 Fiat-Shamir transform

The Fiat-Shamir transform replaces a verifier's random challenge in a suitable interactive proof protocol by a cryptographic hash function of the public statement and transcript so far. For a commitment $a$ about statement $x$, the prover computes $c=H(x,a)$ and then a response $z$. A verifier recomputes $c$ and checks the response. In signature applications the message is also bound into the hashed transcript.

This removes an interaction, but hashing an arbitrary protocol is not automatically secure: the protocol structure, transcript encoding and security model matter. CRYSTALS-Dilithium uses a version with aborts, discarding unsuitable responses through rejection sampling so that released responses have the required distribution. This illustrates how the transformation and its concrete implementation need separate arguments.^[ref]