1
$\begingroup$

The GSW one of the FHE scheme is widely used as a homomorphic commitment scheme to build lattice based ABE, homomorphic signatures and NIZK and so on. But I cannot find other FHE schemes to be considered as a commitment scheme such like that.

Is there a special reason why GSW is only one scheme regarded as a commitment scheme? or all known FHE schemes such as BGV are also commitment schemes?

$\endgroup$
1
$\begingroup$

Yes, all known FHE schemes are also commitment schemes (BGV included). The reason why GSW if much more often explicitly described as a commitment is that, unlike the alternatives, it leads to a commitment scheme with very nice property - for example, it gives a dual mode commitment (i.e. it can be perfectly binding or perfectly hiding depending on how exactly the parameters are generated), which is a very useful property (at the heart, to mention one application, of the constructions of fully homomorphic signatures).

$\endgroup$
3
  • $\begingroup$ Thank you for your answer. As I know, all multiplicative homomorphic scheme satisfies dual mode commitment, I think BGV also satisfies a dual mode one. Thus I somewhat wonder that the special property of GSW $\endgroup$ – filter hash Jan 31 at 5:11
  • $\begingroup$ I think this is incorrect. Not all multiplicatively homomorphic encryption schemes are dual mode commitments, and in particular, it is not obvious at all to me whether BGV can be used as a dual mode fully homomorphic commitment. $\endgroup$ – Geoffroy Couteau Jan 31 at 19:15
  • $\begingroup$ Thanks a lot. I'm confused a dual mode commitment. I will study about this topic! Thank you again $\endgroup$ – filter hash Feb 1 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.