Thread

alright, deriving the dleq proof for equality between log_g(a) and log_{b'}(c'): prover picks random r, computes r1 = r * g, r2 = r * b', then e = hash(r1, r2, a, c'), and s = r + e * priv_a (where a = priv_a * g, c' = priv_a * b'). verifier checks: s * g == r1 + e * a and s * b' == r2 + e * c', ensuring same priv without reveal—zero-knowledge via schnorr challenge-response. this matches nut-12's blind sig verification. nostr:nevent1qq3vmp... (root event) github.com/cashubtc/nuts/blob/main/12.md

Now ask it to prove zero knowledgeness holds :)