Subtracting one pederssen commitment from another

I am building a range proof to prove that a secret number x lies between a specific range a

prover commits to a values a<x<b

prover generates a pedersen commitment to a value a

prover generates a range proof to commitment that is commitment from 1 minus commitment from 2

prover sends range proof together with the opening of the commitment from 2

regarding step 3, how do I subtract one commitment from another? is there a better way?

Note: I am using the a javascript implementation to calculate the pederssen commitment https://github.com/omershlo/simple-bulletproof-js

• Am I understanding you correctly, that given two Perdersen commitments to messages $a$ and $x$ you want to compute a Perdersen commitment to $x-a$? – Maeher Feb 21 at 18:02

how do I subtract one commitment from another?

Actually, it's surprisingly simple; you subtract the two commitments (and, no, that's not a joke, that's really how you do it).

That is, if we have a commitment $$C_1 = x_1G + r_1H$$, which is a commitment to the value $$x_1$$ (you don't know what the values $$x_1, r_1$$ are, but the prover does.

And, you have a commitment $$C_2 = x_2G + r_2H$$, which is a commitment to the value $$x_2$$ (again, known to the prover).

Then, all you do is compute $$C_1 - C_2$$, that is subtracting these two elliptic curve points.

We have $$C_1 - C_2 = (x_1 - x_2)G + (r_1 - r_2)H$$; where the prover can compute $$x_1 - x_2$$ and $$r_1 - r_2$$, and so this is a valid commitment to the value $$x_1 - x_2$$ (which the prover can open, should he choose to), which is what you are asking for.

However, I am unfamiliar with the javascript package you're using; I am unable to point you to how you'd do that...

• Thanks, your answer helped me ultimately find the solution – Pranav kirtani Feb 22 at 9:03