The recipient generates a private key $$x_r \in Z_q^*$$ and the corresponding public key $${y_r}_0 = G_0^{x_r}$$, $${y_r}_1 = G_1^{x_r}$$.