For Confidential Transactions a Pedersen commitment is being used. The commitment preserves addition and the commutative property applies: $$C(\text{BF}_1, \text{data}_1) \oplus C(\text{BF}_2, \text{data}_1) = C(\text{BF}_1 + \text{BF}_2, \text{data}_1 + \text{data}_1)$$$\oplus$ doesn't denote XOR here but more generally "another type of addition operation"
How can I prove these properties and how do we get blinded factor?

  • $\begingroup$ What do you mean with "paint"? And what do you mean with "blinded factor"? $\endgroup$
    – SEJPM
    Sep 28, 2016 at 20:42
  • $\begingroup$ How can I prove this property? The blinding factor is present because without one, someone could try guessing at the data; if your data is small and simple, it might be easy to just guess it and compare the guess to the commitment. (For Confidential Transactions) $\endgroup$
    – J.Madison
    Sep 28, 2016 at 20:47
  • $\begingroup$ Proving this property is trivial, just do the math on the same parameter set. However you need to replace the addition on the left side with a multiplication. For anybody interested, the original paper by Pedersen is freely available online by now. $\endgroup$
    – SEJPM
    Sep 28, 2016 at 20:55
  • $\begingroup$ C (BF1, data1) - this is a function of two variables? Can I convert to another type of this expression? $\endgroup$
    – J.Madison
    Sep 28, 2016 at 20:59
  • $\begingroup$ s is a random value? $\endgroup$
    – J.Madison
    Sep 29, 2016 at 14:07

1 Answer 1


First, we'll recap the Pedersen-Commitment scheme and then we'll show that it is indeed additively homomorphic. For reference, the original paper by Pedersen is free by now.

The commitment scheme

Let $q,p\in\mathbb P$ be primes such that $p=r\cdot q+1$, for some $r\in\mathbb N$. Let $q$ be the order of a subgroup of $\mathbb Z_p^*$ called $G_q$. Let $g,h\in G_q$ further be element of this group such that the $\log_g(h)$ is unknown to all parties.

A committer now commits to a value $s\in\mathbb Z_q$ by choosing a random $t\in\mathbb Z_q$ and publishing $$E(s,t)=g^s\cdot h^t\bmod p$$

He opens the commitment by simply publishing $(s,t)$ and he can't change the choice of $s$ if he published $E(s,t)$ except if he knows $\log_g(h)$ and somebody else obviously can't find out what $s$ is before the opening because it's blinded.

The homomorphic property

This assumes that you have committed to $s_1,s_2$ using $t_1,t_2$ as random blinding exponents. Now you can observe that (in $\mathbb Z_p^*$): \begin{eqnarray} E(s_1,t_1)\cdot E(s_2,t_2) & \equiv &(g^{s_1}\cdot h^{t_1})\cdot(g^{s_2}\cdot h^{t_2}) \\ & \equiv & (g^{s_1}\cdot g^{s_2})\cdot(h^{t_1}\cdot h^{t_2} \\ & \equiv & g^{s_1+s_2}\cdot h^{t_1+t_2} \\ & \equiv & E(s_1+s_2,t_1+t_2) \end{eqnarray}

You can create a new committment (as a sum) from two old ones, but then you also have to publish the new blinding exponent.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.