sigma-protocols: extended DH (statistical case without known modulus); correct multiplication [cdn01]