I am building a range proof to prove that a secret number x lies between a specific range a

prover commits to a values a<x<b

prover generates a pedersen commitment to a value a

prover generates a range proof to commitment that is commitment from 1 minus commitment from 2

prover sends range proof together with the opening of the commitment from 2

regarding step 3, how do I subtract one commitment from another? is there a better way?

Note: I am using the a javascript implementation to calculate the pederssen commitment https://github.com/omershlo/simple-bulletproof-js

  • 2
    $\begingroup$ Am I understanding you correctly, that given two Perdersen commitments to messages $a$ and $x$ you want to compute a Perdersen commitment to $x-a$? $\endgroup$
    – Maeher
    Feb 21 '19 at 18:02

how do I subtract one commitment from another?

Actually, it's surprisingly simple; you subtract the two commitments (and, no, that's not a joke, that's really how you do it).

That is, if we have a commitment $C_1 = x_1G + r_1H$, which is a commitment to the value $x_1$ (you don't know what the values $x_1, r_1$ are, but the prover does.

And, you have a commitment $C_2 = x_2G + r_2H$, which is a commitment to the value $x_2$ (again, known to the prover).

Then, all you do is compute $C_1 - C_2$, that is subtracting these two elliptic curve points.

We have $C_1 - C_2 = (x_1 - x_2)G + (r_1 - r_2)H$; where the prover can compute $x_1 - x_2$ and $r_1 - r_2$, and so this is a valid commitment to the value $x_1 - x_2$ (which the prover can open, should he choose to), which is what you are asking for.

However, I am unfamiliar with the javascript package you're using; I am unable to point you to how you'd do that...

  • $\begingroup$ Thanks, your answer helped me ultimately find the solution $\endgroup$ Feb 22 '19 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.