zkenc

type Commitment struct {
	// S = sᵏtᵘ
	S *saferith.Nat
	// A = Enc₀ (α, r)
	A *paillier.Ciphertext
	// C = sᵃtᵍ
	C *saferith.Nat
}

type Private struct {
	// K = k ∈ 2ˡ = Dec₀(K)
	// plaintext of K
	K *saferith.Int

	// Rho = ρ
	// nonce of K
	Rho *saferith.Nat
}

type Proof struct {
	*Commitment
	// Z₁ = α + e⋅k
	Z1 *saferith.Int
	// Z₂ = r ⋅ ρᵉ mod N₀
	Z2 *saferith.Nat
	// Z₃ = γ + e⋅μ
	Z3 *saferith.Int
}

type Public struct {
	// K = Enc₀(k;ρ)
	K *paillier.Ciphertext

	Prover *paillier.PublicKey
	Aux    *pedersen.Parameters
}