I was trying to use Pedersen's homomorphic property for some privacy preserving mechanism, and to the best of my knowledge

$Com(x1,r1)\cdot Com(x2,r2)^{-1} = g^{x1-x2}h^{r1-r2}$

That is, if we commit $x1-x2$ with blinding factor $r1-r2$ we should get the commitment with value $Com(x1,r1)\cdot Com(x2,r2)^{-1}$.

However, I'm only getting this if $x1-x2>0$ and $r1-r2>0$. I believe this should hold whatever the values of $x1-x2$ or $r1-r2$.

I am taking the mod of all values i.e., $(x1-x2) mod\ p$ for some prime p, so none of the numbers are negative. So does Pedersen commitment not support homomorphism for subtraction?


You used the wrong modulus when verifying the result.

Note that although the computation is modulo $p$, i.e. you compute $g^xh^r \bmod p$, the exponents $x,r$ are in $Z_q$. And so the operations among the exponents are modulo $q$. That means, after the homomorphic operation, you get a commitment of $x_1-x_2 \bmod q$, not $x_1-x_2 \bmod p$ .

  • $\begingroup$ do you know a combination of $p,q, g$ and $h$ that I can use to test my code? I am taking modulus q but still not getting the values to be equal. $\endgroup$ Jul 3 '18 at 17:16
  • $\begingroup$ You can use for example parameters in RFC 6979 (A.2.1. ) ietf.org/rfc/rfc6979.txt You can use $p,q,g$ in it and $y$ (as $h$). $\endgroup$ Jul 3 '18 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.