error, knowledge error, extractor access, runtime, rewinding model and transformation assumptions in separate fields. Two values can share a subject or unit and still answer different questions.
Worked example. Record ε_s, κ, challenge domain, extractor access and R(x,w), then test which conclusion survives if the statement is true but the prover uses an external witness service Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.
Why the result follows. the receipt prevents sound from becoming an unsupported synonym for proves possession The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.
Changed-context transfer check. change the challenge size, prover success probability, encoded instance, extractor access or Fiat–Shamir model one at a time. For build a proof-property receipt, change only the named premise and recalculate before comparing the conclusions. Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.
A common misconception is that nearby measurements are interchangeable. Here, The common shortcut is to move from false statements are rejected to every accepted prover demonstrably possesses the witness in the ordinary execution. In chapter 12, the shortcut fails because a defensible claim links language soundness, relation, knowledge error, extractor, runtime, model and application binding Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.
Limits and caveats. Knowledge extraction is definition- and model-specific; toy special-soundness algebra does not certify every proof system or deployment. The present boundary is build a proof-property receipt, so adjacent claims need their own observations. These are security-definition lessons with toy algebra; a production claim requires the exact protocol, parameter set, reduction, model and implementation review. Report any convention, instrument setting or model choice that can change the boundary of the claim.
Practical evidence check. Preserve the relation, instance encoding, transcript domains, success experiment, soundness and knowledge errors, extractor algorithm, runtime analysis, oracle model and application bindings. For chapter 12, retain the inputs and intermediate result that decide build a proof-property receipt. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reviewer should be able to change one premise and obtain the transfer result without guessing the sample, pore domain, calibration state or verifier behaviour used.
Contents · Previous chapter · Return to the Zero-Knowledge Proofs subject guide
Frequently asked questions
Does a sound proof automatically prove knowledge?
No. A proof-of-knowledge claim adds an extractor, a witness relation, a knowledge error and an efficiency condition.
Will a normal verifier learn the witness?
No. Extraction is an analysis tool with specified access; zero knowledge can still protect the witness in normal executions.
Is special soundness enough for every non-interactive proof?
No. The Fiat–Shamir transformation or other compilation needs its own model and extraction theorem.
Does witness extraction prove a person’s identity?
Only if the application relation and credential bindings justify that claim. Cryptographic witness knowledge alone is narrower.
Continue through the verified reading routes
Start with the wider system
The Gold Standard of Zero-Knowledge Proofs · The Gold Standard of Education | Learning That Transfers into Life · How X Works hub
Compare the closest mechanisms
Schnorr witness recovery from a reused commitment · Honest-verifier and malicious-verifier zero knowledge · Polynomial sum-check with fresh challenges
Choose the next lesson by reader job
Use the Schnorr lesson for the concrete two-transcript equation, the verifier-security lesson for simulation boundaries, and this lesson for the extractor and knowledge-error obligations that distinguish proof of knowledge from statement soundness.
Authoritative sources and evidence checks
IETF CFRG — Sigma Protocols · NIST — Privacy-Enhancing Cryptography tools · Bellare and Goldreich — On Defining Proofs of Knowledge
The Sigma-protocol properties follow the current CFRG draft, the relation view follows NIST, and the extractor-definition cautions follow Bellare and Goldreich. All challenge sizes and examples are original teaching fixtures.