A puzzle where the attacker sees many hints about a secret number and still mustn't find it.
The idea: KZG and SNARK setups publish a secret number τ hidden inside curve points, in many powers: τ, τ², τ³ and so on, all hidden. That lets anyone evaluate a polynomial "at τ" without knowing τ, which is how a whole polynomial gets squeezed into one point. The bet is that even with all these hints, nobody can compute certain other hidden values that would let them cheat. More hints means more risk, which makes it a stronger bet than plain Diffie-Hellman.
Why it matters: Makes the KZG commitments used for blobs binding.
On the map: given q powers gτ, gτ², gτ³, …
Given many powers of a secret τ hidden in the group (g^τ, g^τ², ...), nobody can compute certain related values. This is the q-strong Diffie-Hellman assumption[1], and it is what makes KZG commitments binding: a prover can't open a commitment to two different values[2].
It is a stronger, riskier assumption than plain Diffie-Hellman, because the attacker sees many related values (KE)[3].
If any of these breaks, this breaks too.
If this breaks, these break with it.