No fixed-construction reduction from Fiat-Shamir to NIZK

Conditional · against fixed-construction reductions · assuming collision resistance · GK03

Statement

If collision-resistant hash functions exist, the Fiat–Shamir transform of GK03’s 3-round public-coin protocol is unsound for every efficient hash function, so the transform does not in general compile interactive arguments into sound non-interactive ones in the standard model — GK03. What fails is soundness, not zero knowledge; the counterexample is an argument, not a proof. Non-interactive arguments built by other means are not ruled out.

Notes

• GK03’s protocol is contrived; Fiat–Shamir applied to the standard GKR-based succinct argument is also unsound, for explicit circuit families and every hash function — KRS25 (No fixed-construction reduction from Fiat-Shamir + GKR to SNARK).
• Read against signatures, the same counterexample gives No fixed-construction reduction from Fiat-Shamir + Hash function to DS — GK03.