Is there a zero-knowledge proof that proves that two Pedersen commitments commit the same value?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
An EC Pedersen commitment is of the form $C=(bG+vH)$, where $v$ is the scalar value being committed to, $b$ is the scalar blinding factor, and $G$ and $H$ are well-known generator points on the curve. They must be chosen such that the discrete log of $H$ w.r.t. $G$ is unknowable.
Let there be two commitments, $C_1$ and $C_2$ to the same value $v$ but with different blinding factors $b_1$ and $b_2$.
To prove that $C_1$ is a commitment to the same value as $C_2$, provide a signature (such as a Schnorr signature) for the public key $C_1-C_2$ on the generator point $G$.
This works because if the values are the same, they cancel out and $C_1-C_2=(b_1-b_2)G$. This means a signature can be provided, using the private key $b_1-b_2$.
If the values did not cancel each other out, then the private key required to generate the signature would be $b1-b2+v_1(G/H)-v_2(G/H)$. It is impossible to know this private key, because the EC discrete log assumption is that $G/H$ is unknowable.
Therefore, being able to provide a signature on the generator point $G$ proves the values must be the same.
The technique I've described is used as part of cryptocurrencies that use Greg Maxwell's confidential transactions protocol.
