Zero-Knowledge Proof: The Schnorr Protocol

🔐 Zero-Knowledge Proof

Rounds to run 12 Prover mode

Honest

Cheating

Eavesdropper view

Off

Round0 / 12

This round—

Rounds passed0 / 0

Cheat-success bound(1/256)⁰ = 1

Prime p2147483647

Generator g7

Public key y=gˣ mod p—

Secret x🔒 known only to Prover

Each round: the Prover picks a random nonce r, sends commitment t=g^r mod p. The Verifier sends a random challenge c. The Prover replies with s=r+c·x mod q. The Verifier accepts iff g^s ≡ t·y^c (mod p). A prover who doesn't know x can only pass by guessing the challenge in advance — probability 1/256 per round, shrinking exponentially over repeated rounds. Real modular arithmetic — open the console to inspect it.

An eavesdropper sees every (t, c, s) below. Because r is a fresh random nonce each round, s = r + c·x mod q is masked by r and looks statistically close to uniform — informally, the transcript alone gives no practical way to extract x. (This is an intuitive illustration, not a formal simulator-based zero-knowledge proof.)

Commitment t (amber) → Challenge c (cyan) → Response s (violet) → Verifier check (green = pass, red = fail)