Zero Knowledge Argument for Elliptic Curve Multiplication/Inverse Multiplication Correctness?

Question

I was reading this post and the accepted answer wrote about a way to “prove that some list of points $[A,B,C,...]$ when multiplied by $x$ produces $[A′,B′,C′,...]$”. However, in their explanation their definition of $e$ seems to be self-referential. If you understand what they were getting at in that post, I'd appreciate if you could try to explain it.

I'm also curious if another zero knowledge argument of correctness is possible:

Alice performs a multiplication $A' = xA$, and later performs a multiplication $B' = x^{-1}B$. Alice does not know their discrete logarithms of $A$ and $B$ in respect to each other, however they are both within the subgroup generated by a publically known point $G$. If Bob knows $\left\lbrace A', A, B', B \right\rbrace$, how could Alice convince him that the multiplication done to compute $B'$ was the inverse of the multiplication done to compute $A'$ without revealing $x$, or ideally any information about $x$?

Answer 1

how could Alice convince him that the multiplication done to compute $B′$ was the inverse of the multiplication done to compute $A′$ without revealing $x$, or ideally any information about $x$?

If you've solved the previous problem (given $A, B, A', B'$, such that there exists an $x$ with $xA = A'$ and $xB = B'$), then it is easy; just do that procedure with the foursome:

$$(A, B', A', B)$$

That is, prove that there is a $y$ with $yA = A'$ and $yB' = B$.

If you have proved that, we have $x = y$ (and so the first half of the conjunction is $A' = xA$), and if we multiply both sides of $yB' = B$ by $x^{-1}$, we get $B' = (x^{-1})B$, which is exactly what you're asking for.

Answer 2

I realized that there is probably more content about this problem in the form of modular exponentiation. I found this page on the Chaum-Pedersen protocol, and it seems to translate pretty well into Elliptic Curve arithmetic (it actually looks a lot like ECDSA). I'm gonna try to write out my solution, apologies if my notation is ambiguous.

---

Zero Knowledge Argument for Elliptic Curve Multiplication

Alice has a sequence of $n$ points $p = \left<P_i | 0 < i \le n\right> = \left( P_1, \cdots, P_{n-1}, P_n \right)$. She wants to multiply all the points by a secret $x$ to get the sequence of products $q = \left<Q_i = xP_i | 0 < i \le n\right>$, and then send the tuple $\left( p, q \right)$ to Bob.

She wants to prove that she knows an $x$ such that for all $i \in \left\lbrace 1, \cdots, n-1, n \right\rbrace$ the equation $Q_i = xP_i$ is satisfied. Or in other words, that all $(P_i, Q_i)$ pairs share the same scalar factor $x$.

Generating the proof

1. Generate a random secure $k$ withing the order of the underlying ring, along with the sequence $r = \left<R_i = kP_i | 0 < i \le n\right>$
2. Create a hash commitment $c = H(p || q || r)$ and an accompanying scalar $s = k - cx$

Alice can now send Bob the tuple $(p, q, c, s)$ as a proof, or just $(c, s)$ if Bob already has $p$ and $q$.

Verifying correctness of proof

1. Create the sequence $r'=\left<R'_i = sP_i + eQ_i | 0 < i \le n\right>$
2. The proof is valid if $e = H(p||q||r')$, otherwise it is invalid.

Why this works

Start with the definition of $R'_i$

$R'_i = sP_i + cQ_i$

Expanding from the definitions $s = k - cx$ and $Q_i = xP_i$

$R'_i = (k - cx)P_i + (cx)P_i$

Since elliptic curve scalar multiplication distributes over addition, the $cx$ and $-cx$ terms cancel out

$R'_i = kP_i$

This means that $r' = r$, so $H(p||q||r)=H(p||q||r')$

---

Zero Knowledge Argument for Elliptic Curve Inverse Multiplication

As pointed out by poncho in another answer, the second problem I pointed out is just another form of the first problem.

If $A' = xA$ and $B' = x^{-1}B$, then since $B = xB'$ all you must do is generate a proof where $p = (A, B')$ and $q = (A', B)$