# Linear commitments for groups beyond $\mathbb{Z}_p$

I need a construction for the following: Given a group $$\mathbb{G}$$ of order $$p$$, enable a party to commit to a vector $$(x_1,\ldots,x_N)\in\mathbb{G}^n$$ in a way that, in a later phase, the party can open $$\sum_{i=1}^N c_i\cdot x_i$$ for some public coefficients $$c_1,\ldots,c_N\in\mathbb{Z}_p$$, while proving succinctly that this opening is done correctly.

KZG commitments can be seen as an example of this for $$\mathbb{G} = \mathbb{Z}_p$$ (and for 'structured coefficients' $$\gamma^0,\ldots,\gamma^{N-1}$$). However, for my use-case I need this for more general groups: concretely for elliptic curve groups and class groups.

The notion of Functional Commitments seems to be what I need, but I find this paper insufficient as it seems it only deals with the case $$\mathbb{G} = \mathbb{Z}_p$$.

Any pointers would be very welcome. Thanks!

• Your question only mention succinct openings; do you also need the commitments themselves to be succinct? Commented Jul 3 at 21:12
• Thanks @GeoffroyCouteau. Yep, also need the commitments to be succinct (perhaps with some non-succinct setup of course) Commented Jul 5 at 13:32

You can try looking at more general functional commitments, which work for functions $$f: \mathcal{X} \to \mathcal{Y}$$ for any finite sets $$\mathcal{X}, \mathcal{Y}$$. See these paper by de Castro and Peikert. This one is lattice based and has transparent setup!
I imagine for class groups, a functional commitment for vectors with entries in $$\mathbb Z_p$$ should suffice, because the ring of integers of any number field is a free module over $$\mathbb Z$$ (i.e any ring of integer element can be written as a $$\mathbb Z$$ linear combination of some basis elements). That is, you can uniquely represent any ring of integer element as a vector of integers with respect to the basis. You can take class group element representatives to be some ring of integer elements (i.e vectors with integer entries).