# What is the reason of using Pedersen Commitment scheme over HMAC?

I want to implement non-interactive Bit Commitment scheme for messages of arbitrary length.

And I am curious, what is the reason of using Pedersen Commitment scheme over Salted Hash (in other words HMAC).

Example is coin flipping protocol from Wikipedia:

1. Alice "calls" the coin flip but only tells Bob a commitment to her call,
2. Bob flips the coin and reports the result,
3. Alice reveals what she committed to,
4. Bob verifies that Alice's call matches her commitment,
5. If Alice's revelation matches the coin result Bob reported, Alice wins

With HMAC Alice calculates a hash of her call at step 1 and reports it to Bob, keeps key (salt) in secret. During reveal step (3) she reveals a key.

With Pedersen Commitment scheme she reports her commitment at step 1, then reveals her call at step 3 with additional data, related to scheme.

In many applications, especially in zero-knowledge proofs, we need commitment schemes that are additively homomorphic. Pedersen commitment schemes do have this property, hash-based commitment schemes don't.

If we do Pedersen commitments on elliptic curves for performance reasons, where we fix two points $$P$$ and $$Q$$ on a curve, we can define:

$$\text{commit}(s,r) := sP + rQ$$

Or, in the more general form if we fix points $$P_1, \ldots, P_n$$, $$Q$$ on the curve, we can commit to multiple values $$s_1, \ldots, s_n$$ at once:

$$\text{commit}(s_1, s_2, ..., s_n, r) := s_1P_1 + s_2P_2 + ... + s_nP_n + rQ$$

This Pedersen commitment scheme is additively homomorphic. Indeed, in the $$\text{commit}(s,r)$$ case for just one value, we can commit to the addition of two values $$s_1$$ and $$s_2$$:

$$\text{commit}(s_1 + s_2, r_1 + r_2) = (s_1 + s_2)P + (r_1 + r_2)Q$$

which is equal to

$$(s_1P + r_1Q) + (s_2P + r_2Q) = \text{commit}(s_1, r_1) + \text{commit}(s_2, r_2)$$

It also holds true for the simultaneous commitment of $$n$$ values $$s_1, \ldots, s_n$$.

Hash-based schemes where

$$\text{commit}(s,r) := H(s)P + rQ$$

$$\text{commit}(s_1+s_2, r_1+r_2) \ne H(s_1 || s_2)P + (r_1+r_2)Q$$