Tricking the Schnorr's protocol From the lecture notes I have learned the following:


$P \rightarrow V$: $T=g^t$ ($t$, randomly chosen from $Z_q$)
$P \leftarrow V$: $c$ (randomly chosen from $Z_q$)
$P \rightarrow V$: $s=xc+t \mod q$
$V$ accepts if $g^s=A^cT$, (where $A=g^x$)


Question: Can $P$ instead of sending $g^s$ send directly $A^cT$?

In other words, $P$ has all it need to generate $A^cT$ which is the same as $g^s$. Can someone explain what I am seeing wrong?
Well yes, $P$ can generate $A^cT$ and send it over, but why would it help? 

The point of this protocol is that $P$ proofs to $V$ that it knows $x$, without revealing anything about $x$. The way that $P$ does this is that given some randomly chosen $t$ and a challenge $c$, it can compute an $s$ such that $g^s=A^cT$. The fact that $P$ can compute this $s$ proves knowledge of $x$ (note that $s=xc+t$). Anyone that does not know $x$, cannot compute $s$ (assuming some hard problem).

On the other hand, anyone can compute $A^cT$ given $A,c,T$, so this does not prove anything about knowledge of $x$.