2
$\begingroup$

Given the following (using additive notation):

  • $G$ - generator of an elliptic curve group of order $q$
  • $s$ - secret drawn uniformly from the distribution $1..q$
  • $k$ and $K$ - a private public keypair
  • $E$ - an encryption of $s$ under $K$
  • $C$ - a commitment to $s$ such that $C = sG$.

Note that it's important that $C$ is formed as $sG$ - though pointers to general literature using any kind of commitments that satisfy the below problem would be appreciated as well.

How can I produce $E$ in such a way that, given $E$, $C$, and $K$, (and some other normal public info like generators, etc) one can verify that $C$ commits to the value that $E$ encrypts?

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ Thank you @kelalaka for the formatting. $\endgroup$ – oren.tysor Oct 24 '19 at 21:11
  • 1
    $\begingroup$ You have to do calculations with encrypted data. So the encryption function must be homomorphic in some sense. It means that it is necessary to specify the $E(K,s).$ $\endgroup$ – Alexey Ustinov Oct 25 '19 at 9:12
  • $\begingroup$ As written, with the commitment and a guess to the secret, you can verify the secret. This is not true of standard commitment schemes - is that an intended feature of what you're looking for? $\endgroup$ – poncho May 21 at 21:59
  • $\begingroup$ @poncho I've revised the question to be more clear. By "a guess to the secret" do you mean a random guess as in a brute force? I looked at en.wikipedia.org/wiki/Commitment_scheme for my usage of commitment. If I'm using the terminology incorrectly by all means point me to a place to be more informed. $\endgroup$ – oren.tysor May 22 at 12:00
  • 1
    $\begingroup$ @RubenDeSmet: actually, his scheme $sG$ is not hiding at all; if someone has a guess to $s$, they can verify it. Hiding means that it is infeasible to gain any information about the secret, including 'is the secret this specific value?' $\endgroup$ – poncho May 22 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.