Jointly Establishing a Shared Random String for NIZK proofs of knowledge If OWFs exist, then a Shared Random String for

NIZK proofs (of membership) can be established by:

verifier commits a random string of the same length using statistically hiding commitment

prover sends random string of the same length

verifier opens the commitments

the xor of the commited bits and the prover's string is used as the shared random string

The problem with using this for NIZK proofs of knowledge is that the

above protocol is not (at least not obviously) simulable for the prover.



  Is there a known concrete obstacle to being able to establish
  
  a Shared Random String for NIZK proofs of knowledge?
  
  (For example, showing that such a protocol can't be black-box zero knowledge?)


If no, is there a plausible computaional assumption that is known to suffice for doing so?
I'm not sure the solution you have given works.

However, it can be adapted to work -- both for NIZK proofs and proofs of knowledge -- by using a coin-tossing protocol where "secure" here means in the sense of general secure two-party computation. This can be done based on one-way functions in polynomially many rounds, or based on stronger assumptions in constant rounds.

A good reference is Lindell's paper on coin tossing.