# ZKP of knowledge of EC keys preimage

There is a random scalar seed $$s$$ which we may call a master secret.

There are 2 public strings or scalars: $$m1, m2$$ and 2 corresponding EC keypairs: $$a, A=a*G$$ and $$b, B=b*G$$

$$a$$ and $$b$$ are somehow securely derived from $$(s, m1)$$ and $$(s, m2)$$ respectfully.

It might be $$a = HKDF(s, m1)$$ or $$a = s + m1$$, or some hash, it does not matter right now.

I need to prove 2 things without disclosing $$s$$ or $$s*G$$:

1. That I know some $$s$$ that allowed me to generate $$a,A$$ using $$m1$$ or $$b, B$$ using $$m2$$
2. That the same $$s$$ was used to generate those 2 (maybe more) keypairs

Is it possible without using snarks?

• If $a=s+m_1$, someone can easily calculate $sG=A-m_1G$. A solution to your question would probably involve proposing a different way to derive $a$ and $b$ May 26 at 22:17
• Furthermore, I assume you don't want malleability. For example, if $a=s+x+m_1$, then I can always demonstrate that any value of $s$ was used to create $a$, simply by claiming a different choice of $x$. It would be necessary to demonstrate that $A$ can only be claimed to have been derived from one value of $s$. This means the method of derivation of $a$ must be carefully considered May 26 at 23:00
• What about side-stepping this, and instead publishing identities as the pair $(A_i, sH_p(A_i))$, where $H_p()$ means hash a value to produce an EC point in the group of the base point. If you want to prove that two identities are linked, you provide a discrete-log-equivalence proof that $s$ is the same in both cases May 26 at 23:10