# Homomorphism with subtraction for Pedersen Commitment

I was trying to use Pedersen's homomorphic property for some privacy preserving mechanism, and to the best of my knowledge

$Com(x1,r1)\cdot Com(x2,r2)^{-1} = g^{x1-x2}h^{r1-r2}$

That is, if we commit $x1-x2$ with blinding factor $r1-r2$ we should get the commitment with value $Com(x1,r1)\cdot Com(x2,r2)^{-1}$.

However, I'm only getting this if $x1-x2>0$ and $r1-r2>0$. I believe this should hold whatever the values of $x1-x2$ or $r1-r2$.

I am taking the mod of all values i.e., $(x1-x2) mod\ p$ for some prime p, so none of the numbers are negative. So does Pedersen commitment not support homomorphism for subtraction?

Note that although the computation is modulo $p$, i.e. you compute $g^xh^r \bmod p$, the exponents $x,r$ are in $Z_q$. And so the operations among the exponents are modulo $q$. That means, after the homomorphic operation, you get a commitment of $x_1-x_2 \bmod q$, not $x_1-x_2 \bmod p$ .
• do you know a combination of $p,q, g$ and $h$ that I can use to test my code? I am taking modulus q but still not getting the values to be equal. Jul 3 '18 at 17:16
• You can use for example parameters in RFC 6979 (A.2.1. ) ietf.org/rfc/rfc6979.txt You can use $p,q,g$ in it and $y$ (as $h$). Jul 3 '18 at 18:03