Homomorphism with subtraction for Pedersen Commitment

Question

I was trying to use Pedersen's homomorphic property for some privacy preserving mechanism, and to the best of my knowledge

$Com(x1,r1)\cdot Com(x2,r2)^{-1} = g^{x1-x2}h^{r1-r2}$

That is, if we commit $x1-x2$ with blinding factor $r1-r2$ we should get the commitment with value $Com(x1,r1)\cdot Com(x2,r2)^{-1}$.

However, I'm only getting this if $x1-x2>0$ and $r1-r2>0$. I believe this should hold whatever the values of $x1-x2$ or $r1-r2$.

I am taking the mod of all values i.e., $(x1-x2) mod\ p$ for some prime p, so none of the numbers are negative. So does Pedersen commitment not support homomorphism for subtraction?

Answer 1

You used the wrong modulus when verifying the result.

Note that although the computation is modulo $p$, i.e. you compute $g^xh^r \bmod p$, the exponents $x,r$ are in $Z_q$. And so the operations among the exponents are modulo $q$. That means, after the homomorphic operation, you get a commitment of $x_1-x_2 \bmod q$, not $x_1-x_2 \bmod p$ .