I am studying the zerocoin paper‡. More precisely I am stuck at page 6, on the Spend function (in paragraph "B. Our construction"). I am not understanding how the ZKSoK is computed. Let's consider the Pedersen commitment as $$C\gets g^Sh^r\bmod p$$
I've found a lot of examples online but they all refer to a case where the "secret" is $ω$: $x=g^ω$ And $x$ is public. I understand the steps in this cases but I am not sure about two things on zerocoin:
- Does the provider give $S$ ($S$=serial number) to the verifier, in order to be able to do the verification?
- What is the condition that says if the proof is valid or not?