# Is there a concept of Pedersen commitment “in the base”?

says ElGamal can be made homomorphic over multiplication. So you can have $$(g^r, h^r g^m)$$ (i.e., encrypting $$g^m$$) vice $$(g^r, h^r m)$$.

Then in this question Difference between Pedersen commitment and commitment based on ElGamal they point out that the Pedersen commitment looks a whole lot like the second item in the tuple.

So of course I wonder:

1. Is there a version of Pedersen where you just commit to a base, and will it be unconditionally hiding? I.e. is $$P = u h^r$$ a hiding commitment for the value $$u$$?
2. I know that taking a variation on Schnorr's protocol, you can prove you know the opening of a commitment $$g^mh^r$$. If the answer to the first question is yes, is there a variation where you can prove you know $$u, r$$ from commitment $$P$$? I think the answer is yes, if you just do the appropriate shift from exponentiation to multiplication to addition but I don't know if there is any security issue which would crop up as a result.
3. Finally, what groups would this work for/does the security assumption remain the same? I believe regular Pedersen just requires discrete log to be hard (so I was thinking $$\mathbb{Z}^*_p$$ for the generator where $$p$$ is a prime). Would that still work?
• You do realize that the "commitment scheme" $P = uh^r$ would not be binding at all (and hence would not be considered a valid commitment scheme), and that the proof of knowledge you're asking for in step 2 would be trivial (as anyone given $P$ can compute $u=P, r=0$, hence they know a possible openning) – poncho Dec 14 '20 at 22:22
• So in a paper from Camenisch-Lysyanskaya Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials [link.springer.com/content/pdf/10.1007/3-540-45708-9_5.pdf] they do have $C_u = uh^{r_2}$ which they say is a commitment. Is that because it's due to Strong-RSA then, or it's not really a commitment? – eternalmothra Dec 14 '20 at 23:06
• Where do they cliam that $C_u = uh^{r_2}$ is a commitment? The only commitments I see discussed are Pedersen commitments. – poncho Dec 15 '20 at 3:15
• I see it now; it's near the end. Now, they don't claim that $C_u$ is a commitment in isolation; it's only a commitment with the addition of $C_r = g^{r_2}h^{r_3}$, that is, if you also commit to the $r_2$ value – poncho Dec 15 '20 at 5:25