R = (M, {P_1,...,P_n}, c_1, {r_1,...,r_n})

L_1 = c_1 P + r_1 G
c_2 = H(M, L_1)               // H(...) is a hash function
...
L_i = c_i P + r_i G
c_{i+1} = H(M, L_i)
...
L_n = c_n P + r_n G

R^j = (M, {P_1^j,...,P_n^j}, c_1^j, {r_1^j,...,r_n^j})

c_1^1 = c_1^2 = ... = c_1^m
      = c_1

c_1 -> L_1^j -> c_2^j -> ... -> c_{n-1}^j -> L_n^j

c_1 = H(M, L_n^1, ..., L_n^m)