Security, Zero Knowledge Proofs, Snark, Cryptography, Research.
(namely it is assumed to be a computationally hard problem to compute the witness w given x=gʷ), thus violating the weak soundness property. In other words we reduce the protocol soundness to the discrete log problem with help of the extractor E. Figure 4: Illustration of the simulation run during