_verify

Verifies that two encryptions for two keys are valid and that they are encrypting the same amount b. For this proof, the prover knows only one of the randoms values and knows the secret of the public key that does not know the random for. Let (L1, R1) = (g^b y^_r, g^_r), _r is unknown to the prover. The prover can decrypt b with the knowledge of x. By showing that L1 = g^b R^x whe can prove that the ElGamal encryption indeed encrypts b. The protocol runs as follows

    P:  kx, kb, kr <-- R     sends    Ax=g^kx, AL1 = g^kb R^kx, AL2 = g^kb y2^kr, AR2 = g^kr
    V:  c <-- R              sends    c
    P:  sx = k + c*x         sends    s
    P:  sb = kb + c*b        sends    sb
    P:  sr = kr + c*r        sends    sr

The verifier asserts:

• g^sx == Ax * (y^c) [poe]

• g^sb R1^sx == AL1 * (L1^c) [poe2]

• verifyElGamal for (L2,R2)

notation: (P)rover (V)erifier (R)andom

EC_MUL: 10; EC_ADD: 6

Fully qualified path: she::protocols::SameEncryptionUnknownRandom::_verify

pub fn _verify(
    L1: NonZero<EcPoint>,
    R1: NonZero<EcPoint>,
    L2: NonZero<EcPoint>,
    R2: NonZero<EcPoint>,
    g: NonZero<EcPoint>,
    y1: NonZero<EcPoint>,
    y2: NonZero<EcPoint>,
    Ax: NonZero<EcPoint>,
    AL1: NonZero<EcPoint>,
    AL2: NonZero<EcPoint>,
    AR2: NonZero<EcPoint>,
    c: felt252,
    sb: felt252,
    sx: felt252,
    sr2: felt252,
) -> Result<(), Errors>