Can you please help with the following?

Let $C_1= g^r h_1^x h_2^y$, $C_2 = a^z$ and $C_3=(g^{r'}h_1^x h_2^y)^z$.

Basically, $C_1$ is a commitment on the values $x, y$ and $C_3$ is another, blinded commitment on the same values. $C_2$ is a commitment to the blinding factor $z$ of $C_3$.

We would like to prove in ZK that the values $x, y$ in the two commitments $C_1$ and $C_3$ are the same. Public knowledge are the values $a, C_1, C_2, C_3$ and the generators $g, h_1, h_2$. The secret values are shown in parentheses below:

\begin{align} \pi = PK\{(r, r', x, y, z):\; & C_1= g^r h_1^x h_2^y \; \; \wedge \nonumber \\ & C_2 = a^z \; \;\wedge \nonumber \\ & C_3=(g^{r'}h_1^x h_2^y)^z \; \} \nonumber \end{align}

I have a proof but I find it somewhat ugly. It would be greatly appreciated if you can provide a more elegant one...



1 Answer 1


It could be straight-forward with verification equation quadratic in challenge, compared to well-known equation of Schnorr protocol that is linear in challenge.

In particular, for well-known responses like $X = xc + \alpha$, $Y = yc + \beta$, $R, R', Z$ and equations for $C_1, C_2$ do it: $(g^{R'} h_1^X h_2^Y)^Z = C_3^{c^2} D_1^c D_0$

Produce explicit formulae for $D_1$ and $D_0$ to complete this homework.

$(g^{r' c + \delta} h_1^{x c + \alpha} h_2^{y c + \beta})^{z c + \gamma} = C_3^{c^2} D_1^c D_0$

This approach with higher-degree polynomials in challenge rely on an upper bound for number of roots, two in this particular case.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.