Interactive vs Non-Interactive

ZK proofs naturally come in interactive form: prover and verifier exchange messages.

Three-message sigma protocol:

Prover                    Verifier
  -- commitment ----->
                       <-- challenge --
  -- response ------->

Verifier checks the response is consistent with commitment + challenge. The transcript proves nothing without all three messages.

Sometimes interaction is impractical:

• Verifier offline (cert verification, blockchain transactions).
• Many verifiers (single proof, broadcast).

Fiat-Shamir transform makes it non-interactive:

• Replace verifier's challenge with c = hash(commitment, public_inputs).
• The hash is "an oracle" — assumed to behave randomly.
• In random oracle model, this is provably secure (under reasonable assumptions).

Now the prover computes the entire proof alone:

Prover sends:
  commitment (a)
  response (z)

Verifier:
  recomputes c = hash(a, statement)
  checks consistency between (a, c, z)

Cost: one hash. Big benefit.

Pitfalls:

• Hash must include EVERYTHING: statement + commitment. Forgetting either creates exploits.
• Domain separation: use different hash labels for different protocols.
• "Frozen Heart" attack: implementations that omitted statement from the hash were broken (multiple Bulletproofs implementations had this in 2022).

We'll see this when implementing Schnorr → non-interactive Schnorr → signatures.