We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob:
- Alice knows: $g$, $h$, $x_1$, $x_2$ and $(a,b,c)$,
- Bob knows: $g$, $h$ and $(a,b,c)$.
Can Alice prove to Bob in zero knowledge that she knows $x_1$ and $x_2$ such that $(a,b,c) = (g^{x_1} , x_2ยท(h^{x_1}), h^{x_2})$?
This proof must be practical and non-interactive.
