# Verify commitment C commits to the same value that E encrypts

Given the following (using additive notation):

• $$G$$ - generator of an elliptic curve group of order $$q$$
• $$s$$ - secret drawn uniformly from the distribution $$1..q$$
• $$k$$ and $$K$$ - a private public keypair
• $$E$$ - an encryption of $$s$$ under $$K$$
• $$C$$ - a commitment to $$s$$ such that $$C = sG$$.

Note that it's important that $$C$$ is formed as $$sG$$ - though pointers to general literature using any kind of commitments that satisfy the below problem would be appreciated as well.

How can I produce $$E$$ in such a way that, given $$E$$, $$C$$, and $$K$$, (and some other normal public info like generators, etc) one can verify that $$C$$ commits to the value that $$E$$ encrypts?

• Thank you @kelalaka for the formatting. – oren.tysor Oct 24 '19 at 21:11
• You have to do calculations with encrypted data. So the encryption function must be homomorphic in some sense. It means that it is necessary to specify the $E(K,s).$ – Alexey Ustinov Oct 25 '19 at 9:12
• As written, with the commitment and a guess to the secret, you can verify the secret. This is not true of standard commitment schemes - is that an intended feature of what you're looking for? – poncho May 21 '20 at 21:59
• @poncho I've revised the question to be more clear. By "a guess to the secret" do you mean a random guess as in a brute force? I looked at en.wikipedia.org/wiki/Commitment_scheme for my usage of commitment. If I'm using the terminology incorrectly by all means point me to a place to be more informed. – oren.tysor May 22 '20 at 12:00
• @RubenDeSmet: actually, his scheme $sG$ is not hiding at all; if someone has a guess to $s$, they can verify it. Hiding means that it is infeasible to gain any information about the secret, including 'is the secret this specific value?' – poncho May 22 '20 at 13:39