= Fiat-Shamir transform
The <Fiat-Shamir transform> replaces a verifier's random challenge in a suitable interactive proof protocol by a <cryptographic hash function> of the public statement and transcript so far. For a commitment $a$ about statement $x$, the prover computes $c=H(x,a)$ and then a response $z$. A verifier recomputes $c$ and checks the response. In signature applications the message is also bound into the hashed transcript.
This removes an interaction, but hashing an arbitrary protocol is not automatically secure: the protocol structure, transcript encoding and security model matter. <CRYSTALS-Dilithium> uses a version with aborts, discarding unsuitable responses through <rejection sampling> so that released responses have the required distribution. This illustrates how the transformation and its concrete implementation need separate arguments.<Dilithium documentation by CRYSTALS project>[Scientific Background, Fiat-Shamir with Aborts and sampling]{ref}
Back to article page
