0
$\begingroup$

So, the question is, a commitment scheme on elliptic curve is given.

Initialisation phase:

  1. There is an elliptic curve EC, generator point $G$ over $GF(p)$, which creates a group, and random prime number $e$.
  2. Choose an $x$.
  3. Calculate $M = x \cdot G$.
  4. Calculate $M' = e \cdot M$.
  5. Extract $xM$, where $xM$ is an $x$ coordinate of $M$.
  6. Calculate $H = xM \cdot G$.

EC, $G$, $e$ are public parameters, $x$ is a private parameter.

Commitment is defined as follows: $C = x \cdot G + r \cdot H$.

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

It is possible to calculate $C = x \cdot G + r \cdot H$ and $C = x' \cdot G + r' \cdot H'$. Therefore, it is possible to calculate $r' = (x + r \cdot xM - x') / x'M$.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose $H$ as another generator point.

Are there any other ways to make this commitment perfectly binding?

$\endgroup$

2 Answers 2

2
$\begingroup$

If I'm not wrong: first got a Pedersen commitment (computationally binding & theoretically hiding), then "transform" it in an ElGamal commitment (theoretically binding & computationally hiding), nice primer in 1

$\endgroup$
1
  • $\begingroup$ Nice! To summarize what's in the link, you generate the commitment as the two points $mG + rH, rG$ (where $m$ is the value you're committing to). That works... $\endgroup$
    – poncho
    Sep 2, 2021 at 17:52
0
$\begingroup$

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

Actually, it's not even computationally binding, as the committer knows the discrete log of $H$ (it's $xM$), and so he can trivially open the commitment any way he wants.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose H as another generator point.

Pedersen commitments cannot be made perfectly binding, because no matter how you choose $H$, it would be possible (although, in practice, computationally infeasible, or so we hope) to compute the discrete log, and so it'd be possible to open the commitment with different values.

For a commitment to be perfectly binding, then what must happen is that, for any possible commitment, there is only one possible secret that it can open to; Pedersen doesn't fulfill that.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.