Zero knowledge proof for a discrete logarithm Say a have a group $G$ chosen as $Z_N^*$ where $N=pq$ and both $p$ and $q$ are safe primes. The algorithm for discrete logarithm is as follows:


Pick $g$ as a random element from $Z_N^*$
Pick $x$ as a random element from $(0, N')$ where ${N' =  p' q'}$ where ${p=2p' + 1}$ and ${q=2q' + 1}$
Evaluate ${y = g^x \: mod \: N}$


For public $y$ and $g$, what is the easiest way to construct ZKP that the prover knows $x$ without revealing it?
This problem was studied in [BCK], and interestingly they showed that constructing a Schnorr-like zero-knowledge proof system (ZKP) in a group of unknown order with non-trivial soundness error is not possible in the plain model (i.e., without CRS). Their result is much more general and talks about homomorphisms in groups of unknown order.

However, if one considers the CRS model, then [BBF] recently showed that ZKP is possible in the generic group model under the "adaptive root" assumption. Boneh talks briefly about this work here.

[BBF]: Boneh, Bünz and Fisch, Batching Techniques for Accumulators with Applications to IOPs and Stateless Blockchains, Crypto 2019

[BCK]: Bangerter, Camenisch and Krenn, Efficiency Limitations for Σ-Protocols for Group Homomorphisms, TCC 2010