Sigma protocol ZK-proof of a pair of pedersen commitments

Question

Let's say you are using a $\Sigma$ protocol ZK proof to prove knowledge of $x_1, x_2$ so that $Y = g_1^{x_1}g_2^{x_2}$. Of course $g_1$, $g_2$ are generators within cyclic group G of prime order q, with q of sufficient size.

My question is, if $z = dlog_{g_1}g_2$ is known to the prover, how would that affect the soundness of the proof? If the value of z is known to the verifier, how would that affect honest-verifier z-k property?

Intuitively it seems like knowing z would break things, but I don't see how.

Answer 1

The important thing to understand is that if the prover knows such a $z$, then the commitment is not binding. In particular, for any $Y$ and any $x_1'$ it can find $x_2'$ such that $Y=g_1^{x_1'}\cdot g_2^{x_2'}$. Thus, it can open the commitment to any $x_1'$ it likes. As such, it can also prove knowledge of any $x'_1,x'_2$ it wishes. This does not break soundness, since it indeed knows such an $x'_1,x'_2$ and so everything is true.

If $z$ is known to the verifier, then this actually makes no difference, because Pedersen is a perfectly hiding commitment.

In general, you should study more about Pedersen commitments, and then understand the $\Sigma$ protocol issue.