#[0]
may i ask you to take a look at this, and confirm, that R1 and R2 will be different and the proof will fail, because they will actually be -r*G and -r*B'?
Discussion
Yeah there's a sign error there.
Generally we go with s = r + e*x (but in the literature you will occasionally see a s = r - e*x variant, which ofc makes no difference). Here they seem to have mixed it up in the verify step.
or, well not that actually, just a sign error 😄
my solution was that i replaced the sides in the substraction. previously tried to make it work x-only and that sort of worked, but this seems better.
as in taking x only for the 4 points in the hash for e, that actually worked.
x-only just makes it more confusing, but it's a separate thing right. The general pattern for DLEQ is:
proving P_1 and P_2 have same DL for A,B:
s = r + ex, where e = H(R_1,R_2,P_1, P_2) where R_1 = rA and R_2 = rB and P_1 = xA and P_2=xB.
Then return s, e, R_1, R_2
Then verify with
sA =?= R_1 + eP_1, sB =?= R_2 + eP_2, with e calculated as above.
thank you!