1
$\begingroup$

Given a generic group $\mathbb{G}$ of an unknown order (such as a $3000$-bit RSA group) and a randomly generated element $g \in \mathbb{G}$, is the commitment scheme $\mathrm{Com}(x)= g^x$ not considered to be a computationally hiding scheme for sufficiently large (say, $128$-bit) integers?

I thought it was computationally hiding since retrieving $x$ from $\mathrm{Com}(x)$ would mean solving the discrete log problem. But it seems it is not considered to be computationally hiding in the literature, which seems confusing to me.

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ "But it seems it is not considered to be computationally hiding in the literature, which seems confusing to me."-> Could you add a reference about this sentence. $\endgroup$
    – Ievgeni
    Jan 19, 2021 at 9:51
  • 3
    $\begingroup$ Given a candidate $x'$ and a commitment $c$, does the commitment scheme let you verify wherever $c$ is a commitment to $x'$? $\endgroup$
    – Maeher
    Jan 19, 2021 at 10:00
  • $\begingroup$ @Maeher Thanks. I think that was my confusion. I thought the computationally hiding property just meant recovering $x$ from the commitment was infeasible. It seems you also should not be able to verify whether $\mathrm{Com}(x)$ is the commitment for $x$ in order for it to be computationally hiding. That explains the need for a blinding factor. $\endgroup$
    – Mathdropout
    Jan 20, 2021 at 0:39

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.