Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I am looking for a proof of knowledge as such:
$PK\{ (x,r) : C = g^xh^r \land V = g^x\}$
Where $C, V, g$ and $h$ are public information and $x$ and $r$ is known only to the prover.
I.e. I have a Pedersen commit and a public key and I want to prove in zero knowledge that the committed value is the private key. Is there such a construct available?
It can be done with two Schnorr proofs, which can be interactive or noninteractive.
This is a simple way of proving knowledge of a discrete log; in the noninteractive version, to prove the knowledge of $x$ s.t. $a = g^x$ (assuming a public hash function $H$), the prover picks a random value $r$, computes $t = g^r$, $c = H(t)$, and then publishes $t$ and $s = r + cx$. The verifier then checks whether $g^s = t a^c$
To prove the statement you want, you first publish a proof that you know $x$ s.t. $V = g^x$
The second proof is that you know $r$ s.t. $C V^{-1} = h^r$
The two combined is equivalent to the statement you are interested in.
