# Pedersen commitments and addition

For Confidential Transactions a Pedersen commitment is being used. The commitment preserves addition and the commutative property applies: $$C(\text{BF}_1, \text{data}_1) \oplus C(\text{BF}_2, \text{data}_1) = C(\text{BF}_1 + \text{BF}_2, \text{data}_1 + \text{data}_1)$$$\oplus$ doesn't denote XOR here but more generally "another type of addition operation"
How can I prove these properties and how do we get blinded factor?

• What do you mean with "paint"? And what do you mean with "blinded factor"? – SEJPM Sep 28 '16 at 20:42
• How can I prove this property? The blinding factor is present because without one, someone could try guessing at the data; if your data is small and simple, it might be easy to just guess it and compare the guess to the commitment. (For Confidential Transactions) – J.Madison Sep 28 '16 at 20:47
• Proving this property is trivial, just do the math on the same parameter set. However you need to replace the addition on the left side with a multiplication. For anybody interested, the original paper by Pedersen is freely available online by now. – SEJPM Sep 28 '16 at 20:55
• C (BF1, data1) - this is a function of two variables? Can I convert to another type of this expression? – J.Madison Sep 28 '16 at 20:59
• s is a random value? – J.Madison Sep 29 '16 at 14:07

## 1 Answer

First, we'll recap the Pedersen-Commitment scheme and then we'll show that it is indeed additively homomorphic. For reference, the original paper by Pedersen is free by now.

## The commitment scheme

Let $q,p\in\mathbb P$ be primes such that $p=r\cdot q+1$, for some $r\in\mathbb N$. Let $q$ be the order of a subgroup of $\mathbb Z_p^*$ called $G_q$. Let $g,h\in G_q$ further be element of this group such that the $\log_g(h)$ is unknown to all parties.

A committer now commits to a value $s\in\mathbb Z_q$ by choosing a random $t\in\mathbb Z_q$ and publishing $$E(s,t)=g^s\cdot h^t\bmod p$$

He opens the commitment by simply publishing $(s,t)$ and he can't change the choice of $s$ if he published $E(s,t)$ except if he knows $\log_g(h)$ and somebody else obviously can't find out what $s$ is before the opening because it's blinded.

## The homomorphic property

This assumes that you have committed to $s_1,s_2$ using $t_1,t_2$ as random blinding exponents. Now you can observe that (in $\mathbb Z_p^*$): \begin{eqnarray} E(s_1,t_1)\cdot E(s_2,t_2) & \equiv &(g^{s_1}\cdot h^{t_1})\cdot(g^{s_2}\cdot h^{t_2}) \\ & \equiv & (g^{s_1}\cdot g^{s_2})\cdot(h^{t_1}\cdot h^{t_2} \\ & \equiv & g^{s_1+s_2}\cdot h^{t_1+t_2} \\ & \equiv & E(s_1+s_2,t_1+t_2) \end{eqnarray}

You can create a new committment (as a sum) from two old ones, but then you also have to publish the new blinding exponent.