# What are the pros and cons of Pedersen commitments vs hash-based commitments?

Obviously, it's possible to create a commitment scheme comm(r, S) by using a hash function H and computing H(S||r). This scheme is secure under the assumption that H is collision and preimage resistant, which (IMO) is a lighter cryptographic assumption than the discrete log assumption.

So I guess my question is, why are commitment schemes like Pedersen commitments used which do require the latter assumption? What efficiency or security benefits they bring? And are there still any benefits to using hash commitments?

The hash-based commitment scheme you are sketching is in fact not secure under collision resistance and preimage resistance of the hash function. For hiding, you need to assume that the hash function you are using behaves like a random oracle (i.e., whenever queried on a new value it returns a uniformly random value from the output domain of the hash function, and for every repeated query it answers consistently).

The random oracle assumption is an idealizing assumption which is considered to be a rather strong assumption compared to the discrete log assumption.

• Interesting. Out of curiosity, is there a way to massage the hash-based scheme so that it doesn't depend on the RO assumption? And is there a good resource on commitment schemes in general? (I never learned about commitment schemes properly, so...) Jan 15, 2018 at 20:06
• For example, you could have a look at these lecture notes by Yevgeniy Dodis.
1. This commitment scheme by using a hash function is computationally hiding if the hash function be partial pre-image resistance. In the random oracle model, the scheme is therefor hiding as long as guessing a bit string of, say, $$k+1$$ bits is infeasible.
$$commit(u,x)=g^{u}h^{x}$$ where $$u\in_{R}\mathbb{Z}_{n}$$, $$x$$ is the committed value, $$g$$ is the generator of the cyclic group $$\langle g \rangle$$ of order a large prime $$n$$, $$h\in_{R}\langle g \rangle\setminus\{1\}$$ a random group element such that $$\log_{g} h$$ is not known to any party, neither the sender nor the receiver.
$$commit(u_{1},x_{1})\cdot_{\langle g \rangle}=commit(u_{2},x_{2})=commit(u_{1}+_{\mathbb{Z}_{n}}u_{2},x_{1}+_{\mathbb{Z}_{n}}x_{2})$$