A trick that replaces a verifier's random questions with a hash, so a proof becomes a single file anyone can check. It's proven safe only for an imaginary, perfectly random hash.
The idea: In an interactive proof, the verifier keeps the prover honest with unpredictable questions: a cheater can't prepare answers in advance. Fiat-Shamir lets the prover generate those questions by hashing the conversation so far, so changing anything changes the questions. That works as long as the prover can't steer the hash, which is guaranteed for a perfectly random one. The 2025 attack found a way to steer a real one: make the statement being proven compute the hash itself, so the prover can see its own questions coming.
Why it matters: Nearly every zero-knowledge proof used in practice depends on it, and in 2025 researchers forged proofs against one standard design.
The details
On the map: for multi-round proofs, proven only for an idealized hash. A 2025 attack forged GKR-based proofs for any hash, using a crafted circuit
Fiat-Shamir (1986)[1] turns an interactive proof, where a verifier keeps the prover honest with random challenges, into a non-interactive one: the prover computes each challenge as a hash of everything said so far. Almost every practical non-interactive proof is built this way, as are many signatures.
It is proven secure only if the hash behaves like a random oracle[2, 3]. With real hash functions there is no general proof, and there are known failures:
Canetti, Goldreich and Halevi (1998)[4, 5] showed the random-oracle method can fail in principle, and Goldwasser and Kalai (2003)[6] built a secure three-round protocol whose Fiat-Shamir version is insecure for every possible hash. These examples were contrived.
In 2025 Khovratovich, Rothblum and Soukhanov[7] showed a practical attack on a standard GKR-based succinct argument: for any chosen hash, they build a circuit that evaluates the hash itself, and a convincing proof of a false statement about it.
In practice the common failure is "weak Fiat-Shamir": leaving some public inputs out of the hash. It let attackers fake proofs in the Helios voting system (2012)[8] and in several PlonK and Bulletproofs implementations (Trail of Bits' Frozen Heart disclosures, 2022)[9].
This box covers multi-round proof systems, where the risk is real. The FS tag marks what depends on it. Signatures built with Fiat-Shamir from simple three-move protocols (Schnorr, EdDSA, ML-DSA, SQIsign) are the well-understood case, shown with the ROM tag instead. For specific protocols Fiat-Shamir can be proven secure with special hash functions built from LWE (2019)[10, 11], but those aren't the hashes used in practice.
Amos Fiat and Adi Shamir. How To Prove Yourself: Practical Solutions to Identification and Signature Problems. Advances in Cryptology — CRYPTO’ 86, 1986. doi:10.1007/3-540-47721-7_12
David Pointcheval and Jacques Stern. Security Arguments for Digital Signatures and Blind Signatures. Journal of Cryptology, 2000. doi:10.1007/s001450010003
Eli Ben-Sasson, Alessandro Chiesa and Nicholas Spooner. Interactive Oracle Proofs. Theory of Cryptography, 2016. doi:10.1007/978-3-662-53644-5_2
Ran Canetti, Oded Goldreich and Shai Halevi. The random oracle methodology, revisited (preliminary version). Proceedings of the thirtieth annual ACM symposium on Theory of computing - STOC '98, 1998. doi:10.1145/276698.276741
Ran Canetti, Oded Goldreich and Shai Halevi. The random oracle methodology, revisited. Journal of the ACM, 2004. doi:10.1145/1008731.1008734
S. Goldwasser and Y.T. Kalai. On the (In)security of the Fiat-Shamir paradigm. 44th Annual IEEE Symposium on Foundations of Computer Science, 2003. Proceedings.. doi:10.1109/sfcs.2003.1238185
Dmitry Khovratovich, Ron D. Rothblum and Lev Soukhanov. How to Prove False Statements: Practical Attacks on Fiat-Shamir. IACR Cryptology ePrint Archive, Paper 2025/118. eprint.iacr.org/2025/118
David Bernhard, Olivier Pereira and Bogdan Warinschi. How Not to Prove Yourself: Pitfalls of the Fiat-Shamir Heuristic and Applications to Helios. Advances in Cryptology – ASIACRYPT 2012. doi:10.1007/978-3-642-34961-4_38
Ran Canetti, Yilei Chen, Justin Holmgren et al. Fiat-Shamir: from practice to theory. Proceedings of the 51st Annual ACM SIGACT Symposium on Theory of Computing, 2019. doi:10.1145/3313276.3316380
Chris Peikert and Sina Shiehian. Noninteractive Zero Knowledge for NP from (Plain) Learning with Errors. Advances in Cryptology – CRYPTO 2019. doi:10.1007/978-3-030-26948-7_4