I am curious whether one can do Pedersen commitment on $GF(2^n)$. One method I thought of was to get a prime order multiplicative subgroup of $GF(2^n)$. But for efficiency and security, what would be an appropriate value of $n$ for a security strength of 128-bit security?

  • $\begingroup$ Pedersen commitments rely on the discrete logarithm being hard and that one had a ... more shacky security history in $GF(2^n)$ than $GF(p)$ (IIRC). $\endgroup$
    – SEJPM
    Jan 16 at 19:29
  • $\begingroup$ Thanks. You are right, just found the recent attack on GF(2^10000). $\endgroup$
    – Sean
    Jan 16 at 22:06
  • $\begingroup$ I noticed that some recent zk proof systems such as Aurora (libiop) needs binary field. How would pedersen commitment work using such systems? $\endgroup$
    – Sean
    Jan 17 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.