1
$\begingroup$

For EC Pedersen commitment: The two generators are G and H. Two messages and randomness are $m_1$, $m_2$, $r_1$, $r_2$, so the two Pedersen commitments are $Gm_1+Hr_1$ and $Gm_2+Hr_2$.

When adding these two, I got a new Pedersen commitment as $G(m_1+m_2)+H(r_1+r_2)$ with message $m_1+m_2$ and randomness $r_1+r_2$. But then what if the message $m_1+m_2$(or randomness $r_1+r_2$) overflows?

For example messages are in field mod 2^64, than if message becomes some 2^64+1, it would become 1. As G*(2^64+1) should not equal to G*1, unless G has the order of 2^64.

$\endgroup$

1 Answer 1

2
$\begingroup$

But then what if the message $m_1+m_2$(or randomness $r_1+r_2$) overflows
For example messages are in field mod 2^64, than if message becomes some 2^64+1, it would becomes 1

With Pedersen, the points $G, H$ have a prime order (lets call that $q$); when you add the two commitments, you effectively get $G(m_1 + m_2 \bmod q) + H(r_1 + r_2 \bmod q)$. It doesn't matter how you thought about the messages before you generated the commitments. For example, you always picked the $m_1, m_2$ values from 0 to $2^{64}-1$ and think of them as values from $\mathbb{Z}_{2^{64}}$, Pederson will still add them modulo $q$.

BTW: you really do need to pick the $r_1, r_2$ values randomly from 0 to $q-1$ - otherwise, you lose the hiding property. For example, if you did select $r_1 \in [0, 2^{64}-1]$ (and the attacker knew that), then he could test whether a specific $m_1$ value was likely what was committed to with $O(2^{32})$ effort, which is quite practical.

But then what if the message $m_1+m_2$(or randomness $r_1+r_2$) overflows

Nothing special happens; the logical additions happen modulo $q$, no big deal; they'll wrap around. Of course, if you do select $m_1, m_2 \in [0, 2^{64}-1]$ (which is quite safe, unlike the case of $r_1, r_2$), that addition won't wrap (because $q \ggg 2^{64}$, at least, for any curve which is actually secure)

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.