I have a protocol that operates in the malicious setting which involves parties sending each other group elements $u\in \mathbb{G}$ of a specific form (For example, these are messages of the form $u=g^{\alpha}\cdot h^{\beta}$ with generators $h,g\in \mathbb{G}$ and $\alpha, \beta \in \mathbb{Z}_q$ for some prime $q$).
Additionally, these parties attach non-interactive zero-knowledge proofs of knowledge that show that the group elements sent are indeed of that form (for instance, the group elements sent were not picked in an oblivious manner). So, if a party in the protocol sends $u=g^{\alpha}\cdot h^{\beta}$ it also has to attach $\pi_{g,h}(u)$ which is a ZKPOK that proves that $u$ is in the desired form.
In my attempts to prove soundness of a protocol, I am assuming in contradiction that there exists a PPT adversary $\mathcal{A}$ which breaks the protocol, and then I use $\mathcal{A}$ as a subroutine in a new PPT $\mathcal{B}$ which breaks an intractable problem (specifically, Discrete Logarithm in $\mathbb{G}$).
However, my problem is that I want $\mathcal{B}$ to use $\mathcal{A}$ in a black box manner, but I also want to use its "exponents" (discrete logarithms) $\alpha, \beta$ after running $\mathcal{A}$ in order to compute the discrete logarithm of an arbitrary group element $a\in \mathbb{G}$. However, $\mathcal{A}$ can choose $\alpha, \beta$ in any manner which $\mathcal{B}$ running $\mathcal{A}$ may not know.
How do I resolve this disparity?
What I had in mind, is to have $\mathcal{A}$ output $\alpha, \beta$ as part of its output, and reason that since $\mathcal{A}$ has to attach a ZKPOK of $\alpha, \beta$ when sending its group element(s), it computed $\alpha, \beta$ on its own and therefore it can also output them.
- Can I alter $\mathcal{A}$'s output in such a manner to fit my needs?
- Is there a different / better approach to solve the problem where I need access to discrete logarithms sent by a party controlled by a black boxed PPT ?
- Can anyone point me to a paper that entails a proof with a similar technique?
Many thanks in advance.
