[zk-sdk] Allow all-zero ciphertext for ciphertext-ciphertext equality proof

zk-sdk/src/sigma_proofs/ciphertext_ciphertext_equality.rs

@@ -152,10 +152,13 @@ impl CiphertextCiphertextEqualityProof {
         second_ciphertext: &ElGamalCiphertext,
         transcript: &mut Transcript,
     ) -> Result<(), EqualityProofVerificationError> {
+        // Reject if any public key or the first ciphertext is the identity point.
+        // The second ciphertext is allowed to be the identity point, as this is
+        // a common state in Token-2022.
         if first_pubkey.get_point().is_identity()
             || second_pubkey.get_point().is_identity()
             || first_ciphertext.commitment.get_point().is_identity()
-            || second_ciphertext.commitment.get_point().is_identity()
+            || first_ciphertext.handle.get_point().is_identity()
         {
             return Err(SigmaProofVerificationError::IdentityPoint.into());
         }

zk-sdk/src/sigma_proofs/ciphertext_commitment_equality.rs

@@ -145,6 +145,7 @@ impl CiphertextCommitmentEqualityProof {
     ) -> Result<(), EqualityProofVerificationError> {
         if pubkey.get_point().is_identity()
             || ciphertext.commitment.get_point().is_identity()
+            || ciphertext.handle.get_point().is_identity()
             || commitment.get_point().is_identity()
         {
             return Err(SigmaProofVerificationError::IdentityPoint.into());