Verification

c0

P1, ... , Pn

s1, ... , sn

m

Equation 2
then finds c1 , c2 , ... , c_n-1
Finally, c’0 is calculated according to cn-1 and judged

c₁ = Hash(m, (s₃ * G) + (c₃ * P₃)) = ea4e0fd9c64c5d912fce8df7de0148bdb437353b5568fa16543f136e065ecd3c

c₂ = Hash(m, (s₁ * G) + (c₁ * P₁))

c₃ = Hash(m, (s₂ * G) + (c₂ * P₂))