Bean Guy
• 593
• 2
• 7

I was reading the paper PlonK and in the Round 1 of the claim to achieve zero-knowledge by adding random multiples (of degree one) of the polynomial $$Z_H = x^n - 1$$ to the secret polynomials.

Here, $$H$$ is the set containing the $$n$$-th roots of unity and tipically described as $$H = \{\omega, \dots, \omega^{n-1}, \omega^n = 1\},$$ where $$\omega$$ is a primitive $$n$$-th root of unity.

So, the setting is as follows: We have a secret polynomial $$s(x)$$ such that we have to evaluate at some random point $$z \in \mathbb{Z}_p$$, begin $$z$$ and the evaluation $$s(z)$$ publicly known.

To avoid leaking the knowledge of $$s(z)$$, they define: $$s'(x) := (b_1x + b_2)Z_H(x) + s(x),$$ and they claim that this is enough to obtain zero-knowledge of $$s(z)$$.

I have two questions:

1. Why the multiple of $$Z_H(x)$$ has degree one and not, for instance, four or 69? In round 2 of PlonK they use the same strategy, but with another polynomial of degree two. Why?
2. Why is this true? If $$z \in H$$, then clearly $$s'(x)$$ leads information about $$s(x)$$, as $$s'(z) = s(z).$$
edited title
Bean Guy
• 593
• 2
• 7

Bean Guy
• 593
• 2
• 7

# Does the order of this polynomial matter to achieve zero-knowledge? PlonK question

I was reading the paper PlonK and in the Round 1 of the claim to achieve zero-knowledge by adding random multiples (of degree one) of the polynomial $$Z_H = x^n - 1$$ to the secret polynomials.

Here, $$H$$ is the set containing the $$n$$-th roots of unity and tipically described as $$H = \{\omega, \dots, \omega^{n-1}, \omega^n = 1\},$$ where $$\omega$$ is a primitive $$n$$-th root of unity.

So, the setting is as follows: We have a secret polynomial $$s(x)$$ such that we have to evaluate at some random point $$z \in \mathbb{Z}_p$$, begin $$z$$ and the evaluation $$s(z)$$ publicly known.

To avoid the knowledge of $$s(z)$$, they define: $$s'(x) := (b_1x + b_2)Z_H(x) + s(x),$$ and they claim that this is enough to obtain zero-knowledge of $$s(z)$$.

I have two questions:

1. Why the multiple of $$Z_H(x)$$ has degree one and not, for instance, four or 69? In round 2 of PlonK they use the same strategy, but with another polynomial of degree two. Why?
2. Why is this true? If $$z \in H$$, then clearly $$s'(x)$$ leads information about $$s(x)$$, as $$s'(z) = s(z).$$