# Proof of Zero Knowledge Groth16

I understand that in the non-interactive linear form (page 15 of Groth16: https://eprint.iacr.org/2016/260.pdf), given $$A$$ and $$B$$ in the proof $$(A,B,C)$$, the simulator can compute the $$C$$ by: $$C =\frac{AB-\alpha\beta-D}{\delta}$$ where $$D = \sum^{l}_{i=0} {a_i(\beta u_i(x) + \alpha v_i(x) + w_i(x))}$$.

However, I don't get how the simulator would work when the scheme is compiled to SNARK.Here, when all keys are raised to power form, we have: $$e(A,B) = e(C, g^\delta) e(g^\alpha, g^\beta) e(D, g)$$. I see that $$e(C, g^\delta) = e(A,B)/(e(g^\alpha, g^\beta) e(D, g))$$, but how could the simulator extract the $$G_1$$ element $$C$$ from the $$G_t$$ element $$e(C, g^\delta)$$?

The simulator would not generate random elements of $$\mathbb G_T$$, but would as before generate uniform random values $$A,B\in\mathbb Z/p\mathbb Z$$ and compute $$C$$ per your equation. They would then SNARK-ify these numbers by $$[A]=g^A\in\mathbb G_1$$, $$[B]=h^B\in\mathbb G_2$$ and $$[C]=g^C\in\mathbb G_1$$ per the bottom of page 6 (note that these SNARK-ified elements are all uniformly distributed in their respective groups).

The equation $$e([A],[B])=e([C],h^\delta) e(g^\alpha,h^\beta)e(g,h)^D$$ would then automatically be true by the bilinearity property of $$e$$.

• Many thanks for the response. What's intriguing to me is that: why would one allow the simulator to know the trap door (the toxic values such as the $\delta$ - shouldn't they be "forgotten" by the set up process)? In another word, why would the scheme allow the simulator to be "super-power" like a set-up?
– Sean
Jun 14, 2022 at 16:59
• I don't think of values such as $\delta$ as "toxic" values; they're provided to verifiers as part of $\mathbf\sigma$ and I think of verifier information as public. Jun 14, 2022 at 17:08
• But on page 17 0f Groth16 (eprint.iacr.org/2016/260.pdf), the trapdoor $\tau$ is defined as $\tau = (\alpha, \beta, \gamma, \delta, x)$. The verifier key $\sigma$ is raised to power in group $G_1$ and $G_2$. I don't think the $\delta$ is visible to verifier (i.e., the verifier can only see $g^\delta$), if I'm understanding it right.
– Sean
Jun 15, 2022 at 1:43
• Apologies, you are correct. Providing the simulator with $\tau$ is part of the defined rules of section 2.2; I would interpret this as the simulator being able to come up with the exact same proof if exactly the same blinding values were chosen at random. Jun 15, 2022 at 5:46
• Thanks again for clarification!
– Sean
Jun 15, 2022 at 14:28