Let's change the formula to $C_1C_2=(g_1g_2)^{r}g_3^m$ and $C_2C_1^{-1}=(g_2g_1^{-1})^{r}g_3^m$. The prover just needs to prove that she knows how to open the two commitments as well as the random and the commited value are equal in two commitments, which is EQ form of [2] as you provided. Here is the protocol:
- The prover sends $a_1=(g_1g_2)^{u_1}g_3^{u_2}$ and $a_2=(g_2g_1^{-1})^{u_1}g_3^{u_2}$ for random $u_1$, $u_2$.
- The verifier sends a challenge $c$.
- The prover answers $d_1=u_1+c \cdot r$ mod $n$, $d_2=u_2+c \cdot m$ mod $n$ to the verifier.
- The verifier checks if $a_1(C_1C_2)^c = (g_1g_2)^{d_1}g_3^{d_2}$ and $a_2(C_2C_1^{-1})^c = (g_2g_1^{-1})^{d_1}g_3^{d_2}$
Completeness follows immediately.
special soundness: Given two accepting conversations $(a_1, a_2; c; d_1, d_2)$ and $(a_1, a_2; c'; d_1', d_2')$ with $c \neq c'$, we have $r = (d_1-d_1')/(c-c')$ and $m = (d_2-d_2')/(c-c')$
honest-verier zero-knowledge: chooses random $c, d_1, d_2$, setting $a_1=(g_1g_2)^{d_1}g_3^{d_2}(C_1C_2)^{-c}$ and $a_2=(g_2g_1^{-1})^{d_1}g_3^{d_2}(C_2C_1^{-1})^{-c}$ to simulate the conversation.
To Σ-protocol zero knoweledge, please refers to session 6.5 Zero-Knowledge from Σ-Protocols in Efficient Secure Two-Party Protocols for detailed information.
Most importantly, we need to argue the above protocol is equivalent to what you need. Generally suppose $C_1=g_1^{x_1}g_2^{x_2}g_3^{x_3}g'^{x'}$ and $C_2=g_1^{x_1'}g_2^{x_2'}g_3^{x_3'}g''^{x''}$, then you can check $C_1C_2=(g_1g_2)^{r}g_3^m$ and $C_2C_1^{-1}=(g_2g_1^{-1})^{r}g_3^m$ imply $x_1=r$, $x_1'=0$, $x_2=0$, $x_2'=r$,$x_3=0$, $x_3'=m$, $g'^{x'}=g''^{x''}=1$.
========================================================================
Let me correct my answer. The above protocol is for group $G_1=G_2$, for $G_1 \neq G_2$, we can process using following intuition:
It is known that if $G_1$ and $G_2$ are cyclic groups, then $G_3 = G_1 \times G_2$ is also a cyclic group with generator $(g_1, g_2)$ or $(g_1, g_3)$.
we can change $C_1 = g_1^r$ in $G_1$ as $C'_1 = (g_1^r, 1_{G_2})$ in $G_3$ and $C_2 = g_2^rg_3^m$ in $G_2$ to $C'_2 = (1_{G_1}, g_2^rg_3^m)$ in $G_3$, now the question is that for the two new elements in $G_3$, the prover knows the coresponding secret and the equality of $r$ in the first and second element. $1_{G_1}$ and $1_{G_2}$ are the identity in group $G_1$ and $G_2$.
using a similiar intuition, we can get
$C'_1 \circ_{G_3} C'_2 = (g_1^r, g_2^rg_3^m) = (g_1, g_2)^r \circ_{G_3} (1_{G_1}, g_3)^m$ $C'^{-1}_1 \circ_{G_3} C'_2 = (g_1^{-r}, g_2^rg_3^m) = (g_1^{-1}, g_2)^r \circ_{G_3} (1_{G_1}, g_3)^m$
where $(g_1, g_2)$, $(1_{G_1}, g_2)$, $(g_1^{-1}, g_2)$ and $(1_{G_1}, g_3)$ are public elements in group $G_3$. Here $\circ_{G_3}$ denotes the operator in $G_3$.
The you can follow the previous intuition to get a similiar protocol in group $G_3$.