Given the following (using additive notation):
- $G$ - generator of an elliptic curve group of order $q$
- $s$ - secret drawn uniformly from the distribution $1..q$
- $k$ and $K$ - a private public keypair
- $E$ - an encryption of $s$ under $K$
- $C$ - a commitment to $s$ such that $C = sG$.
Note that it's important that $C$ is formed as $sG$ - though pointers to general literature using any kind of commitments that satisfy the below problem would be appreciated as well.
How can I produce $E$ in such a way that, given $E$, $C$, and $K$, (and some other normal public info like generators, etc) one can verify that $C$ commits to the value that $E$ encrypts?