Appropriate Zero-Knowledge Proof Schemes

The definition assumes that one party has to generate a value K (usually some sort of key — in the present application the prekey) with a certain probability distribution Corr (for correct ) and needs a generation algorithm gen for this task, and another party wants to be convinced that K is an element of a set Good. The first party is called the prover, the second party the verifier. More precisely, both the distribution and the set are parametrized with security parameters, and there is a precondition that all values generated with the correct distribution are elements of Good. 

Definition 7.25 (Zero-knowledge proof scheme with generation algorithm, goodness predicate, and external verifiability). Let a pair (CorrFam, GoodFam) be given where 

It would not help if the prover executed a proof with each observer, because a cheating prover could give some of them acceptable proofs and others not. Then, as nobody is globally trusted, one cannot take consistent measures, because either the prover can be lying or those observers who say they did not obtain an acceptable proof. 

Informally, K is the value that had to be generated originally, and aux is an auxiliary value that will help the prover to convince the verifier. 

Informally, this is the algorithm for the person who generated a value K with gen and now wants to convince someone that K is good. 

---