【安全技术】佩德森承诺

语言 Chinese, Simplified

SEO Title

ZKP Pedersen Commitments

Definition #

Start with a finite group $G$ $G$

of prime order $q$ $q$

, where $q$ $q$

is suitably large. For instance, we can use an order- $q$ $q$

subgroup the multiplicative group $Z_{p}^{*}$ $Z_{p}^{*}$ $Z_{p}^{*}$ $Z_{p}^{*}$

where $q$ $q$

divides $p$ $p$

, or an elliptic curve group or subgroup. Select two generators $g, h$ $g, h$ $g, h$ $g, h$

of $G$ $G$

such that $\log_{g} (h)$ $\log_{g} (h)$ $\log_{g} (h)$ $\log_{g} (h)$ $\log_{g} (h)$ $\log_{g} (h)$

is not known. The parameters of the commitment scheme are $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$ $(G, q, g, h)$

To generate a commitment $c \in G$ $c \in G$ $c \in G$ $c \in G$

to a secret integer $s$ $s$

, where $0 < s < q$ $0 < s < q$ $0 < s < q$ $0 < s < q$ $0 < s < q$ $0 < s < q$

, randomly sample $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$

and compute:

$c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$ $c = C_{g, h} (s, t) = g^{s} h^{t}$

(When $g, h$ $g, h$ $g, h$ $g, h$

are clear from context, we can simply write $C (s, t)$ $C (s, t)$ $C (s, t)$ $C (s, t)$ $C (s, t)$ $C (s, t)$ $C (s, t)$

To open the commitment, simply reveal $s$ $s$

and $t$ $t$

Intuition as to Why Pedersen Commitments are Binding #

Suppose Alice has sent Bob a commitment $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$

to a value $s$ $s$

. She now wants to cheat by sending Bob an opening for $c$ $c$

that corresponds to $s^{'} \neq s$ $s^{'} \neq s$ $s^{'} \neq s$ $s^{'} \neq s$ $s^{'} \neq s$

. In other words, she wants to break the binding property of Pedersen commitments.

That means Alice has to find $t^{'}$ $t^{'}$ $t^{'}$

such that $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$ $g^{s^{'}} h^{t^{'}} = c$

. Since $g^{s^{'}}$ $g^{s^{'}}$ $g^{s^{'}}$ $g^{s^{'}}$

and $c$ $c$

are already fixed, Alice is left to solve $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$ $h^{t^{'}} = c g^{- s^{'}}$

. In other words, she needs to compute $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$ $t^{'} = \log_{h} (c g^{- s^{'}})$

. Since the discrete logarithm problem is supposed to be hard in $G$ $G$

, Alice will have a difficult time finding $t^{'}$ $t^{'}$ $t^{'}$

Before committing to a value, Alice can also look for distinct pairs $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$ $(s, t), (s^{'}, t^{'})$

such that $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$

, without regard for the specific values of $s$ $s$

and $s^{'}$ $s^{'}$ $s^{'}$

. This is also equivalent to computing a discrete logarithm in $G$ $G$

. As the Pedersen paper points out: given $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$ $C (s, t) = C (s^{'}, t^{'})$

, where $s^{'} \neq s$ $s^{'} \neq s$ $s^{'} \neq s$ $s^{'} \neq s$ $s^{'} \neq s$

, then $t^{'} \neq t$ $t^{'} \neq t$ $t^{'} \neq t$ $t^{'} \neq t$ $t^{'} \neq t$

, and it is possible to compute the discrete logarithm of $h$ $h$

with respect to $g$ $g$

$\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$ $\log_{g} (h) = \frac{s - s^{'}}{t^{'} - t} (\mod q)$

To summarize, breaking the binding property of Pedersen commitments is equivalent to solving the discrete log problem.

Intuition as to Why Pedersen Commitments are Hiding #

Suppose Alice has sent Bob a commitment $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$ $c = C (s, t)$

to a value $s$ $s$

. Bob wants to cheat by figuring out $s$ $s$

, or at least something about $s$ $s$

, from $c$ $c$

Remember that $t$ $t$

is sampled uniformly at random, and so every value of $t$ $t$

is equally likely to be chosen, which means every value of $h^{t}$ $h^{t}$ $h^{t}$

is equally likely. Since $h$ $h$

is a generator of $G$ $G$

, that means that $t$ $t$

“selects” every element of $G$ $G$

uniformly at random.

If Bob is able to gain any advantage in guessing the value of $s$ $s$

or $g^{s}$ $g^{s}$ $g^{s}$

from $c$ $c$

, then he necessarily gains an advantage in guessing $t$ $t$

or $h^{t}$ $h^{t}$ $h^{t}$

. However, $t$ $t$

is selected uniformly at random, so $h^{t}$ $h^{t}$ $h^{t}$

is a uniform random element of $G$ $G$

. You can’t gain information about a uniform random distribution.

The Additive Property #

Given two commitments, $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$ $c_{1} = C (s_{1}, t_{2}) = g^{s_{1}} h^{t_{1}}$

and $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$ $c_{2} = C (s_{2}, t_{2}) = g^{s_{2}} h^{t_{2}}$

, the product of $c_{1}$ $c_{1}$ $c_{1}$

and $c_{2}$ $c_{2}$ $c_{2}$

is $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$ $g^{s_{1} + s_{2}} h^{t_{1} + t_{2}} = C (s_{1} + s_{2}, t_{1} + t_{2})$

. That is, the product of any two Pedersen commitments is a commitment to the sum of the committed values.

This also allows for scalar multiplication through exponentiation; $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$ $C {(x, y)}^{n} = C (n x, n y)$

This additive property can be incredibly useful. It allows for a variety of operations to be performed on committed values before revealing them. Systems like Bulletproofs, for instance, exploit this property of the Pedersen scheme to commit to entire vectors of values at once, aggregating the commitments into a single value.

Useful Algorithms and Properties of Pedersen Commitments #

Proof of Knowledge of Secret #

Given a commitment $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$ $A = C_{g, h} (x, y) = g^{x} h^{y}$

, Alice can demonstrate to Bob that she knows $x$ $x$

and $y$ $y$

without revealing either $x$ $x$

or $y$ $y$

. This is a useful protocol for protecting against the additive properties of Pedersen commitments being used maliciously. The protocol works as follows:

$\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$ $\begin{matrix} Alice & Bob \\ t_{1}, t_{2} \overset{$}{\leftarrow} Z_{q} \\ T = g^{t_{1}} h^{t_{2}} \\ \to_{}^{T} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ s_{1} = x \cdot k + t_{1}, s_{2} = y \cdot k + t_{2} \\ \to_{}^{s_{1}, s_{2}} \\ g^{s_{1}} h^{s_{2}} \overset{?}{=} A^{k} T \end{matrix}$

This works because:

$g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$ $g^{s_{1}} h^{s_{2}} = g^{x k + t_{1}} h^{y k + t_{2}} = g^{x k} h^{y k} g^{t_{1}} h^{t_{2}} = {(g^{x} h^{y})}^{k} T = A^{k} T$

This is secure because, in order to trick Bob, Alice needs to break the discrete log problem.

A straightforward application of the Fiat-Shamir transform can turn this into a non-interactive proof. If Alice selects $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$ $k = H a s h (g ‖ h ‖ A ‖ T)$

, where the output of $H a s h ()$ $H a s h ()$ $H a s h ()$ $H a s h ()$ $H a s h ()$ $H a s h ()$ $H a s h ()$

has the same bit length as $q$ $q$

, she can proceed as though $k$ $k$

were selected uniformly at random. Bob can compute $k$ $k$

in the same way, and verify the rest of the proof from there.

An Easy Proof of Equal Commitments #

Given two commitments to a secret $s$ $s$

using the same set of generators, call them $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$ $c_{1} = C (s, t_{1})$

and $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$ $c_{2} = C (s, t_{2})$

, where $t_{2} \neq t_{1}$ $t_{2} \neq t_{1}$ $t_{2} \neq t_{1}$ $t_{2} \neq t_{1}$ $t_{2} \neq t_{1}$ $t_{2} \neq t_{1}$

, Alice can easily show that both $c_{1}$ $c_{1}$ $c_{1}$

and $c_{2}$ $c_{2}$ $c_{2}$

commit to the same value. The simplest way, given by Pedersen, is for Alice to reveal $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$ $r = t_{1} - t_{2} (\mod q)$

to Bob.

This works because Bob can check that

$c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$ $c_{1} c_{2}^{- 1} = g^{s} h^{t_{1}} g^{- s} h^{- t_{2}} = g^{s - s} h^{t_{1} - t_{2}} = h^{t_{1} - t_{2}} = h^{r}$

Proof of Equal Commitments with Different Binding Generators #

Suppose Alice has $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$ $c_{1} = C_{g_{1}, h} (s, t_{1})$

and $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$ $c_{2} = C_{g_{2}, h} (s, t_{2})$

, possibly with $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$

. Alice can prove to Bob that $c_{1}$ $c_{1}$ $c_{1}$

and $c_{2}$ $c_{2}$ $c_{2}$

commit to the same value.

Alice starts by selecting random integers $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$ $r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q}$

, then computing $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$ $c_{3} = C_{g_{1}, h} (r_{1}, r_{2}) = g_{1}^{r_{1}} h^{r_{2}}$

and $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$ $c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) = g_{2}^{r_{1}} h^{r_{3}}$

. She sends $c_{3}, c_{4}$ $c_{3}, c_{4}$ $c_{3}, c_{4}$ $c_{3}, c_{4}$ $c_{3}, c_{4}$ $c_{3}, c_{4}$

to Bob.

Bob selects a random challenge value $k \overset{$}{\leftarrow} Z_{q}$ $k \overset{$}{\leftarrow} Z_{q}$ $k \overset{$}{\leftarrow} Z_{q}$ $k \overset{$}{\leftarrow} Z_{q}$ $k \overset{$}{\leftarrow} Z_{q}$ $k \overset{$}{\leftarrow} Z_{q}$

and sends it to Alice.

Alice computes $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$ $z_{1} = k s + r_{1}$

, $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$ $z_{2} = k t_{1} + r_{2}$

, and $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$ $z_{3} = k t_{2} + r_{3}$

in $Z_{q}$ $Z_{q}$ $Z_{q}$

and sends $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$ $z_{1}, z_{2}, z_{3}$

to Bob.

Bob then checks that $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = C_{g_{1}, h} (z_{1}, z_{2})$

and $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = C_{g_{2}, h} (z_{1}, z_{3})$

. If the condition holds, Bob accepts the proof as valid.

This works because:

$c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$ $c_{3} c_{1}^{k} = (g_{1}^{r_{1}} h^{r_{2}}) {(g_{1}^{s} h^{t_{1}})}^{k} = g_{1}^{r_{1}} h^{r_{2}} g_{1}^{k s} h^{k t_{1}} = g_{1}^{k s + r_{1}} h^{k t_{1} + r_{2}} = g_{1}^{z_{1}} h^{z_{2}} = C_{g_{1}, h} (z_{1}, z_{2})$

and

$c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$ $c_{4} c_{2}^{k} = (g_{2}^{r_{1}} h^{r_{3}}) {(g_{2}^{s} h^{t_{2}})}^{k} = g_{2}^{r_{1}} h^{r_{3}} g_{2}^{k s} h^{k t_{2}} = g_{2}^{k s + r_{1}} h^{k t_{2} + r_{3}} = g_{2}^{z_{1}} h^{z_{3}} = C_{g_{2}, h} (z_{1}, z_{3})$

In diagram form: #

$\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$ $\begin{matrix} Alice & Bob \\ r_{1}, r_{2}, r_{3} \overset{$}{\leftarrow} Z_{q} \\ c_{3} = C_{g_{1}, h} (r_{1}, r_{2}), c_{4} = C_{g_{2}, h} (r_{1}, r_{3}) \\ \to_{}^{c_{3}, c_{4}} \\ k \overset{$}{\leftarrow} Z_{q} \\ \leftarrow_{}^{k} \\ z_{1} = k s + r_{1} \\ z_{2} = k t_{1} + r_{2} \\ z_{3} = k t_{2} + r_{3} \\ \to_{}^{z_{1}, z_{2}, z_{3}} \\ c_{3} c_{1}^{k} \overset{?}{=} C (z_{1}, z_{2}) \\ c_{4} c_{2}^{k} \overset{?}{=} C (z_{1}, z_{3}) \end{matrix}$

Again, this can be made non-interactive through the use of a Fiat-Shamir transform. Alice can use $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$ $k = H a s h (g_{1} ‖ g_{2} ‖ h ‖ c_{1} ‖ c_{2} ‖ c_{3} ‖ c_{4})$

, again selecting a hash so that $k$ $k$

and $q$ $q$

have the same bit length.

While this construction is more complicated, it has the benefit of allowing for commitments to be made when $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$ $g_{1} \neq g_{2}$

Proof of Squared Commitments #

We can use the equality of commitments proof above to commit to both a secret $s$ $s$

and its square.

Suppose Alice has a random $t_{1}$ $t_{1}$ $t_{1}$

and corresponding commitment $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$ $c_{1} = C_{g, h} (s, t_{1}) = g^{s} h^{t_{1}}$

. Alice can select a random $t_{2}$ $t_{2}$ $t_{2}$

and compute $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}}$

Note that $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$ $c_{2} = C_{c_{1}, h} (s, t_{2}) = {(c_{1})}^{s} h^{t_{2}} = {(g^{s} h^{t_{1}})}^{s} h^{t_{2}} = g^{s^{2}} h^{s t_{1} + t_{2}} = C_{g, h} (s^{2}, s t_{1} + t_{2})$

, so $c_{2}$ $c_{2}$ $c_{2}$

is a commitment to $s^{2}$ $s^{2}$ $s^{2}$

in base $g$ $g$

Once $c_{1}$ $c_{1}$ $c_{1}$

has been generated, Alice can easily generate $c_{2}$ $c_{2}$ $c_{2}$

, provide both values to Bob, and use the equality proof above to demonstrate that $c_{2}$ $c_{2}$ $c_{2}$

commits to the square of the value committed to by $c_{1}$ $c_{1}$ $c_{1}$

Security Considerations #

Generator Selection #

Suppose that Alice knows $l = \log_{g} (h)$ $l = \log_{g} (h)$ $l = \log_{g} (h)$ $l = \log_{g} (h)$ $l = \log_{g} (h)$ $l = \log_{g} (h)$ $l = \log_{g} (h)$ $l = \log_{g} (h)$

and has a commitment $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$ $c = C (s, t) = g^{s} h^{t}$

Then Alice can rewrite the commitment as $c = g^{s} h^{t}$ $c = g^{s} h^{t}$ $c = g^{s} h^{t}$ $c = g^{s} h^{t}$ $c = g^{s} h^{t}$ $c = g^{s} h^{t}$ $c = g^{s} h^{t}$

as $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$ $c = g^{s} {(g^{l})}^{t} = g^{s} g^{t l} = g^{s + t l}$

. Let $s^{'} = s + l$ $s^{'} = s + l$ $s^{'} = s + l$ $s^{'} = s + l$ $s^{'} = s + l$ $s^{'} = s + l$ $s^{'} = s + l$

and $t^{'} = t - 1$ $t^{'} = t - 1$ $t^{'} = t - 1$ $t^{'} = t - 1$ $t^{'} = t - 1$ $t^{'} = t - 1$ $t^{'} = t - 1$

. She can the fraudulently “open” the commitment $c$ $c$

by sending $(s^{'}, t^{'})$ $(s^{'}, t^{'})$ $(s^{'}, t^{'})$ $(s^{'}, t^{'})$ $(s^{'}, t^{'})$ $(s^{'}, t^{'})$ $(s^{'}, t^{'})$ $(s^{'}, t^{'})$

. This will appear as a valid opening to Bob, since:

$g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$ $g^{s^{'}} h^{t^{'}} = g^{s + 1} {(g^{l})}^{t - 1} = g^{s + l} g^{l (t - 1)} = g^{s + l} g^{t l - l} = g^{s + t l} = g^{s + t l} = c$

If the discrete logarithm of $h$ $h$

with respect to $g$ $g$

is known to Alice (or if an insecure group is chosen that makes computing the discrete log easy), the binding property is lost.

This is why it is important to ensure that generators $g$ $g$

and $h$ $h$

are selected independently. Ideally, $g$ $g$

and $h$ $h$

should be chosen independently from one another using a nothing-up-my-sleeve construction. For instance, $g$ $g$

and $h$ $h$

can be selected using an agreed-upon PRF and algorithm D.3.1 from the ANSI X9.62 standard (“Finding a Point on an Elliptic Curve”).

Random Number Generator Issues #

In selecting the hiding value $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$ $t \overset{$}{\leftarrow} Z_{q}$

, it is important that $t$ $t$

be truly uniform.

Suppose there is an attack on the process used to generate $t$ $t$

, and we have a set of commitments $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$ $c_{1}, c_{2}, \dots, c_{n}$

to secrets $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$ $s_{1}, s_{2}, \dots, s_{n}$

, not necessarily distinct. An attacker can then attack each $h^{t_{i}}$ $h^{t_{i}}$ $h^{t_{i}}$ $h^{t_{i}}$

and recover the corresponding values for $g^{s_{i}}$ $g^{s_{i}}$ $g^{s_{i}}$ $g^{s_{i}}$

. From this, the attacker can quickly identify repeated commitments to the same value. In cases where commitments are suspected of having a simple linear relationship (e.g. $s_{i} = k \cdot s_{j}$ $s_{i} = k \cdot s_{j}$ $s_{i} = k \cdot s_{j}$ $s_{i} = k \cdot s_{j}$ $s_{i} = k \cdot s_{j}$ $s_{i} = k \cdot s_{j}$ $s_{i} = k \cdot s_{j}$ $s_{i} = k \cdot s_{j}$

or $s_{i} = s_{j} + k$ $s_{i} = s_{j} + k$ $s_{i} = s_{j} + k$ $s_{i} = s_{j} + k$ $s_{i} = s_{j} + k$ $s_{i} = s_{j} + k$ $s_{i} = s_{j} + k$ $s_{i} = s_{j} + k$

for some known value of $k$ $k$

), these relationships can be recovered as well by examining $g^{s_{i}} g^{k}$ $g^{s_{i}} g^{k}$ $g^{s_{i}} g^{k}$ $g^{s_{i}} g^{k}$ $g^{s_{i}} g^{k}$ $g^{s_{i}} g^{k}$

and ${(g^{s_{i}})}^{k}$ ${(g^{s_{i}})}^{k}$ ${(g^{s_{i}})}^{k}$ ${(g^{s_{i}})}^{k}$ ${(g^{s_{i}})}^{k}$ ${(g^{s_{i}})}^{k}$ ${(g^{s_{i}})}^{k}$

References #

[Pedersen91] Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing (1991).
[ANSIX962] ANS X9.62-1998, Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA) (1998).

本文地址

https://architect.pub

登录发表评论
10 次浏览

发布日期

星期二, 一月 28, 2025 - 15:40

最后修改

星期二, 一月 28, 2025 - 15:59

热门内容

今日:

总体:

最近浏览：

热门内容

今日:

总体:

最近浏览：

【安全技术】佩德森承诺

category

Definition #

Intuition as to Why Pedersen Commitments are Binding #

Intuition as to Why Pedersen Commitments are Hiding #

The Additive Property #

Useful Algorithms and Properties of Pedersen Commitments #

Proof of Knowledge of Secret #

An Easy Proof of Equal Commitments #

Proof of Equal Commitments with Different Binding Generators #

In diagram form: #

Proof of Squared Commitments #

Security Considerations #

Generator Selection #

Random Number Generator Issues #

References #

Tags

最新内容

Tags