# Jointly Establishing a Shared Random String for NIZK proofs of knowledge

If OWFs exist, then a Shared Random String for
NIZK proofs (of membership) can be established by:

verifier commits a random string of the same length using statistically hiding commitment
prover sends random string of the same length
verifier opens the commitments
the xor of the commited bits and the prover's string is used as the shared random string

The problem with using this for NIZK proofs of knowledge is that the
above protocol is not (at least not obviously) simulable for the prover.

Is there a known concrete obstacle to being able to establish
a Shared Random String for NIZK proofs of knowledge?
(For example, showing that such a protocol can't be black-box zero knowledge?)

If no, is there a plausible computaional assumption that is known to suffice for doing so?

• That certainly seems to work. $\:$ (Unless someone else gives a better answer, $\hspace{1.6 in}$ I'll be accepting and upvoting this.) $\;\;$ – user6973 Mar 22 '12 at 17:39