zkSnarks: Why does the target polynomial $t(s)$ need to be kept a secret if it's known to both prover & verifier?

Question

I am reading this explanation of zkSnark written by Maksym Petkus - http://www.petkus.info/papers/WhyAndHowZkSnarkWorks.pdf

The example used here is that there is a polynomial of degree 3 which the verifier knows has roots 1 & 2.

• The whole polynomial is $p(x)$

• The target polynomial $t(x) = (x-1)(x-2)$.

• The 3rd root comes from $h(x)$, i.e. if 3rd root is 3, then $h(x) = (x-3)$.

• And $p(x) = h(x). t(x)$.

So it seems the secret here that the prover proves to the verifier is his knowledge of $h(x)$

However, deep into the tutorial, in Section 3.6, where the author adds Non-Interactivity to the protocol, he says the following

Till this point, we had an interactive zero-knowledge scheme. Why is that the case? Because the proof is only valid for the original verifier, nobody else (other verifiers) can trust the same proof since:

• the verifier could collude with the prover and disclose those secret parameters $s$, $\alpha$ which allows to fake the proof, as mentioned in remark 3.1

• the verifier can generate fake proofs himself for the same reason

• verifier have to store $\alpha$ and $t(s)$ until all relevant proofs are verified, which allows an extra attack surface with possible leakage of secret parameters

I understand how $\alpha$ is a secret & needs to be protected but why does $t(s)$ need to be protected - in the interactive version, it was something known by both the prover & verifier, so why while adding Non-Interactivity to the protocol does $t(s)$ suddenly become a secret?

Answer 1

While the polynomial $t(x)$ itself is known, the specific evaluation at $s$, $t(s)$, is not known.

In the interactive version, the prover computes $g^p$ and $g^h$ in "encrypted space" as the paper calls it, by using the "encrypted" powers of $s$.

The verifier then uses $t(s)$ to check that $g^p = g^{h \cdot t(s)}$, implying $p(x) = h(x) \cdot t(x)$ with high probability.

Because $t(x)$ is known, if $t(s)$ was also known, $s$ could be recovered. This is because the polynomial $t(x) - t(s)$ has $s$ as a root, by definition. Any algorithm that computes roots of polynomials modulo $q$, for example the Cantor–Zassenhaus algorithm, could be used to find $s$. Thus, $t(s)$ must be kept secret.

In order to do so, we also encrypt $t(s)$ giving $g^{t(s)}$, and then use a bilinear pairing to perform the multiplication in the exponent of $g$.