Alice picks random points
Q in a group where DLP w.r.t. a base point
G is hard (I am thinking an elliptic curve, but it doesn't have to be). Alice doesn't know the DLP of those two points.
(P,Q) to Bob.
Bob is to pick a random scalar
r, and return
(r*P,r*Q) to Alice, while keeping
Is there a way for Bob to prove to Alice that he knows that
r, and that the pair of points that he sent her are what she is expecting, but without revealing