Can you please help with the following?
Let $C_1= g^r h_1^x h_2^y$, $C_2 = a^z$ and $C_3=(g^{r'}h_1^x h_2^y)^z$.
Basically, $C_1$ is a commitment on the values $x, y$ and $C_3$ is another, blinded commitment on the same values. $C_2$ is a commitment to the blinding factor $z$ of $C_3$.
We would like to prove in ZK that the values $x, y$ in the two commitments $C_1$ and $C_3$ are the same. Public knowledge are the values $a, C_1, C_2, C_3$ and the generators $g, h_1, h_2$. The secret values are shown in parentheses below:
\begin{align} \pi = PK\{(r, r', x, y, z):\; & C_1= g^r h_1^x h_2^y \; \; \wedge \nonumber \\ & C_2 = a^z \; \;\wedge \nonumber \\ & C_3=(g^{r'}h_1^x h_2^y)^z \; \} \nonumber \end{align}
I have a proof but I find it somewhat ugly. It would be greatly appreciated if you can provide a more elegant one...
Thanks!