0
$\begingroup$

I have read many question on this website and understood the Pedersen commitment until I came across with this page.

This page, it computes $\mathcal h= g^s \bmod p$ where $s$ is secret, instead of using $h$ and $g$ as a generator of a group $G$ like in first page. Is there a specific reason for this?

$\endgroup$

1 Answer 1

1
$\begingroup$

In a prime order group, every element except for the identity is a generator. As such, $g^s \bmod p$ will be a generator except with probability $1/q$. This is just one way of ensuring that $h$ is a generator (that is true for generic groups). Note that given $s$, it is possible to decommit to any value. As such, $s$ behaves as a type of trapdoor. This means that the receiver (or some external party). has to choose $h$ and not the committer. In some protocols, this is used by having the receiver choose $h$ and prove that it knows the appropriate $s$ with a zero-knowledge proof of knowledge. This enables the simulator to extract $s$ and use it during the simulation. Of course, in a real execution, it remains secret since the proof is zero knowledge.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.