Consider a user wants to identify herself as the owner of two discrete logarithm based credentials: (pk1,sk1)=((ID1,p,g,y1),x1) and (pk2,sk2)=((ID2,p,g,y2),x2), where g^{x1} = y1 mod p and g^{x2} = y2 mod p. We have to design an identification scheme to allow her to identify to a server who has only access to pk1, pk2. Consider the following 3-message protocol: first, the user computes z=g^r*y1^a*y2^b mod p and sends it to the server; second, the server randomly chooses a challenge c and sends it to the user; third, the user sends X to the server, which accepts the user's identification if and only if a suitable equality is verified. For which of the following values for X, can this protocol solve our problem?


A. r+c*(x1+x2) mod (p-1)
B. r+c*a*x1+c*b*x2 mod (p-1)
C. r+(a+c)*x1+(b+c)*x2 mod (p-1)
D. r+c+a*x1+b*x2 mod (p-1)

Please explain your reasoning