Verifiable encryption of discrete log(s) from the paper Verifiable Encryption from MPC-in-the-Head.
Adapted to allow encrypting messages of a generalized Pedersen commitment and some other optimizations. See the corresponding module for more details.