# Zero knowledge proof for opening of Pedersen commit and discrete logarithm

I am looking for a proof of knowledge as such:

$$PK\{ (x,r) : C = g^xh^r \land V = g^x\}$$

Where $$C, V, g$$ and $$h$$ are public information and $$x$$ and $$r$$ is known only to the prover.

I.e. I have a Pedersen commit and a public key and I want to prove in zero knowledge that the committed value is the private key. Is there such a construct available?

## 1 Answer

It can be done with two Schnorr proofs, which can be interactive or noninteractive.

This is a simple way of proving knowledge of a discrete log; in the noninteractive version, to prove the knowledge of $$x$$ s.t. $$a = g^x$$ (assuming a public hash function $$H$$), the prover picks a random value $$r$$, computes $$t = g^r$$, $$c = H(t)$$, and then publishes $$t$$ and $$s = r + cx$$. The verifier then checks whether $$g^s = t a^c$$

To prove the statement you want, you first publish a proof that you know $$x$$ s.t. $$V = g^x$$

The second proof is that you know $$r$$ s.t. $$C V^{-1} = h^r$$

The two combined is equivalent to the statement you are interested in.