Sigma Protocol

Walk through a 3-move Schnorr proof: commit → challenge → response → verify. The prover convinces the verifier they know secret such that c = g^secret mod p, without revealing it.

0. Setup

secret g p

Public key c = g^secret mod p —

1. Prover commits

Prover picks random k, sends r = g^k mod p.

k (private)—

r (sent)—

2. Verifier challenges

Verifier picks random e in [0, p).

e (sent)—

3. Prover responds

Prover sends z = k + e · secret.

z (sent)—

4. Verifier checks

Equation: g^z mod p == r · c^e mod p

LHS = g^z mod p—

RHS = r · c^e mod p—

—