Skip to main content
1 of 4
meshcollider
  • 1.6k
  • 1
  • 11
  • 14

I cannot find that specific example $x^3 − 7x^2 + 12x$ in the linked document. But I think you have somewhat answered your own question here:

Here the Prover knows a polynomial of degree 3, 2 of the solutions of the polynomial are 3 & 4. He has to prove to the verifier he knows such a polynomial without revealing to the verifier the 3rd solution.

This is exactly what he is trying to prove here - that he knows a degree 3 polynomial, which has solutions 3 and 4. Proving knowledge of such a polynomial is not specific to one single polynomial - there are multiple such degree-3 polynomials with roots 3 and 4. All the proof does is prove knowledge of one of them.

If prover doesn't know the actual polynomial (i.e. $x^3 − 7x^2 + 12x$) but just picks some random 3rd solution - i.e. $x = 2$ & he goes ahead with the above protocol steps as described, it will still verify with the verifier.

This is because knowledge of a protocol is the same as knowledge of its roots - the only degree-3 polynomial with the roots 3, 4, and 2 is $(x-2)(x-3)(x-4)$. So the prover is still proving that they know a degree-3 polynomial with roots 3 and 4, even if it isn't $x^3 − 7x^2 + 12x$. In that case they "know" the polynomial $(x-2)(x-3)(x-4)$ instead.

meshcollider
  • 1.6k
  • 1
  • 11
  • 14