We can use the technique described in this answer to prove key equivalence across two elliptic curves of different order. I'm wondering if modifying the technique as described below would compromise anything.
So, let's say I have committed to 2 points $A$ and $A'$ on two different elliptic curves with generators $G$ and $G'$. The curves are of orders $q$ and $q'$ such that $q < q'$. I've also publicly committed to a large random number $h$. I would like to prove that $A = a \cdot G$ and $A' = a \cdot G'$ while using this number $h$. I am thinking I could do the following:
- Compute $r = a \cdot h$ (this the main difference from the linked answer).
- Compute $T = r \cdot G$ and $T' = r \cdot G'$.
- Compute $u = H(G, G', A, A', T, T')$ and use it to compute $v = r + a \cdot u$.
- The proof is then $(T, T', v)$.
The verification works same as before: compute $u$ and verify that $v \cdot G = T + u \cdot A$ and $v \cdot G' = T' + u \cdot A'$. The verifier can also verify that I've used the number $h$ because $h \cdot A = T$.
Does the fact that I changed the first step as described above break anything?
Edit: the above approach makes it trivial to recover $a$ - so, it doesn't work. Maybe there is another approach that would work?
