2

You cannot modify $\mathcal A$ in this way. If you need $\alpha$ and $\beta$ for the reduction, then you will need to use a zero-knowledge proof of knowledge from which you can extract them. I understand that you want to use a NIZK. However, this actually isn't a problem. If you take a Sigma-protocol (3-round proof) for Pedersen commitments (which is ...


Only top voted, non community-wiki answers of a minimum length are eligible