zero-knowledge proof for correct construction of ciphertext

[omershlo]

To prove a ciphertext is constructed correctly such that :
C = Enc(m,r) = g^m r^N mod N^2

1. Verifier commits to a random string com(e) of length t bits
2. Prover creates t encryptions using {m_i , r_i} and sends to the Verifier the vector of encryptions [C_1,...,C_t]
3. Verifier decommits to e
   4.1) if e_i = 0: the Prover sends {m_i , r_i}
   4.2) if e_i= 1: the Prover sends {m', r'} = {m + m_i, r*r_i}
4. Verifier checks C_i = Enc{m_i, r_i} for zero bits and Enc(m', r') = C*C_i otherwise

C is constructed correctly with probability 1-1/2^t