Given a pedersen commitment $P$, is it possible to show that I only know $a$ in $P=aG + bH + cQ$ in zero knowledge

  • $\begingroup$ Are you asking how to prove that you don't know $b, c$? Zero knowledge proofs generally can't prove lack-of-knowledge... $\endgroup$ – poncho Jun 12 at 14:45
  • $\begingroup$ @poncho you can know b, c. But the proof should only prove that you know a $\endgroup$ – WeCanBeFriends Jun 12 at 15:20
  • 4
    $\begingroup$ Given $P$ I can pick $a$ arbitrarily and then I ‘know’ some $a$ such that $P = [a]G + [b]H + [c]Q$, assuming $P$, $G$, $H$, and $Q$ all live in the same subgroup. (Of course, I can't find $b$ and $c$ without computing discrete logs here.) So, proving this is vacuous. What are you really trying to do? $\endgroup$ – Squeamish Ossifrage Jun 12 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.