Timeline for How does taking the difference between commitments verifies that the messages are correct?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 7, 2022 at 17:06 | comment | added | baro77 | @xenon I have edited my answer because my educated guess is that you need to recap the basics of proofs techniques.. hope my new words can help someway | |
| Nov 7, 2022 at 17:04 | history | edited | baro77 | CC BY-SA 4.0 |
added 1777 characters in body
|
| Nov 7, 2022 at 15:05 | comment | added | xenon | I've been thinking about it but I'm still not very sure. Sorry if I'm gonna sound dumb. I'm very new to these stuff. If it's as you said that the DLP can be broken this way, how is Pedersen commitment still used in so many places? It must have been secure to be used, isn't it? | |
| Nov 5, 2022 at 11:34 | comment | added | baro77 | #1 as far as G and H are on the same EC group there's just one j (mod the group order), if G and H are about different curves or groups I don't know if you can prove computational binding property at all; #2 just one j (mod...) as said before: if j_2 is calculated it's = j; #3 you're right, in fact the proof proves it will not be your case (j is calculated => DLP is broken, so take the contrapositive - justified by DLP hardness assumption) | |
| Nov 5, 2022 at 10:15 | comment | added | xenon | Follow-up #3: If $j$ can indeed be solved from $\frac{m_2 -m}{b-b_2} = j$, doesn’t this mean the pederson commitment can’t exactly bind to the original value because it seems like the original author could find a different $m_2$ and $b_2$ to match the commintment $C$? I think I’m missing something here.😬 | |
| Nov 5, 2022 at 10:14 | comment | added | xenon | Follow-up #2: When the original author fakes a different message $m_2$ for commitment $C$ and $m_2 \neq m$ with $b_2$, assuming there can only be one value for $j$ such that $H=jG$ (meaning no other value for $j$ to satisfy the equation), will this will cause $\frac{m_2 -m}{b-b_2} = j_2$ such that $j_2 \neq j$? Meaning $j_2$ is different from the original intended value of $j$ for $H=jG$? Since $m_2 \neq m$ and $b_2 \neq b$, the newly derived $j_2$ must be different from $j$ to keep $H$ the same original point so that $H=j_{2}G$, wouldn’t it? Since $j \neq j_2$, isn't the DLP not broken? | |
| Nov 5, 2022 at 10:13 | comment | added | xenon | Follow-up #1: Ohh... I've always thought $H$ is simply any generator point on the curve known to everyone and decided by the implementer? Will there always be a $j$ for any point on the curve $H$ such that $H=jG$? What if there isn't such a $j$ for a particular chosen point $H$ on the curve? | |
| Nov 5, 2022 at 8:48 | history | edited | baro77 | CC BY-SA 4.0 |
edited body
|
| Nov 4, 2022 at 8:15 | history | answered | baro77 | CC BY-SA 4.0 |