# Does Schnorr identification protocol using commitment scheme?

In schnorr identification protocol, a prover needs to choose a random,let's say $$r$$ at the beginning, then commit to this randomness as $$g^r\bmod p$$. When we say "commit", does it really mean we are using a commitment scheme?

if so, a commitment scheme needs to have binding and hiding properties. In this case I can get it is binding. But for hiding, it is not clear for me to see this property. Since the definition of hiding is adversary generate two messages $$m_1,m_2$$ and the adversary cannot distinguish their commitments.

• It is "hiding" because finding $r$ is literally solving the DLP and you are guaranteed in this context to always commit to a random message. – SEJPM Jun 5 '20 at 8:48
• Yes I agree in this sense, the verifier cannot find $r$. But in the definition of commitment scheme, the hiding property is not specified in this way. This is why we use Pederson commitment but not just simply $c=g^r$. Does this because when we are using a commitment scheme like Pederson, we normally commit to some value in a limit set, say {0,1}?, so we cannot just use $c=g^r$. But in other hands, if the set of the randomness that a verifier can choose is quite limited in this schnorr protocol, we cannot use $c=g^r$, then this $g^r$ strictly speaking cannot be a commitment scheme? – Wu Shuang Jun 5 '20 at 9:46
• I suppose one shouldn't call it a "commitment scheme" but instead a "random commitment scheme" which only provides the hiding property for random messages (though I don't know right now how to formalize such a weak hiding property without relying on message recovery security). Perhaps one could think of it as a "KEM for commitments" where the scheme generates a random output and a commitment for you. – SEJPM Jun 5 '20 at 9:51