I need to design a Σ-protocol ZKP using Pedersen commitment scheme that proves knowledge of a, y such that statement A = h^y * g^a only holds for even y (y=2x). Of course, the protocol needs to be sound, special-sound, and honest-verifier zero-knowledge. Any suggestions?

Is it possible for an attacker on a Diffie-Hellman key exchange to manipulate both sides in a way so that the secret generated on each side is identical? Or put differently, would it be possible to detect an attack via MITM if we can detect via a different channel that the secrets of both parties...