@profile<EOL>def verifyGt(x, tTilde, y, pi, errorOnFail=True):
<EOL>p,c,u = pi<EOL>assertType(x, G1Element)<EOL>assertType(tTilde, G2Element)<EOL>assertType(y, GtElement)<EOL>assertType(p, GtElement)<EOL>g = generatorGt()<EOL>beta = pair(x,tTilde)<EOL>t1 = g**u * p**c <EOL>t2 = beta**u * y**c<EOL>cPrime = hashZ(g,p,beta,y,t1,t2)<EOL>if cPrime == c:<EOL><INDENT>return True<EOL><DEDENT>if errorOnFail:<EOL><INDENT>raise Exception("<STR_LIT>")<EOL><DEDENT>else:<EOL><INDENT>return False<EOL><DEDENT>
Verifies a zero-knowledge proof. 
@x: Blinded message, G1Element, x = HG1(m)*r
@tTilde: hashed tweak, G2Element, t~ = HG2(t)
@y: server response (intermediate result), GtElement
@pi:  pi = (p, c, u), zero-knowledge proof from server, 
  p = g^kw, GtElement; c,u integer values
@errorOnFail: Rasise an exception if the proof does not hold.