[
[
['8','add','hl'],
['9','add','hl'],
['55','add','hl'],
['15','remove','slide-up'],
['2','add','slide-down']
],
[
['21','add','hl'],
['21','remove','hidden'],
['23','add','hl'],
['23','remove','hidden'],
['4','add','hidden'],
['8','remove','hl'],
['8','add','hidden'],
['9','remove','hl'],
['9','add','hidden'],
['55','remove','hl'],
['55','add','slide-left']
],
[
['21','remove','hl'],
['23','remove','hl'],
['21','add','hl'],
['51','add','hl'],
['27','remove','slide-up'],
['15','add','slide-down']
],
[
['52','add','hl'],
['52','remove','slide-left'],
['34','add','hl'],
['34','remove','hidden'],
['21','remove','hl'],
['21','add','hidden'],
['51','remove','hl'],
['51','add','slide-right']
],
[
['52','remove','hl'],
['34','remove','hl'],
['34','add','hl'],
['54','add','hl'],
['39','remove','slide-up'],
['27','add','slide-down']
],
[
['41','remove','hidden'],
['55','add','hl'],
['55','remove','slide-left'],
['34','remove','hl'],
['34','add','hidden'],
['54','remove','hl'],
['54','add','slide-right']
],
[
['55','remove','hl']
]
]
The starting point is $\lib{schnorr-real}$.
We can rearrange things so that $c$ is chosen first.
Now $r$ is essentially a OTP encryption of plaintext $ca$ under key $y$, using a variant of OTP with addition mod $\nmod$. We achieve the same distribution by choosing $r$ uniformly and solving for $y$:
Now $Y$ is computed as $Y = g^y = g^{r-ca} = g^r (g^{ac})^{-1} = g^r (A^c)^{-1}$. By rewriting $Y$ in this way, the private exponent $a$ is no longer needed. The result is $\lib{schnorr-fake}$, completing the proof.
$\lib{schnorr-real}$
$\lib{schnorr-fake}$
$A := g^a$
$y \gets \Z_\nmod$
$Y := g^y$
$c \gets \Z_\nmod$
$y \gets \Z_\nmod$
$r $
${}:= (y+ca) \pct \nmod$
${}\gets \Z_\nmod$
$y := (r - ca) \pct \nmod$
return $(A,Y,c,r)$