verifier commits a random string of the same length using statistically hiding commitment
prover sends random string of the same length
verifier opens the commitments
the xor of the commited bits and the prover's string is used as the shared random string
The problem with using this for NIZK proofs of knowledge is that the
above protocol is not (at least not obviously) simulable for the prover.
Is there a known concrete obstacle to being able to establish
a Shared Random String for NIZK proofs of knowledge?
(For example, showing that such a protocol can't be black-box zero knowledge?)
If no, is there a plausible computaional assumption that is known to suffice for doing so?