In the Kate Polynomial Commitment scheme, a commitment of a Polynomial $f(x)$ at $x=s$ is defined as
$Com_f = f(s).G$ where $G$ is the generator of the Elliptic Curve of prime order which is used.
So the polynomial to be committed, which Polynomial Ring should it be belong to?
Consider an Elliptic Curve $E$ defined over $F_p$. Let the order of the generator of Elliptic Curve which is used for the Commitment be the prime $q$. The Polynomial to be commited should be in $F_q[x]$ rather than in $F_p[x]$
If the polynomial which is committed is in $F_p[x]$ rather than in $F_q[x]$, then we run into the following problem.
$f_1 = a_0 + a_1x + ... + a_nx^n \in F_p[x]$ &
$f_2 = a_0 + a_1x + ... + a_nx^n \in F_q[x]$
Let's say the Reference String for the polynomial is sampled at $s$ (here again I think $s \in F_q$)
Let $f1(x=s) = v1$ & $f2(x=s) = v2$.
Now $v1.G$ will not the be the same as $(v1 \bmod p).G$ while
$v2.G$ will be the same as $(v2 \bmod q).G$ like it should be.
So I think that the polynomial should be in the Ring $F_q[x]$. However, I don't find any text of the Kate Polynomial Commitment Scheme which explicitly talks about which ring the polynomial to be committed is in.
A secondary point here is if for the Kate PCS, is it recommended to always use an Elliptic Curve of prime order or is it ok to work with an Elliptic Curve of composite order also as long as you use the generator of a prime order subgroup?