I am looking for a proof of knowledge as such:

$PK\{ (x,r) : C = g^xh^r \land V = g^x\}$

Where $C, V, g$ and $h$ are public information and $x$ and $r$ is known only to the prover.

I.e. I have a Pedersen commit and a public key and I want to prove in zero knowledge that the committed value is the private key. Is there such a construct available?


1 Answer 1


It can be done with two Schnorr proofs, which can be interactive or noninteractive.

This is a simple way of proving knowledge of a discrete log; in the noninteractive version, to prove the knowledge of $x$ s.t. $a = g^x$ (assuming a public hash function $H$), the prover picks a random value $r$, computes $t = g^r$, $c = H(t)$, and then publishes $t$ and $s = r + cx$. The verifier then checks whether $g^s = t a^c$

To prove the statement you want, you first publish a proof that you know $x$ s.t. $V = g^x$

The second proof is that you know $r$ s.t. $C V^{-1} = h^r$

The two combined is equivalent to the statement you are interested in.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.