# Can Pedersen commitment be used in pairing groups?

For bilinear groups: $$(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$$, where $$\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$$ are groups of prime oder $$p$$. $$g_1,h_1$$ are generators of $$\mathbb{G}_1$$, and $$g_2,h_2$$ are generators of $$\mathbb{G}_2$$

Is it possible to use Pederson commitment over all these three groups?

For instance:

In $$\mathbb{G}_1$$: $$c_1(m_1,r_1)=g_1^{m_1}h_1^{r_1}$$

In $$\mathbb{G}_2$$: $$c_2(m_2,r_2)=g_2^{m_2}h_2^{r_2}$$

In $$\mathbb{G}_T$$: $$c_3(m_3,r_3)=e(g_1,g_2)^{m_3}e(g_1,h_2)^{r_3}$$

• Is this homework? If it is, you need to consider these two questions: 1) what are the security properties that Pedersen commitments requires of the group? 2) do the various groups meet those security properties? – poncho Jun 12 '20 at 20:41
• The group order needs to be prime $p$ such that $p=2q+1$, $q$ is another prime. So if we set the three groups to satisfy this requirement, theoretically, it is possible to use Pedersen commitment in each of the group. is this correct? Practically how difficult to make these group satisfy this requirement? It is not a homework, I just thought if this is possible, trying to construct something with it, but I am afraid I will be wrong at the beginning.@poncho – Wu Shuang Jun 12 '20 at 21:01
• It sounds like you misunderstand what 'group order' is; it's not the 'modulo $p$' that the group is based on, but instead the number of elements within the group. In any case, the answer is insufficient; Pedersen commitments are insecure in some groups, but secure in others - what's the difference between those two groups? What properties would an attacker exploit to either open a commitment to another value, or deduce the committed value from a commitment? – poncho Jun 12 '20 at 21:16
• I was wrong with the group order indeed. Do you mean the biding and hiding properties? if the modular p satisfies the requirement, then these two properties should hold?(Thanks!)@poncho – Wu Shuang Jun 12 '20 at 21:19