How does `d-KCA` help secure the zcash protocol?

Question

I have been going back and forth between part 2 and part 4 of the Explaining SNARKs series.

• In part 2, it is claimed that Bob has an idea about the polynomial and want to test whether Alice knows it by sending her $(g, s.g, ..., s^d.g)$ and checking the answer $P(s).g$.

• In part 4, it is claimed that now Alice return 2 polynomials $a' = P(s).g$ and $b'=\alpha P(s).g$ computed from $(g, s.g, ..., s^d.g)$ and $(\alpha.g,\alpha s.g, ..., \alpha s^d.g)$. But now Bob only check that $b'=\alpha.a'$ and that if it is the case then Alice knows with high probability $(c_0,...,c_d)$.

My question: What is the use of the d-KCA knowing that:

• If Bob knows $P$ and the probability that Alice answers correctly without using P is very low, then the verifiability is ensured already.

• If in the d-KCA, Alice sends back $a'=\beta .g$ and $b'=\beta \alpha .g$, we have $b'=\alpha . a'$. So if Bob only check that equality he can be fooled.

I am really wondering what I am missing...

Answer 1

Two points:

• Bob does not know $P$ which is partly the point of the protocol.
• Alice could respond with the $\alpha$-pair $(a',b') = (\beta g, \alpha\beta g)$, there is nothing wrong with that. This implies that her coefficients are $c_0=\beta, c_i=0$ for $i>1$.

However, this will only do her any good if her coefficients $(c_0, \cdots, c_d)$ actually present a solution to the QAP.

Answer 2

All it proves is that Alice used ( g , s . g , . . . , s d . g ) and ( α . g , α s . g , . . . , α s d . g ) in the same linear combination.

Additional tests (explained later in their tutorial or this tutorial here) are required to ensure that the linear combination she resulting from a valid solution for our QAP