In part 2 , we saw how Alice can blindly evaluate the hiding $E(P(s))$ of her polynomial $P$ of degree $d$, at a point $s$ belong to Bob. We called this "blind" evaluation because Alice did not learn $s$ in the process.

However, there was something missing in that protocol — the fact that Alice is able to compute $E(P(s))$ does not guarantee she will indeed send $E(P(s))$ to Bob, rather than some completely unrelated value.

Thus, we need a way to "force" Alice to follow the protocol correctly. We will explain in Part 4 precisely how we achieve this. In this post, we focus on explaining the basic tool needed for that — which we call the Knowledge of Coefficient (KC) Test.

As before, we denote by $g$ a generator of a group $G$ of order $|G|=p$ where the discrete log is hard. It will be convenient from this post onwards to write our group additively rather than multiplicatively. That is, for $\alpha \in \mathbb{F}_p$, $\alpha \cdot g$ denotes the result of summing $\alpha$ copies of $g$.

The KC Test

For $\alpha \in \mathbb{F}_p^*$[1], let us call a pair of elements $(a, b)$ in $G$ an $\alpha$-pair if $a, b \neq 0$ and $b = \alpha \cdot a$.

The KC Test proceeds as follows:

• Bob chooses random $\alpha \in \mathbb{F}_p^*$ and $a \in G$. He computes $b = \alpha \cdot a$.
• He sends to Alice the "challenge" pair $(a, b)$. Note that $(a, b)$ is an $\alpha$-pair.
• Alice must now respond with a different pair $(a^{'}, b^{'})$ that is also an $\alpha$-pair.
• Bob accepts Alice's response only if $(a',b')$ is indeed an $\alpha$-pair. (As he knows $\alpha$ he can check if $b' = \alpha \cdot a')$.

Now, let's think about how Alice could successfully respond to the challenge. Let's assume for a second that she knew $\alpha$. In that case, she could simply choose any $a^{'}$ in $G$, and compute $b^{'} = \alpha \cdot a^{'}$; and return $(a^{'}, b^{'})$ as her new $\alpha$-pair.

However, as the only information about $\alpha$ she has is $\alpha \cdot a$ and $G$ has a hard discrete log problem, we expect that Alice cannot find $\alpha$. So, how can she successfully respond to the challenge without knowing $\alpha$?

Here's the natural way to do it: Alice simply chooses some $\gamma \in \mathbb{F}_p^*$, and responds with $(a',b') =$ $(\gamma \cdot a, \gamma \cdot b)$. In this case, we have:

$b'=$ $\gamma \cdot b =$ $\gamma \alpha \cdot a =$ $\alpha (\gamma \cdot a) =$ $\alpha \cdot a'$,

so indeed $(a^{'}, b^{'})$ is an $\alpha$-pair as required.

Note that if Alice responds using this strategy, she knows the ratio between $a$ and $a^{'}$. That is, she knows the coefficient $\gamma$ such that $a^{'} = \gamma \cdot a$.

The Knowledge of Coefficient Assumption[2] (KCA) states that this is always the case, namely:

KCA: If Alice returns a valid response $(a^{'}, b^{'})$ to Bob's challenge $(a, b)$ with non-negligible probability over Bob's choices of $a, \alpha$, then she knows $\gamma$ such that $a^{'} = \gamma \cdot a$.

The KC Test and Assumption will be important tools in Part 4.

What Does "Alice Knows" Mean Exactly?

You may wonder how we can phrase the KCA in precise mathematical terms; specifically, how do we formalize the notion that "Alice knows $\gamma$" in a mathematical definition?

This is done roughly as follows: We say that, in addition to Alice, we have another party which we call Alice's Extractor. Alice's Extractor has access to Alice's inner state.

We then formulate the KCA by saying that whenever Alice successfully responds with an $\alpha$-pair $(a^{'}, b^{'})$, Alice's Extractor output $\gamma$ such that $a^{'} = \gamma \cdot a.$[3]