Prove you know a secret.
Without revealing the secret.

// Add to Cargo.toml: sha2 = "0.10", rand = "0.8"
use sha2::{Sha256, Digest};
use rand::Rng;

// A salted commitment. The foundation of ZK protocols:
// commit to a value now, prove you knew it later, without
// revealing it early.
struct Commitment {
    hash: [u8; 32], // published
    salt: [u8; 32], // secret until reveal
}

fn commit(secret: &[u8]) -> Commitment {
    // Salt defeats brute force on the commitment. Without it,
    // SHA-256(42) is guessable; SHA-256(salt || 42) is not.
    let salt: [u8; 32] = rand::thread_rng().gen();
    let mut h = Sha256::new();
    h.update(salt);
    h.update(secret);
    Commitment { hash: h.finalize().into(), salt }
}

fn reveal_and_verify(c: &Commitment, secret: &[u8]) -> bool {
    let mut h = Sha256::new();
    h.update(c.salt);
    h.update(secret);
    let computed: [u8; 32] = h.finalize().into();
    computed == c.hash
}

// Coin flip over the internet, with no trusted party.
// Alice commits before Bob reveals, so neither can bias it.
fn fair_coin_flip() {
    let alice: u8 = rand::thread_rng().gen_range(0..=1);
    let c = commit(&[alice]);          // Alice commits first

    let bob: u8 = rand::thread_rng().gen_range(0..=1); // Bob announces

    assert!(reveal_and_verify(&c, &[alice])); // Alice reveals, Bob checks
    let result = alice ^ bob;          // XOR of two fair bits is fair
    println!("Alice: {}, Bob: {}, Result: {}", alice, bob, result);
}

/* Compile: gcc commit.c -o commit -lssl -lcrypto */
#include <openssl/sha.h>
#include <openssl/rand.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>

typedef struct {
    uint8_t hash[32]; /* published commitment */
    uint8_t salt[32]; /* secret until reveal   */
} Commitment;

Commitment commit(const uint8_t *secret, size_t len) {
    Commitment c;
    RAND_bytes(c.salt, 32);
    SHA256_CTX ctx;
    SHA256_Init(&ctx);
    SHA256_Update(&ctx, c.salt, 32);
    SHA256_Update(&ctx, secret, len);
    SHA256_Final(c.hash, &ctx);
    return c;
}

int verify_commitment(const Commitment *c,
                      const uint8_t *secret, size_t len) {
    uint8_t computed[32];
    SHA256_CTX ctx;
    SHA256_Init(&ctx);
    SHA256_Update(&ctx, c->salt, 32);
    SHA256_Update(&ctx, secret, len);
    SHA256_Final(computed, &ctx);
    return memcmp(computed, c->hash, 32) == 0;
}

/* The Schnorr identification protocol: an interactive ZK
 * proof that Peggy knows x where Y = x*G, without showing x.
 *   Round 1: Peggy sends R = k*G for random k.
 *   Round 2: Victor sends a random challenge c.
 *   Round 3: Peggy sends s = k + c*x mod n.
 *   Verify : s*G == R + c*Y.
 * Victor learns that Peggy knows x, and nothing about x. */
void schnorr_zk_concept(void) {
    printf("Peggy publishes Y = x*G\n");
    printf("R1 Peggy:  R = k*G (random k)\n");
    printf("R2 Victor: challenge c (random)\n");
    printf("R3 Peggy:  s = k + c*x mod n\n");
    printf("Verify:    s*G == R + c*Y\n");
    printf("A cheater passes with probability ~1/n.\n");
    printf("Victor learns zero information about x.\n");
}