$H_1(m)$ - ‘hash to group’ of message
$sk$ - private key
$pk=sk \cdot g$ - public key
$H_2$ - hash to field
Wallet enclave chooses $r$ (i.e. https://datatracker.ietf.org/doc/html/rfc6979#section-3.2) and outputs $(s, c, t)$
$t = sk \cdot H_1(m)$
$c=H_2(g,pk, H_1(m), t, R_1, R_2)$
$R_1 = r \cdot g$
$R_2 = r \cdot H_1(m)$
$s=r+c \cdot sk$
Verifier calculates (i.e. inside SNARK):
$A = s \cdot g - c \cdot pk$
$B = s \cdot H_1(m) - c \cdot t$
And checks:
$c=H_2(g,pk, H_1(m), t, A, B)$
Use $t$ as nullifier