Help with a zero knowledge proof

Question

Can you please help with the following?

Let $C_1= g^r h_1^x h_2^y$, $C_2 = a^z$ and $C_3=(g^{r'}h_1^x h_2^y)^z$.

Basically, $C_1$ is a commitment on the values $x, y$ and $C_3$ is another, blinded commitment on the same values. $C_2$ is a commitment to the blinding factor $z$ of $C_3$.

We would like to prove in ZK that the values $x, y$ in the two commitments $C_1$ and $C_3$ are the same. Public knowledge are the values $a, C_1, C_2, C_3$ and the generators $g, h_1, h_2$. The secret values are shown in parentheses below:

\begin{align} \pi = PK\{(r, r', x, y, z):\; & C_1= g^r h_1^x h_2^y \; \; \wedge \nonumber \\ & C_2 = a^z \; \;\wedge \nonumber \\ & C_3=(g^{r'}h_1^x h_2^y)^z \; \} \nonumber \end{align}

I have a proof but I find it somewhat ugly. It would be greatly appreciated if you can provide a more elegant one...

Thanks!

Answer 1

It could be straight-forward with verification equation quadratic in challenge, compared to well-known equation of Schnorr protocol that is linear in challenge.

In particular, for well-known responses like $X = xc + \alpha$, $Y = yc + \beta$, $R, R', Z$ and equations for $C_1, C_2$ do it: $(g^{R'} h_1^X h_2^Y)^Z = C_3^{c^2} D_1^c D_0$

Produce explicit formulae for $D_1$ and $D_0$ to complete this homework.

$(g^{r' c + \delta} h_1^{x c + \alpha} h_2^{y c + \beta})^{z c + \gamma} = C_3^{c^2} D_1^c D_0$

This approach with higher-degree polynomials in challenge rely on an upper bound for number of roots, two in this particular case.