In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are using a commitment scheme?

if so, a commitment scheme needs to have binding and hiding properties. In this case I can get it is binding. But for hiding, it is not clear for me to see this property. Since the definition of hiding is adversary generate two messages $m_1,m_2$ and the adversary cannot distinguish their commitments.

  • $\begingroup$ It is "hiding" because finding $r$ is literally solving the DLP and you are guaranteed in this context to always commit to a random message. $\endgroup$ – SEJPM Jun 5 '20 at 8:48
  • $\begingroup$ Yes I agree in this sense, the verifier cannot find $r$. But in the definition of commitment scheme, the hiding property is not specified in this way. This is why we use Pederson commitment but not just simply $c=g^r$. Does this because when we are using a commitment scheme like Pederson, we normally commit to some value in a limit set, say {0,1}?, so we cannot just use $c=g^r$. But in other hands, if the set of the randomness that a verifier can choose is quite limited in this schnorr protocol, we cannot use $c=g^r$, then this $g^r$ strictly speaking cannot be a commitment scheme? $\endgroup$ – Wu Shuang Jun 5 '20 at 9:46
  • $\begingroup$ I suppose one shouldn't call it a "commitment scheme" but instead a "random commitment scheme" which only provides the hiding property for random messages (though I don't know right now how to formalize such a weak hiding property without relying on message recovery security). Perhaps one could think of it as a "KEM for commitments" where the scheme generates a random output and a commitment for you. $\endgroup$ – SEJPM Jun 5 '20 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.