Perfect zero knowledge for the Schnorr protocol? Can somebody explain (or point to a reference) why the Schnorr protocol cannot be proved zero knowledge?
Schnorr can be proven zero knowledge when the challenge $e$ is restricted to a small set (typically $0$ and $1$).

Recall that in the Schnorr protocol, the prover knows the logarithm $u$ of $y$ to base $g$. He chooses a random value $r$, computes $a = g^r$ and sends $a$ to the verifier. The verifier chooses a random challenge $e$ from some set and sends it to the prover. The prover computes $z = r + ue$ and sends it to the verifier. The verifier checks that $g^z = a y^e$.

Remember, (informally) a protocol is zero knowledge if for any verifier $V^*$ there exists a simulator that can create conversations with the same distribution as conversations between the honest prover and $V^*$.

Proof sketch: Our simulator chooses $z$ uniformly at random and guesses what challenge $V^*$ will issue. Based on the guess $e$, it computes its initial message $a$ as $g^z y^{-e}$. If $V^*$ chooses $e$ as its challenge, the simulator has the correct response and has created a challenge with the correct distribution. It is a fairly easy exercise to prove that it succeeds with probability $1/2$, when $V^*$ is restricted to respond with $0$ or $1$.

So Schnorr is zero knowledge when the challenge space is small (so that we can guess the challenge with significant probability), but Schnorr is also not very useful when the challenge space is small, since you need to run the protocol many times to be sure that the prover really knows the secret.

When the challenge space is large, the above simulator fails. I can't remember a proof that there cannot be a different simulator that succeeds, but no such simulator is known. Which means that while we cannot say that Schnorr is zero knowledge. On the other hand, as far as I know, we cannot say that it is not zero knowledge.

There are alternative notions of zero knowledge, e.g. honest verifier zero knowledge. We can prove that Schnorr satisfies these notions even when the challenge set is large, and for many applications this is sufficient. E.g. in the random oracle model, we can get non-interactive zero knowledge via the Fiat-Shamir heuristic. There are also constructions for converting honest verifier zero knowledge to zero knowledge.