zklogstar

type Commitment struct {
	// S = sˣ tᵘ (mod N)
	S *saferith.Nat
	// A = Enc₀(alpha; r)
	A *paillier.Ciphertext
	// Y = α⋅G
	Y curve.Point
	// D = sᵃ tᵍ (mod N)
	D *saferith.Nat
}

type Private struct {
	// X is the plaintext of C and the discrete log of X.
	X *saferith.Int

	// Rho = ρ is nonce used to encrypt C.
	Rho *saferith.Nat
}

type Proof struct {
	*Commitment
	// Z1 = α + e x
	Z1 *saferith.Int
	// Z2 = r ρᵉ mod N
	Z2 *saferith.Nat
	// Z3 = γ + e μ
	Z3 *saferith.Int
	// contains filtered or unexported fields
}

type Public struct {
	// C = Enc₀(x;ρ)
	// Encryption of x under the prover's key
	C *paillier.Ciphertext

	// X = x⋅G
	X curve.Point

	// G is the base point of the curve.
	// If G = nil, the default base point is used.
	G curve.Point

	Prover *paillier.PublicKey
	Aux    *pedersen.Parameters
}