-1
$\begingroup$

For Confidential Transactions a Pedersen commitment is being used. The commitment preserves addition and the commutative property applies: $$C(\text{BF}_1, \text{data}_1) \oplus C(\text{BF}_2, \text{data}_1) = C(\text{BF}_1 + \text{BF}_2, \text{data}_1 + \text{data}_1)$$$\oplus$ doesn't denote XOR here but more generally "another type of addition operation"
How can I prove these properties and how do we get blinded factor?

$\endgroup$
  • $\begingroup$ What do you mean with "paint"? And what do you mean with "blinded factor"? $\endgroup$ – SEJPM Sep 28 '16 at 20:42
  • $\begingroup$ How can I prove this property? The blinding factor is present because without one, someone could try guessing at the data; if your data is small and simple, it might be easy to just guess it and compare the guess to the commitment. (For Confidential Transactions) $\endgroup$ – J.Madison Sep 28 '16 at 20:47
  • $\begingroup$ Proving this property is trivial, just do the math on the same parameter set. However you need to replace the addition on the left side with a multiplication. For anybody interested, the original paper by Pedersen is freely available online by now. $\endgroup$ – SEJPM Sep 28 '16 at 20:55
  • $\begingroup$ C (BF1, data1) - this is a function of two variables? Can I convert to another type of this expression? $\endgroup$ – J.Madison Sep 28 '16 at 20:59
  • $\begingroup$ s is a random value? $\endgroup$ – J.Madison Sep 29 '16 at 14:07
1
$\begingroup$

First, we'll recap the Pedersen-Commitment scheme and then we'll show that it is indeed additively homomorphic. For reference, the original paper by Pedersen is free by now.


The commitment scheme

Let $q,p\in\mathbb P$ be primes such that $p=r\cdot q+1$, for some $r\in\mathbb N$. Let $q$ be the order of a subgroup of $\mathbb Z_p^*$ called $G_q$. Let $g,h\in G_q$ further be element of this group such that the $\log_g(h)$ is unknown to all parties.

A committer now commits to a value $s\in\mathbb Z_q$ by choosing a random $t\in\mathbb Z_q$ and publishing $$E(s,t)=g^s\cdot h^t\bmod p$$

He opens the commitment by simply publishing $(s,t)$ and he can't change the choice of $s$ if he published $E(s,t)$ except if he knows $\log_g(h)$ and somebody else obviously can't find out what $s$ is before the opening because it's blinded.


The homomorphic property

This assumes that you have committed to $s_1,s_2$ using $t_1,t_2$ as random blinding exponents. Now you can observe that (in $\mathbb Z_p^*$): \begin{eqnarray} E(s_1,t_1)\cdot E(s_2,t_2) & \equiv &(g^{s_1}\cdot h^{t_1})\cdot(g^{s_2}\cdot h^{t_2}) \\ & \equiv & (g^{s_1}\cdot g^{s_2})\cdot(h^{t_1}\cdot h^{t_2} \\ & \equiv & g^{s_1+s_2}\cdot h^{t_1+t_2} \\ & \equiv & E(s_1+s_2,t_1+t_2) \end{eqnarray}

You can create a new committment (as a sum) from two old ones, but then you also have to publish the new blinding exponent.

$\endgroup$

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.