Adam Back / @adam3us on Nostr: **R to @adam3us: verifier can see that c=H(r*G+c*Q) but they don't learn x the secret ...
**R to @adam3us: verifier can see that c=H(r*G+c*Q) but they don't learn x the secret (private key). now there's a generalisation of that for an OR proof where we know the discrete log of A *OR* discrete log of B which is relatively simple. c1+c2=H(r1*G+c1*A, r1*G+c2*B) and that works because**
verifier can see that c=H(r*G+c*Q) but they don't learn x the secret (private key). now there's a generalisation of that for an OR proof where we know the discrete log of A *OR* discrete log of B which is relatively simple. c1+c2=H(r1*G+c1*A, r1*G+c2*B) and that works because**R to @adam3us: verifier can see that c=H(r*G+c*Q) but they don't learn x the secret (private key). now there's a generalisation of that for an OR proof where we know the discrete log of A *OR* discrete log of B which is relatively simple. c1+c2=H(…
https://nitter.net/adam3us/status/1605984020507947008#m
verifier can see that c=H(r*G+c*Q) but they don't learn x the secret (private key). now there's a generalisation of that for an OR proof where we know the discrete log of A *OR* discrete log of B which is relatively simple. c1+c2=H(r1*G+c1*A, r1*G+c2*B) and that works because**R to @adam3us: verifier can see that c=H(r*G+c*Q) but they don't learn x the secret (private key). now there's a generalisation of that for an OR proof where we know the discrete log of A *OR* discrete log of B which is relatively simple. c1+c2=H(…
https://nitter.net/adam3us/status/1605984020507947008#m