It's a beautiful piece of theory, but when the IACR tried to build a voting scheme based on that to elect their board annually (<a href="https://vote.heliosvoting.org/" rel="nofollow">https://vote.heliosvoting.org/</a>), they got caught by a non-obvious bear trap when you make the whole thing non-interactive (which is the way this is mostly used in practice).<p>Details here: <a href="https://eprint.iacr.org/2016/771" rel="nofollow">https://eprint.iacr.org/2016/771</a><p>Basically, if you do this with a hash function, you need to HASH ALL THE THINGS, not just some of them.<p>As to why this paper keeps showing up without everyone knowing that they're using it: the result in this paper is not, to my knowledge, a new invention of Maurer, rather it's something that everyone working with Sigma protocols more or less knew at the time, but no-one had written it down in its generality (or at least, no-one else got a paper on that accepted; some reviewers might have rejected such a paper as not novel enough). You'll note that Maurer itself got the paper into AFRICACRYPT 2009, which is not quite in the same league as CRYPTO and friends - for example, <a href="https://sites.google.com/site/conferenceranking/" rel="nofollow">https://sites.google.com/site/conferenceranking/</a> calls it "unranked", and the CORE ranking page doesn't seem to list it either.<p>It's a neat little result and it's very useful to be able to cite, but it's not ground-breaking.