Linear commitments for groups beyond $\mathbb{Z}_p$

Question

I need a construction for the following: Given a group $\mathbb{G}$ of order $p$, enable a party to commit to a vector $(x_1,\ldots,x_N)\in\mathbb{G}^n$ in a way that, in a later phase, the party can open $\sum_{i=1}^N c_i\cdot x_i$ for some public coefficients $c_1,\ldots,c_N\in\mathbb{Z}_p$, while proving succinctly that this opening is done correctly.

KZG commitments can be seen as an example of this for $\mathbb{G} = \mathbb{Z}_p$ (and for 'structured coefficients' $\gamma^0,\ldots,\gamma^{N-1}$). However, for my use-case I need this for more general groups: concretely for elliptic curve groups and class groups.

The notion of Functional Commitments seems to be what I need, but I find this paper insufficient as it seems it only deals with the case $\mathbb{G} = \mathbb{Z}_p$.

Any pointers would be very welcome. Thanks!

Answer 1

You can try looking at more general functional commitments, which work for functions $f: \mathcal{X} \to \mathcal{Y}$ for any finite sets $\mathcal{X}, \mathcal{Y}$. See these paper by de Castro and Peikert. This one is lattice based and has transparent setup!

I imagine for class groups, a functional commitment for vectors with entries in $\mathbb Z_p$ should suffice, because the ring of integers of any number field is a free module over $\mathbb Z$ (i.e any ring of integer element can be written as a $\mathbb Z$ linear combination of some basis elements). That is, you can uniquely represent any ring of integer element as a vector of integers with respect to the basis. You can take class group element representatives to be some ring of integer elements (i.e vectors with integer entries).