$H_1(m)$ - ‘hash to group’ of message

$sk$ - private key

$pk=sk \cdot g$ - public key

$H_2$ - hash to field

Wallet enclave chooses $r$ (i.e. https://datatracker.ietf.org/doc/html/rfc6979#section-3.2) and outputs $(s, c, t)$

$t = sk \cdot H_1(m)$

$c=H_2(g,pk, H_1(m), t, R_1, R_2)$

$R_1 = r \cdot g$

$R_2 = r \cdot H_1(m)$

$s=r+c \cdot sk$

Verifier calculates (i.e. inside SNARK):

$A = s \cdot g - c \cdot pk$

$B = s \cdot H_1(m) - c \cdot t$

And checks:

$c=H_2(g,pk, H_1(m), t, A, B)$

Use $t$ as nullifier