Tricking the Schnorr's protocol

Question

From the lecture notes I have learned the following:

• $P \rightarrow V$: $T=g^t$ ($t$, randomly chosen from $Z_q$)
• $P \leftarrow V$: $c$ (randomly chosen from $Z_q$)
• $P \rightarrow V$: $s=xc+t \mod q$
• $V$ accepts if $g^s=A^cT$, (where $A=g^x$)

Question: Can $P$ instead of sending $g^s$ send directly $A^cT$?

In other words, $P$ has all it need to generate $A^cT$ which is the same as $g^s$. Can someone explain what I am seeing wrong?

Answer 1

Well yes, $P$ can generate $A^cT$ and send it over, but why would it help?

The point of this protocol is that $P$ proofs to $V$ that it knows $x$, without revealing anything about $x$. The way that $P$ does this is that given some randomly chosen $t$ and a challenge $c$, it can compute an $s$ such that $g^s=A^cT$. The fact that $P$ can compute this $s$ proves knowledge of $x$ (note that $s=xc+t$). Anyone that does not know $x$, cannot compute $s$ (assuming some hard problem).

On the other hand, anyone can compute $A^cT$ given $A,c,T$, so this does not prove anything about knowledge of $x$.