A stronger puzzle: the attacker gets many related hints about a secret number and still mustn't find it. More hints means more risk.
The idea: KZG and SNARK setups publish a secret number τ hidden inside curve points, in many powers: τ, τ², τ³ and so on, all hidden. That lets anyone evaluate a polynomial "at τ" without knowing τ, which is how a whole polynomial gets squeezed into one point. The bet is that even with all these hints, nobody can compute certain other hidden values that would let them cheat. More hints means more risk, which makes it a stronger bet than plain Diffie-Hellman.
Why it matters: If it failed, the tiny proofs and data seals built on it (KZG commitments, many zero-knowledge proofs) could be faked.
On the map: q-SDH, q-DLOG: given q powers gτ, gτ², gτ³, …
Assumptions where the attacker sees many related values, g^τ, g^(τ²), ..., g^(τ^q) for a secret τ, and must still be unable to compute something like g^(1/(τ+c)) (q-SDH)[1] or τ itself (q-DLOG).
They are stronger, so riskier, than plain Diffie-Hellman: more given information means more attack surface, and Cheon's attack shaves off security when q is large[2]. KZG commitments and pairing SNARKs rely on them[3, 4]. A Diffie-Hellman solver would break them, so they imply key exchange (KE).
If any of these breaks, this breaks too.
If this breaks, these break with it.