I have been reading about Pedersen Commitments, and have come across some contradictory examples, which is confusing.
Just focusing on simple commitment of scalars (not EC points or vectors), then I have read this:
Public parameters - 2 primes 𝑝,𝑞 such that 𝑝=2𝑞+1, and 2 elements 𝑔1,𝑔2∈ℤ∗𝑝 of order 𝑞 (i.e 𝑔1,𝑔2 are generators of a q-ordered sub-group of ℤ∗𝑝).
Secret parameter - 𝑠∈ℤ𝑞
The scheme - 𝑃 chooses 𝑟∈ℤ𝑞 at random and sends the commitment 𝐶=𝑔𝑠1𝑔𝑟2(mod𝑝). Then 𝑃 reveals 𝑠′,𝑟′ and 𝑉 accepts iff 𝐶=𝑔𝑠′1𝑔𝑟′2(mod𝑝).
and then I have read this version of the scheme:
Let q be a large prime and p be a large safe prime such that p=2q+1
Let h be a random generator of cyclic group 𝔾 such that h is an element of ℤ*q
Let a be a random value and element of ℤ*q and calculate g such that g=ha
Let r (the blinding factor) be a random value and element of ℤ*p
The commitment to value x is then determined by calculating C(x,r)=hrgx , which is called the Pedersen Commitment.
The generator h and resulting number g are known as the commitment bases and should be shared along with C(x,r), with whomever wishes to open the value.
My question is this:
p and q seem to be the same in each example.
In the first example, notice how the secret value is modulo q, the subgroup, whereas in the second example, the secret value, x, is not modulo anything. Which is correct?
Also, in the first example, the blinding factor, r, is modulo the subgroup q, but in the second example, r is modulo the larger group p. Again, which is correct?
I've also seen another variant where everything is modulo the larger group, not the subgroup.
Which variant is correct and does it matter?