Why is the first coefficient set to 1 in both GGPR13 & Groth16 SNARKS?

Question

From GGPR13

Section 7.1, Page 42

($v_0(x) +\sum_{k=1}^m a_k \cdot v_k(x)) \cdot (w_0(x) +\sum_{k=1}^m a_k \cdot w_k(x)) - (y_0(x) +\sum_{k=1}^m a_k \cdot y_k(x))$

If you notice, the term $a_k$ is there only for $k = 1$ to $m$. The first terms $v_0, w_0, y_0$ have been brought outside the summation - i.e. equivalent to setting $a_0 = 1$

Likewise in Groth16

Section 2.3, Page 9

The equations will be over $a_0 = 1$ and variables $a_1, \dots a_m \in F$ and be of the form

$\sum a_iu_{i,q} \cdot \sum a_iv_{i,q} = \sum a_iw_{i,q}$

Here they don't bring the first term out with no co-efficient but specify $a_0 = 1$

I understand that $a_0$ can be made 1 by dividing all other coefficients with the previous $a_0$ but why is it done?

---

Also, in site or blog which explains Groth16 - for e.g. Groth16 under the hood, I can't find the examples actually enforcing this $a_0=1$ at all - they just seem to ignore this.

Answer 1

$a_0$ is set to 1 to capture any quadratic polynomial in $\textbf{m}$ variables. This is because a quadratic polynomial may contain low-degree monomials, i.e., degree-1 and degree-0 monomials.

Observe that if $a_0$ is not set to 1 and is considered as an addition variable, then it becomes a quadratic polynomial in $\mathbf{m+1}$ variables. Also, there won't be a degree-0 monomial in the equation, thus not capturing a general quadratic equation.

Now, consider the following polynomials.

$$\sum_{i=0}^m a_i u_{i} \cdot \sum_{i=0}^{m} a_i v_i = \sum_{i=0}^m a_i w_i$$ $$\sum_{i=0}^m b_i u_{i} \cdot \sum_{i=0}^{m} b_i v_i = \sum_{i=0}^m b_i w_i$$

where in the first polynomial we restrict that $a_0 = 1$, i.e., it is a polynomial in $m$ variables whereas the second one is in $m+1$ variables. Clearly, a solution $(d_1, \dots, d_m)$ for the first equation implies $(1, d_1 \dots, d_m)$ is a solution to the second. Whereas a solution $(e_0, e_1, \dots, e_m)$ to the second equation can be used to build a solution to the first equation only when $e_0 \neq 0$. In other words, solving the first equation is harder than solving the second one. Hence, revealing $a_0 = 1$ does not make it easier!