zero-knowledge

Part 2

Thus, we need a way to "force" Alice to follow the protocol correctly. We will explain in Part 4 precisely how we achieve this. In this post, we focus on explaining the basic tool needed for that — which we call the Knowledge of Coefficient (KC) Test.

The KC Test

The KC Test proceeds as follows:
The Knowledge of Coefficient Assumption[2] (KCA) states that this is always the case, namely:
The KC Test and Assumption will be important tools in Part 4.

What Does "Alice Knows" Mean Exactly?

This is done roughly as follows: We say that, in addition to Alice, we have another party which we call Alice's Extractor. Alice's Extractor has access to Alice's inner state.
[2]This is typically called the Knowledge of Exponent Assumption in the literature, as traditionally it was used for groups written multiplicatively.

Part 4

COPYRIGHT © 2025