Serving up zero-knowledge proofs

Summary: Trail of Bits describes how the Fiat-Shamir transformation converts interactive zero-knowledge proofs into non-interactive ones by hashing the prover's inputs to generate the challenge, and how implementation errors in that hashing break the proof's soundness. The post cites a Swiss voting system where only part of the prover's input was given to the hash function, letting a prover create false decryption proofs that could alter valid votes so they were not counted.
Why it matters: A hashing mistake in a ZK implementation let false proofs pass verification in a live voting system, where the consequence was valid votes being altered so they would not be counted.

Read the original at Trail of Bits Blog ↗