0
$\begingroup$

This question Can Elgamal be made additively homomorphic and how could it be used for E-voting?

says ElGamal can be made homomorphic over multiplication. So you can have $(g^r, h^r g^m)$ (i.e., encrypting $g^m$) vice $(g^r, h^r m)$.

Then in this question Difference between Pedersen commitment and commitment based on ElGamal they point out that the Pedersen commitment looks a whole lot like the second item in the tuple.

So of course I wonder:

  1. Is there a version of Pedersen where you just commit to a base, and will it be unconditionally hiding? I.e. is $P = u h^r$ a hiding commitment for the value $u$?
  2. I know that taking a variation on Schnorr's protocol, you can prove you know the opening of a commitment $g^mh^r$. If the answer to the first question is yes, is there a variation where you can prove you know $u, r$ from commitment $P$? I think the answer is yes, if you just do the appropriate shift from exponentiation to multiplication to addition but I don't know if there is any security issue which would crop up as a result.
  3. Finally, what groups would this work for/does the security assumption remain the same? I believe regular Pedersen just requires discrete log to be hard (so I was thinking $\mathbb{Z}^*_p$ for the generator where $p$ is a prime). Would that still work?
Improve this question
$\endgroup$
4
  • $\begingroup$ You do realize that the "commitment scheme" $P = uh^r$ would not be binding at all (and hence would not be considered a valid commitment scheme), and that the proof of knowledge you're asking for in step 2 would be trivial (as anyone given $P$ can compute $u=P, r=0$, hence they know a possible openning) $\endgroup$
    – poncho
    Commented Dec 14, 2020 at 22:22
  • $\begingroup$ So in a paper from Camenisch-Lysyanskaya Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials [link.springer.com/content/pdf/10.1007/3-540-45708-9_5.pdf] they do have $C_u = uh^{r_2}$ which they say is a commitment. Is that because it's due to Strong-RSA then, or it's not really a commitment? $\endgroup$
    – eternalmothra
    Commented Dec 14, 2020 at 23:06
  • $\begingroup$ Where do they cliam that $C_u = uh^{r_2}$ is a commitment? The only commitments I see discussed are Pedersen commitments. $\endgroup$
    – poncho
    Commented Dec 15, 2020 at 3:15
  • 1
    $\begingroup$ I see it now; it's near the end. Now, they don't claim that $C_u$ is a commitment in isolation; it's only a commitment with the addition of $C_r = g^{r_2}h^{r_3}$, that is, if you also commit to the $r_2$ value $\endgroup$
    – poncho
    Commented Dec 15, 2020 at 5:25

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.