What is the benefit of zero knowledge identification (Fiat Shamir) over a standard digital signature? Let's say there is a public key $v$.
Peggy has to prove to Victor that she has the corresponding private key $a$. Of course she doesn't want to disclose $a$ to Victor, but just to prove that she has the key.
Question: What is the benefit of &quot;Solution 2&quot; described below (a.k.a. Fiat-Shamir), which seems more complex and using zero knowledge proofs, when there is an easy solution (see Solution 1)?
Solution 1 (easy):

Victor generates a random number $r$, encrypts it with the public key $v$, and sends the encrypted message $r_E$ to Peggy
If Peggy has the private key $a$, she can decrypt $r_E$ into $r$, and send $r$ back to Victor and claim: &quot;Hey Victor, here is $r$, this is the proof I can decrypt your message $r_E$, so this proves I have $a$&quot;
If Peggy doesn't have the private key $a$, she cannot decrypt $r_E$, so she cannot prove anything.

I don't know the name of this simple scheme, but I think this can be done with nearly any public/private key encryption algorithm, and it seems safe.
Solution 2 (Fiat-Shamir, interactive zero knowledge proof):

$a$ is the private key, $v = a^2 \pmod n$ is the public key

Peggy generates a random number $r$ and sends $x=r^2 \pmod n$ to Victor

Victor sends 0 or 1 (randomly) to Peggy

If Peggy receives 0, she has to send $r$ to Victor (he can then check if $r^2$ is $x$ modulo $n$)
If Peggy receives 1, she has to send $y = r \times a \pmod n$ to Victor (he can then check if $y^2 \times v^{-1}$ is $x$ modulo $n$)

Repeat from step 2 at least $k$ times: the higher $k$ the smaller the probability ($2^{-k}$) of passing the test succesfully without actually knowing $a$


What is the benefit of complex Solution 2 when you can just do Solution 1?
Solution 1 has some weakness when the verifier is malicious. If the prover's private key $a$ is used for decryption, Solution 1 provides the verifier with a decryption oracle, i.e., a malicious verifier can decrypt any ciphertext encrypted with the public key $v$. On the other hand, Solution 2 reveals nothing about the private key $a$ because the random number $r$ (which masks the private key $a$ when the verifier sends a bit 1) is chosen by the prover rather than the verifier.