Given a group G of order q first where the Diffie$-$Hellman decision problem

it's hard. Let g$,$ h be generators of G such that the distinct logarithms logg h and logh are unknown

g$.$ In this group we define the Pedersen binding scheme by

commit algorithm Commit$($m$,$ r$)=$ c $=$ g

mh

r with m$,$ r in Z

$$

q

$.$

Consider the following protocol $\backslash$Pi with public input $$G$,$ g$,$ h$,$ q$,$ c$$ that proves that the

prover knows m$,$ r such that c $=$ g

mh

r

:

$$ The prover uniformly chooses a t$1,$ t$2$ in Z

$$

q and sends to the verifier to t $=$ g

t$1$ h

t$2$

$.$

$$ The verifier uniformly chooses e in Z

$$

q and sends it to the prover.

$$ The prover calculates s$1=$ t$1+$ em mod q$,$ s$2=$ t$2+$ er mod q and sends them to

verifier.

$$ The verifier accepts if and only if g

s$1$ h

s$2=$ tce

$.$

$1.$ It is the $\backslash$Pi $\backslash$Sigma $-$protocol, i$.$e$.$ it has completeness, special correctness, zero knowledge

for honest verifiers?Justify your answers.

$2.$ Is P witness indistinguishable?That is$,$ given an honest prover and common

public input $$G$,$ g$,$ h$,$ q$,$ c$$ what conclusions can a malicious verifier draw, from discussions $($t$,$ e$,$ s$1,$ s$2)$ for witness $($m$,$ r$)$ and $($t

$$

$,$ e$$

$,$ s$$

$1$

$,$ s$$

$2$

$)$ for witness

$($m$$

$,$ r$$

$)$ with m $=$ m$$ and r $=$ r

$$

$.$

$3.$ Change $\backslash$Pi to $\backslash$Pi $$

$,$ so that in the first step the prover calculates and sends instead

for t $=$ g

t$1$ h

t$2$ the values a $=$ g

t$1$ and b $=$ h

t$2$

$.$ What is the relationship that should be checked by

verifier to make sure prover knows m$,$ r$?$Is $\backslash$Pi $\backslash$Sigma $-$protocol now?