# Is there a practical zero-knowledge proof for this special discrete log equation?

We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob:

• Alice knows: $g$, $h$, $x_1$, $x_2$ and $(a,b,c)$,
• Bob knows: $g$, $h$ and $(a,b,c)$.

Can Alice prove to Bob in zero knowledge that she knows $x_1$ and $x_2$ such that $(a,b,c) = (g^{x_1} , x_2·(h^{x_1}), h^{x_2})$?

This proof must be practical and non-interactive.

-
Do you have a specific setup in mind? $\:$ – Ricky Demer Oct 31 '12 at 19:38
Could you post that commitment format you're proposing? Maybe I can change it and still keep the remaining desired properties of the system. Thanks. – SDL Oct 31 '12 at 20:12
@SDL, I was thinking of $\textrm{commit}(x_2) = (g^{x_3}, x_2 h^{x_3})$, but I just now realized this might be problematic: this is binding for everyone, but not concealing against the person who holds the private key (the person who knows the discrete log of $h$ to base $g$ can infer what value was committed to without permission), which I suspect might not meet your needs. So, I withdraw my previous comment. Sorry for my error. – D.W. Oct 31 '12 at 20:27
wait a minute: $\;\;$ How do you make sense of $\: x_2 \cdot \left(h^{x_1}\right) \:$ in a cyclic group? $\hspace{1.05 in}$ – Ricky Demer Oct 31 '12 at 20:37
ElGamal is defined over a multiplicative cyclic group of order q. – SDL Nov 1 '12 at 13:32