zkaffp

type Commitment struct {
	// A = (α ⊙ Kv) ⊕ Enc₀(β; ρ)
	A *paillier.Ciphertext
	// Bx = Enc₁(α;ρₓ)
	Bx *paillier.Ciphertext
	// By = Enc₁(β;ρy)
	By *paillier.Ciphertext
	// E = sᵃ tᵍ (mod N)
	E *saferith.Nat
	// S = sˣ tᵐ (mod N)
	S *saferith.Nat
	// F = sᵇ tᵈ (mod N)
	F *saferith.Nat
	// T = sʸ tᵘ (mod N)
	T *saferith.Nat
}

type Private struct {
	// X ∈ ± 2ˡ
	X *saferith.Int
	// Y ∈ ± 2ˡº
	Y *saferith.Int
	// S = s
	// Original name: ρ
	S *saferith.Nat
	// Rx = rₓ
	// Original name: ρx
	Rx *saferith.Nat
	// R = r
	// Original name: ρy
	R *saferith.Nat
}

type Proof struct {
	*Commitment
	// Z1 = Z₁ = α+ex
	Z1 *saferith.Int
	// Z2 = Z₂ = β+ey
	Z2 *saferith.Int
	// Z3 = Z₃ = γ+em
	Z3 *saferith.Int
	// Z4 = Z₄ = δ+eμ
	Z4 *saferith.Int
	// W = w = ρ⋅sᵉ (mod N₀)
	W *saferith.Nat
	// Wx = wₓ = ρₓ⋅rₓᵉ (mod N₁)
	Wx *saferith.Nat
	// Wy = wy = ρy ⋅rᵉ (mod N₁)
	Wy *saferith.Nat
}

type Public struct {
	// Kv is a ciphertext encrypted with Nᵥ
	// Original name: C
	Kv *paillier.Ciphertext

	// Dv = (x ⨀ Kv) ⨁ Encᵥ(y;s)
	Dv *paillier.Ciphertext

	// Fp = Encₚ(y;r)
	// Original name: Y
	Fp *paillier.Ciphertext

	// Xp = Encₚ(x;rₓ)
	Xp *paillier.Ciphertext

	// Prover = N₁
	// Verifier = N₀
	Prover, Verifier *paillier.PublicKey
	Aux              *pedersen.Parameters
}