zkmul

type Commitment struct {
	// A = α ⊙ Y % ρ
	A *paillier.Ciphertext
	// B = Enc(α;s)
	B *paillier.Ciphertext
}

type Private struct {
	// X = x is the plaintext of Public.X.
	X *saferith.Int

	// Rho = ρ is the nonce for Public.C.
	Rho *saferith.Nat

	// RhoX = ρₓ is the nonce for Public.X
	RhoX *saferith.Nat
}

type Proof struct {
	*Commitment
	// Z = α + ex
	Z *saferith.Int
	// U = r⋅ρᵉ mod N
	U *saferith.Nat
	// V = s⋅ρₓᵉ
	V *saferith.Nat
}

type Public struct {
	// X = Enc(x; ρₓ)
	X *paillier.Ciphertext

	// Y is a ciphertext over the prover's public key
	Y *paillier.Ciphertext

	// C = x ⊙ Y % ρ
	C *paillier.Ciphertext

	// Prover = N
	Prover *paillier.PublicKey
}