Prover uses predictable coins? (e.g. does not change coins)
In principle, Diffie-Hellman and Schnorr protocols can be defined
for any group, not just Z_{p}^{*}.
Describe how these protocols would look if Z_{p}^{+}were used instead. Is it a good idea to use this group? Why or why
not (be very specific and formal)
How about Z_{n}^{*} for some n=pq
for two large primes p,q?
[in fact, in cryptography we do commonly use groups other than Z_{p}^{*}
- they are defined using
elliptic curves]