2
$\begingroup$

Given the following (using additive notation):

  • $G$ - generator of an elliptic curve group of order $q$
  • $s$ - secret drawn uniformly from the distribution $1..q$
  • $k$ and $K$ - a private public keypair
  • $E$ - an encryption of $s$ under $K$
  • $C$ - a commitment to $s$ such that $C = sG$.

Note that it's important that $C$ is formed as $sG$ - though pointers to general literature using any kind of commitments that satisfy the below problem would be appreciated as well.

How can I produce $E$ in such a way that, given $E$, $C$, and $K$, (and some other normal public info like generators, etc) one can verify that $C$ commits to the value that $E$ encrypts?

Improve this question
$\endgroup$
8
  • 1
    $\begingroup$ Thank you @kelalaka for the formatting. $\endgroup$
    – oren.tysor
    Oct 24 '19 at 21:11
  • 1
    $\begingroup$ You have to do calculations with encrypted data. So the encryption function must be homomorphic in some sense. It means that it is necessary to specify the $E(K,s).$ $\endgroup$
    – Alexey Ustinov
    Oct 25 '19 at 9:12
  • $\begingroup$ As written, with the commitment and a guess to the secret, you can verify the secret. This is not true of standard commitment schemes - is that an intended feature of what you're looking for? $\endgroup$
    – poncho
    May 21 '20 at 21:59
  • $\begingroup$ @poncho I've revised the question to be more clear. By "a guess to the secret" do you mean a random guess as in a brute force? I looked at en.wikipedia.org/wiki/Commitment_scheme for my usage of commitment. If I'm using the terminology incorrectly by all means point me to a place to be more informed. $\endgroup$
    – oren.tysor
    May 22 '20 at 12:00
  • 1
    $\begingroup$ @RubenDeSmet: actually, his scheme $sG$ is not hiding at all; if someone has a guess to $s$, they can verify it. Hiding means that it is infeasible to gain any information about the secret, including 'is the secret this specific value?' $\endgroup$
    – poncho
    May 22 '20 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.