There is a random scalar seed $s$ which we may call a master secret.
There are 2 public strings or scalars: $m1, m2$ and 2 corresponding EC keypairs: $a, A=a*G$ and $b, B=b*G$
$a$ and $b$ are somehow securely derived from $(s, m1)$ and $(s, m2)$ respectfully.
It might be $a = HKDF(s, m1)$ or $a = s + m1$, or some hash, it does not matter right now.
I need to prove 2 things without disclosing $s$ or $s*G$:
- That I know some $s$ that allowed me to generate $a,A$ using $m1$ or $b, B$ using $m2$
- That the same $s$ was used to generate those 2 (maybe more) keypairs
Is it possible without using snarks?