Schnorr protocol is witness-hiding? Regular 3-steps Schnorr protocol is a proof of knowledge system for discrete logarithm.
It's honest-verifier zero-knowledge,
but not full zero-knowledge.
My question is, is it witness-hiding?
(I guess it should be the most important property in many cases,
rather than too strong and not required ZK, and too weak HVZK).
I found the answer:
Schnorr protocol is witness-hiding - proved in GGM model in https://www.shoup.net/papers/dlbounds1.pdf (as part of proof that Schnorr identification protocol is secure).

At the same time, it's not possible to prove it in standard model based on discrete-log problem: http://www.cs.cornell.edu/~rafael/papers/schnorr.pdf