Let E
be an elliptic curve of prime order n
. If we assume that Alice and Bob both know a scalar value z
, is there a known zero-knowledge protocol (ideally a Sigma protocol) that allows Bob to convince Alice that he knows some point R
such that zR
satisfies some equation?
The context of this is as follows. I've recently been looking at ZKAttest, which allows a prover to display knowledge of an authentic ECDSA signature without revealing the identity of the signer to the verifier. In this work, the majority of the heavy lifting is done by proving a scalar multiplication of a given point i.e. that some commitment opens to zR
. In this case, z
is hidden via commitment, and R
is revealed to the verifier. However, I'm interested in the other case, where we reveal z
but hide R
.