Zero knowledge proof for Paillier addition under multiple keys
As far as I know, with the same public key $(g,n)$
I would change the problem to prove that if
$e_0 = E(m_1,r_1)\cdot E(m_2,r_2)$
then $m_0 = D(e_0) = m_1 + m_2 \bmod n$ where $D(e_0)$ is the result of decrypting ciphertext $e_0$. Thanks Geoffroy for your helpful comment and LaTeX conversion regarding my incorrect guess on the use of html here. .