0
$\begingroup$

Suppose I have a Pedersen Commitment $cm(x,r) = g^xh^r$ where $g,h$ are generators of group $G$ of prime order $p$. Based on $cm$, I want to create a commitment $cm' = (10\cdot x,r')$, without of course opening the original commitment, while knowing that $x$ is a relatively small value (e.g. less than 1 million) through a range proof.

Based on the additive homomorphic property, I was thinking of just multiplying $cm$ by itself 10 times, i.e. computing $cm^{10}$ which would open with $(10\cdot x, 10\cdot r)$. Is there anything that can go wrong with this?

Improve this question
$\endgroup$
4
  • $\begingroup$ I think the question is missing context. What is your actual goal? Who creates G and the generators? And what are you using the commitments for? Just exponentiating an elemnt is something everyone can do. And it's fairly obvious, that the modified opening works. Btw: the assumption "x is small" indicates, that this is used in a wrong way. If x is chosen from a small subset, security is already gone. $\endgroup$
    – tylo
    Dec 17 '20 at 1:03
  • $\begingroup$ G and generators are public parameters. These commitments will be part of a zero-knowledge protocol proving that cm' hides a value 10 times larger than cm. By the assumption "x is small" I mean that it cannot be as large as p. e.g. you know that I hide a value between 0 and 1 million through a range proof. In my context there is no security issue with that. $\endgroup$
    – Panos
    Dec 17 '20 at 1:15
  • 1
    $\begingroup$ @tylo: "If x is chosen from a small subset, security is already gone" - that is incorrect; even if someone knows apriori that a commitment holds one of two values, they cannot tell which it is. $\endgroup$
    – poncho
    Dec 17 '20 at 3:29
  • $\begingroup$ @poncho You're right, my mistake. I somehow thought about the random value being from a small domain. $\endgroup$
    – tylo
    Dec 17 '20 at 23:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.