# zerocoin ZKSoK Pedersen commitment process

I am studying the zerocoin paper‡. More precisely I am stuck at page 6, on the Spend function (in paragraph "B. Our construction"). I am not understanding how the ZKSoK is computed. Let's consider the Pedersen commitment as $$C\gets g^Sh^r\bmod p$$

I've found a lot of examples online but they all refer to a case where the "secret" is $$ω$$: $$x=g^ω$$ And $$x$$ is public. I understand the steps in this cases but I am not sure about two things on zerocoin:

1. Does the provider give $$S$$ ($$S$$=serial number) to the verifier, in order to be able to do the verification?
2. What is the condition that says if the proof is valid or not?

‡ Paywalled

1. Yes, the value $$S$$ is public. From the notation on page 5, "All values not enclosed in ()’s are assumed to be known to the verifier." This makes sense in the scheme, since, once a coin is spent, its serial becomes public and cannot be used again.
• I still do not understand how $S$ is involved during the generation of the proof. More precisely, referring to the example 1 of the Camenisch and Stadler paper, I do not understand where to use it. Commented Mar 23, 2023 at 14:45
• Example 1 doesn't have the form of a Pedersen commitment. It's $g^x$ rather than $g^x h^y$. Example 4 is closer to what you want. This other answer specifies the Pedersen opening protocol directly. Commented Mar 24, 2023 at 19:38
• I've seen the answer and I get it, but what prevents an attacker from properly compute zkp and then provide another $S$? How is the proof and $S$ linked together, and how is $S$ correctness verified by the verifier? Commented Mar 25, 2023 at 12:19