# Is there a ZKP that proves knowledge of a particular elliptic curve point?

Let E be an elliptic curve of prime order n. If we assume that Alice and Bob both know a scalar value z, is there a known zero-knowledge protocol (ideally a Sigma protocol) that allows Bob to convince Alice that he knows some point R such that zR satisfies some equation?

The context of this is as follows. I've recently been looking at ZKAttest, which allows a prover to display knowledge of an authentic ECDSA signature without revealing the identity of the signer to the verifier. In this work, the majority of the heavy lifting is done by proving a scalar multiplication of a given point i.e. that some commitment opens to zR. In this case, z is hidden via commitment, and R is revealed to the verifier. However, I'm interested in the other case, where we reveal z but hide R.

If I understand your question, you want a sigma protocol for a prover to convince a verifier that for some curve point $$V$$ and scalar $$z$$ (known to both the prover and the verifier), the prover knows an $$R$$ such that $$V=zR$$. Because $$V$$ and $$z$$ are known to the verifier, $$R$$ can be directly recomputed as $$(z^{-1})V = R$$, which defeats the purpose of a zero-knowledge protocol. In other words, this is a language in P rather than a language in NP, therefore the verifier can efficiently verify the statement itself without needing an NP witness.
• Hi: thanks for the answer! I was actually thinking of a situation where V is not known directly but instead hidden behind some commitment. May 30 at 11:56