1
$\begingroup$

Given a generic group $\mathbb{G}$ of an unknown order (such as a $3000$-bit RSA group) and a randomly generated element $g \in \mathbb{G}$, is the commitment scheme $\mathrm{Com}(x)= g^x$ not considered to be a computationally hiding scheme for sufficiently large (say, $128$-bit) integers?

I thought it was computationally hiding since retrieving $x$ from $\mathrm{Com}(x)$ would mean solving the discrete log problem. But it seems it is not considered to be computationally hiding in the literature, which seems confusing to me.

$\endgroup$
3
  • 2
    $\begingroup$ "But it seems it is not considered to be computationally hiding in the literature, which seems confusing to me."-> Could you add a reference about this sentence. $\endgroup$
    – Ievgeni
    Commented Jan 19, 2021 at 9:51
  • 3
    $\begingroup$ Given a candidate $x'$ and a commitment $c$, does the commitment scheme let you verify wherever $c$ is a commitment to $x'$? $\endgroup$
    – Maeher
    Commented Jan 19, 2021 at 10:00
  • $\begingroup$ @Maeher Thanks. I think that was my confusion. I thought the computationally hiding property just meant recovering $x$ from the commitment was infeasible. It seems you also should not be able to verify whether $\mathrm{Com}(x)$ is the commitment for $x$ in order for it to be computationally hiding. That explains the need for a blinding factor. $\endgroup$ Commented Jan 20, 2021 at 0:39

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.