Practical consequences of a honest-verifier zero-knowledge of the Schnorr protocol Schnorr protocol is known to be honest-verifier zero-knowledge and not perfectly zero-knowledge.  

What are the practical consequences of this fact? Does it mean a dishonest verifier can do something to discover the secret exponent $x$?

Setup


$P$ chooses a large prime $p$ and a generator $g$ of the $q$ order subgroup of $\mathbb Z_p^*$.
$P$ chooses a secret $x \leftarrow_{uniform} \mathbb Z_q^*$, computes $y = g^x$ and gives $y$ to $V$.


Protocol


$P$ chooses $r \leftarrow_{uniform} \mathbb Z_q^*$, computes $t = g^r$ and sends $t$ to $V$
$V$ chooses $c \leftarrow_{uniform} \mathbb Z_q$ and sends it to $P$
$P$ computes $s = r + cx$ and sends $s$ to $V$
$V$ verifies that $g^s = ty^c$.
By definition, a dishonest verifier may be able to completely extract the witness from an honest-verifier ZK proof.

To prove this: take any zero-knowledge proof, and add an initial round where the verifier sends 1 to the prover. The prover then works as follows: if it receives 1 then it runs the original zero-knowledge proof; if it receives 0 then it sends the witness.

The above proof is clearly honest-verifier zero-knowledge, but a dishonest verifier can learn the witness by sending 0.

Typically, the point of an honest-verifier zero-knowledge proof is that it can be "compiled" into a (full) zero-knowledge proof without much difficulty. 

Having said the above, some honest-verifier zero-knowledge proofs already have stronger properties like witness indistinguishability. This makes no sense for Schnorr itself since there is only one witness, but I believe that the standard Diffie-Hellman tuple sigma protocol is witness indistinguishable (I would want to write a proof to be 100% sure but I'm nearly sure).