Non-trivial examples of a system being a zero-knowledge proof system but not zero-knowledge proof of knowledge It got me confused these days when I encountered the notions of zero-knowledge proofs (ZKP) and zero-knowledge proofs of knowledge (ZKPoK). As far as I know, the two terms are not the same, but all the ZKP systems I know so far also happen to be ZKPoK systems. 

Can anyone tell me if there is any non-trivial example of a system being a zero-knowledge proof system but not zero-knowledge proof of knowledge, and vice versa?
At first, every ZKPoK protocol is ZKP protocol. This is obvious: if you proved that you know a witness, therefore a witness exists, therefore the statement belongs to the language.

The interesting question is whether a protocol exists which is ZKP but not ZKPoK.
It holds for trivial languages, but you're justly not satisfied with this.
My idea in a discrete log settings, similar to Schnorr protocol, is the following:
 take a protocol proving the equality of the discrete logarithms of $y_1$, $y_2$ to 
bases $g, h \in G$,
i.e. for a language $\{ g||h||y_1||y_2 : \exists w, y_1 = g^w \land y_2 = h^w  \}$,
where $w\in Z_q$ is a witness. $G$ is cyclic group here.

The classical Schnorr-like protocol for that is the following:


Prover chooses $k\in Z_q$, calculates $C_1=g^k, C_2=h^k$ and sends $C_2, C_2$ to Verifier.
Verifier chooses $e\in Z_k$ and sends it to Prover.
Prover calculates $r = k + ew$ and sends it to Verifier.
Verifier checks: $C_1 y_1^e = g^r$ and $C_2 y_2^e = h^r$.


You can easily build knowledge extractor E which will extract $w$ (just the same as in Schnorr protocol), so this is clearly ZKPoK protocol for a language $L_1 = \{ g||h||y_1||y_2 : \exists w, y_1 = g^w \land y_2 = h^w  \}$.

But, notice that this is also a ZKP for a language $L_2 = \{ g||h||y_1||y_2 : \exists v, h = g^v \land y_2 = y_1^v \}$.
The language is actually the same ($L_1 = L_2 = L$), but it's defined through another witnesses.
And knowing a witness $w$ doesn't help you to find witness $v$.
So, this protocol is not a ZKPoK for $L_2$, while it's ZKP for it.

The trick we did here is in the following. We have a language which could be 
independently defined by two types of witnesses. You can use say the witness of the first type to provide a proof, but you could not know the witness of the second type. You can say that it's just a trick and this protocol is still a ZKPoK, just for another type of witness. You're right, but this trick is inevitable: if a prover can provide a proof, and the language is not trivial,
the prover necessarily knows something special (otherwise, anybody can conduct such proofs for himself, and language becomes trivial! ).
And this special thing is a witness! But, this could be another type of witness,
not that one which you initially supposed. This is a core idea of the trick.

WARNING: this is an improvisation and I'm not 100% sure in this, so please wait for endorsement of other people.