Consider a situation where there is a (scalar) secret key $x$, known only to Alice.
There are two well known generator points $G$ and $H$, known to both Alice and Bob. $H$ is chosen such that discrete log of $H$ base $G$ is unknowable.
Alice provides Bob with the points $A$ and $B$, where $A = xG$ and $B = xH$.
Without Alice revealing $x$ to Bob, how can Alice prove to Bob that both $A$ and $B$ were constructed with the same $x$? The proof should be non-interactive.
Is it safe to simply provide a Schnorr signature using the private key $x$ and public key $(A+B)$ on the basis of a generator point $(G+H)$?
The Schnorr signature would be:
$sig.c = H_s( (A+B)$ $||$ $k(G+H))$
$sig.r = k - x * sig.c$
where $k$ is a random number generated only for this Schnorr signature.
The Schnorr signature would be verified by checking that:
$sig.c == H_s((A+B) $ $||$ $ (sig.r*(G+H) + sig.c*(A+B)))$
$H_s()$ means hash the contents to produce a scalar
$||$ means byte concatenation.