Suppose there is a set $P=\{p_1, p_2, ..,p_l\}$ of stock buyers who can make commitments to a share $s_i$ in a set $S=\{s_1,s_2,...,s_m\}$ of shares for an amount $a_i$ in a set $A=\{a_1,a_2,...,a_n\}$. They can make commitments only till a certain time period, say $T$. But people in this group are nasty and will try to break the scheme. They may send wrong commitments, may commit to shares not in S or may not open their commitments later.

The commitments are provided to a person $\mathcal{B}$.

Intent of $\mathcal{B}$ is to find, after time $T$, the total amounts commited to each individual share $s_i$ in $S$ without knowing which person in $P$ commited to which share in $S$. $\mathcal{B}$ wants to ignore (and may be report) any incorrect commitment or the ones which are not opened even after expiry of time $T$.

I thought Pederson commitments can be used here since they have homomorphic additive property. But, I have few queries.

  1. How can we do homomorphic addition for individual shares in $S$?

  2. When we homomorphically add two commitments, we assume they are correct and will be opened later. But, in this case, people in $P$ may not do any of them. How to tackle this part?

  3. Or, should I look for some other commitment scheme?

  • $\begingroup$ In KZG commitments, which are also homomorphically additive, if $C_f$ is commitment to polynomial $f$ & $C_g$ is commitment to polynomial $g$, then commitment of polynomial $h$ defined as $h = f + g$ would be $C_f + C_g$ - this is easily proven by the definition of the commitment itself $\endgroup$
    – user93353
    Commented Apr 28 at 11:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.