Zero Knowledge Proof extended Schnorr - average secrets I am trying to compute and an overall average number of given secrets from inside the commitments.
I have the following set-up:

Three commitments; 

$C_{1}(id, num, r) = g_{1}^{id} g_{2}^{num}  g_{3}^{r}$, 

$C_{2}(id, num, r) = g_{1}^{id} g_{2}^{num}  g_{3}^{r}$, 

$C_{3}(id, num, r) = g_{1}^{id} g_{2}^{num}  g_{3}^{r}$. In this we have secret parameters $id$, $num$ and $r$ (random opening). Also for each commitment $id$ and $num$ are different.

So my question is how can I prove to someone what the overall average of nums is without revealing the individual num/s?

Secondly, how could the ids be hidden as along with secrets and still only prove the average?

I tried adding another commitment and just having a linear relation between secrets $num$. However I have a feeling it is not the correct way of dealing with it.
Here is a protocol that seems to fit your requirements: Let P be a prover and V be a verifier. $g_1,g_2,g_3$ are all generators of a group of order $p$ in which the discrete logarithm cannot be solved efficiently (note: you don't need Diffie-Hellman to be hard, discrete log is sufficient). (I assume that neither P nor V know the discrete log of $g_i$ in base $g_j$ for $i \neq j$).

Both players know three group elements $C_1,C_2,C_3$. First, P sends a value $a$ to V, which is the sum of the $num_i$ (this is perfectly equivalent to giving the average). Now, P intends to prove to V that he knows $(id_i, num_i,r_i)_{i\leq 3}$ such that $C_i = g_1^{id_i}g_2^{num_i}g_3^{r_i}$ for $i\leq 3$, and $a = num_1 + num_2 + num_3$.

Note: it is important to remark that this can only be a proof of knowledge of such values, and not a proof of their existence, as for any triple $(C_1,C_2,C_3)$, there exist many values satisfying your requirements.

Protocol:


P picks nine random exponents $(x_i,y_i,z_i)_{i\leq 3}$, with the constraint that $y_1+y_2+y_3 = 0 \bmod p$, and sends $(R_i)_{i\leq 3} = (g_1^{x_i}g_2^{y_i}g_3^{z_i})_{i\leq 3}$ to V.
V sends a random challenge $e \leq p$ to P.
P sends $(u_i)_{i\leq 3} = (e\cdot id_i + x_i \bmod p)_{i\leq 3}$, $(v_i)_{i\leq 3} = (e\cdot num_i + y_i \bmod p)_{i\leq 3}$, and $(w_i)_{i\leq 3} = (e\cdot r_i + z_i \bmod p)_{i\leq 3}$.
V checks that $C_i^{e} R_i = g_1^{u_i}g_2^{v_i}g_3^{w_i}$ for every $i \leq 3$, and that $v_1+v_2+v_3 = a\cdot e \bmod p$. He accepts if all the checks pass.


This is an honest-verifier zero-knowledge proof of knowledge of $(id_i, num_i,r_i)_{i\leq 3}$ such that $C_i = g_1^{id_i}g_2^{num_i}g_3^{r_i}$ for $i\leq 3$, and $a = num_1 + num_2 + num_3$ (hence, assuming the verifier behaves honestly, it reveals nothing about all those values, except that this statement is true). The average value is then just $a/3$. The protocol can be enhanced into a truly zero-knowledge protocol (which remains zero-knowledge even if the verifier is dishonest) using classical techniques (for example, by letting V send an extractable commitment of $e$ before the first flow of the protocol). It can also be made more efficient regarding communication, using batch techniques.

This is a quite classical example of a zero-knowledge proof of knowledge of discrete logarithms in multiple basis, satisfying some relations. The fact that the protocol is correct is easy to see from its description (if the prover is honest, then the proof is accepted). Proving that it is sound (the prover cannot cheat and make the proof pass without knowing such values) requires the use of a technique called rewinding (to show that if the proof pass, some simulator could extract the values by interacting with the prover, which shows that the prover know those values). Proving that it is (honest-verifier) zero-knowledge is done by showing that if the prover knows $e$ in advance , he can pass the proof even without knowing such values. However, writing the full proof formally would be a bit extensive here. Such proofs require to be already quite familiar with zero-knowledge proofs.