I am reading this explanation of zkSnarks written by Maksym Petkus - http://www.petkus.info/papers/WhyAndHowZkSnarkWorks.pdf
My question is about Section 4.6.1
Setup
- construct the respective operand polynomial $l(x)$ with corresponding coefficients
- sample random $\alpha$ and $s$
- set proving key with encrypted $l(s)$ and it's "shifted" pair: $(g^{l(s)}, g^{{\alpha}l(s)})$
- set verification key: $(g^{\alpha})$
1) I'll take the first step of the above setup.
construct the respective operand polynomial $l(x)$ with corresponding coefficients
We are still in that part of the text where all $l(x)$ are $a$. We haven't still reached 4.6.2 where they explore the case where out of 3 $l(x)$, 2 are $a$ and the 3rd one is $d$.
So if I create 3 points with same a's, it will look something like this
$a * x = r1$
$a * y = r2$
$a * z = r2$
With actual numbers, it can be
$2 * 2 = 4$
$2 * 3 = 6$
$2 * 4 = 8$
So the 3 $l$ points are $[(1, 2), (2, 2), (3,2)]$
If I do a Lagrange's interpolation on these 3 points, it will give me $l(x) = 2$.
If instead, I use $a = 1$, then $l(x)$ obtained from langrange's will always be $l(x) = 1$, i.e. lagrange's will always give me $l(x) = a$
So I am unable to understand how to get to a $l$ polynomial which looks like the one in 4.6.1 with $a=1$ & the $l$ polynomial is $x^2 - 3x + 3$. I am not saying $x^2 - 3x + 3$ doesn't fit the case - $l = 1$ at $x \in {1,2}$ - it does fit the case, but I am never going to get a $l$ polynomial which looks like that from lagrange's - I will always end up with $l(x) = a$.
2) Next is the 3rd step of the setup - i.e.
set proving key with encrypted $l(s)$ and it's "shifted" pair: $(g^{l(s)}, g^{{\alpha}l(s)})$
In all our protocols till now, we have always used $l(x)$ as an intermediate step - i.e. the prover never calculates $E(l(x=s))$ & hands it to verifier. He always uses $l(x)$ to construct $h(x)$ - i.e $h(x) = \frac {l(x) * r(x) - o(x)}{t(x)}$
So I am a little confused by this setup step here? Is the prover now handing Encryption of intermediate stuff ($l(x)$) to verifier instead of $E(h)$? - the verifier just needs $E(h)$ & $E(p)$ & he verifiers the proof by checking $E(p) = E(h)^t$ - so I am not clear as how providing $(g^{l(s)}, g^{{\alpha}l(s)})$ fits into reaching this final step?
