On Σ-protocols

Let p be a prime, q a prime divisor in p−1, and g an element of order q in Z∗ p . Suppose a prover P has chosen w in Zq at random and has published h = gw mod p. A verifier V who gets p, q, g, h can check that p, q are prime, and that g, h have order q. Since there is only one subgroup of order q in Z∗ p , this automatically means that h ∈< g >, i.e. there exists w such that h = gw. But this does not necessarily mean that P knows such a w. The following protocol suggested by Schnorr gives a very efficient way to convince V about this: