In the Lelantus Paper, the authors mentionned this:

In our case, the commitment key ck specifies a prime-order group G and three orthogonal group generators $g, h_1$ and $h_2$.

G is mentioned in the performance section of the paper to be the famous elliptic curve secp256k1. Hence, I don't understand the notion of "group generators" that are orthogonal.

Indeed the group G is of prime-order and obviously commutative (even in the general case). Hence, non-trivial generators are of prime order p as well, and their generated subgroups are the whole group G.

Am I missing something here or is the "orthogonal" notion useless or even wrong?

Note: For me, it would make sense if the sentence meant that $\langle g,\ h_1,\ h_2\rangle\ = \ G$ and the subgroups $\langle g\rangle, \langle h_1\rangle, \langle h_2\rangle$ have trivial intersections together, but the prime order of the group $G$ forbids that, no?


1 Answer 1


A GUESS: the author meant that three numbers $a,b,c \in \mathbb{Z}$ such that $$g^a\cdot h_1^n \cdot h_2^c =1$$ are infeasible to compute. While the term "orthogonal" seems inappropriate, This is a fairly standard assumption.

  • $\begingroup$ I exchanged with a few researchers in my University and indeed they don't see where this orthogonality comes from. The ''infeasible to compute'' assumption is normal in this context as we rely on the discrete log problem, but I guess I'll just strop trying to understand the ''orthogonal'' meaning.. thanks anyway! $\endgroup$
    – Binou
    Nov 7, 2019 at 5:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.