Questions tagged [commitments]
A commitment scheme is a protocol where one party commits themselves to a secret value without revealing it. At a later point, the value can be revealed.
134
questions
0
votes
0answers
28 views
Can Pedersen commitment be used in pairing groups?
For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
1
vote
1answer
59 views
Question of proving the opening of Pedersen Commitment
Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
37 views
Computational Binding of Pedersen Commitment
Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
0
votes
0answers
28 views
Does Schnorr identification protocol using commitment scheme?
In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are ...
0
votes
1answer
35 views
Is the random oracle commitment scheme secure against PPT active adversaries?
The probability that a probabilistic polynomial adversary corrupting the sender can finds two pairs $(m,r)$ such that the output of the random oracle $c$ is the same (break the binding property) is ...
0
votes
1answer
43 views
Computational binding implies Perfect hiding?
Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding?
My idea was: Since the scheme ...
0
votes
0answers
36 views
Range Proofs based on Polynomial Commitment Scheme (PCS)
I have been trying to implement the PCS-based Range Proofs as described here.
My code is in a public repository.
I am not able to understand this part:
This w_cap is a linear combination of f and ...
2
votes
1answer
141 views
Is it possible I can open pedersen commitments without revealing r?
With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$.
In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$,
then de-commit by revealing $(m, r)$....
0
votes
1answer
63 views
What does the “x” operator stands for in cryptography?
I am studying commitment scheme and in of the notes from the class this statement comes up.
I'd like to know exactly what the X = M x R mean, since I don't seem to understand how the "x" operator ...
0
votes
1answer
47 views
Is the hash-based commitment IND-CPA?
As we know the well-known hash-based commitment is as follows:
Prover: given a message $m$, it:
(1) picks a fresh random value $r$
(2) computes $H(r||m)=c$.
Verifier: given $c$ and the commitment ...
1
vote
1answer
68 views
Can I prove in zero knowledge that the public key corresponding to a secret that I committed is in the Accumulator?
I have a set of users in my system, each having a private/public keypair of a digital signature scheme. I also have an accumulator in my system, where all the public keys of the users are accumulated.
...
0
votes
0answers
33 views
Is it correct using Sigma Protocol to do the knowledge proof?
For this background,
the prover knows a secret $x$ for $h=gx$. Prove to the verifier that he knows $x$.
(I know $h=gx$ is not a NP problem, I just want to practice the Sigma Protocol)
Step 1 : $P \...
0
votes
1answer
64 views
Is Commitment Scheme with hash function is a perfectly hiding scheme?
If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding?
$m$ is the message
$r$ is a random value
In commit stage,
$$ c = C(m, r)$$
In reveal stage, by ...
1
vote
0answers
30 views
How to securely and noninteractively generate a blinding factor in MimbleWimble Pedersen commitment?
I'm working on a prototype which will use MimbleWimble Confidential Assets transaction protocol using Cosmos as the blockchain layer.
In my prototype a user is always sending a whole amount to ...
1
vote
2answers
152 views
Sigma protocol with Pedersen commitment and Hash function
Suppose I construct a Pedersen commitment as $g^m h^r$. I could pick the randomness in a "pseudo-random" fashion, such that $r = H(m)$. My questions are as follows:
Given that $H$ is collision-...
2
votes
0answers
46 views
Statistically Binding Commitments
Is it possible to ever have a commitment scheme that is statistically binding but not perfectly binding?
The sender would be computationally unbounded, hence could always computationally trudge ...
1
vote
1answer
55 views
How can a public-key encryption scheme be used to construct a commitment scheme in the CRS model?
For a PKE scheme $(Gen, Enc, Dec)$, the most 'obvious' idea is to commit to an encryption of a bit and in the reveal phase maybe send $r_g$, $r_e$ where $r_g$ is the randomness of $Gen$ and $r_e$ is ...
1
vote
0answers
46 views
Zero knowledge proof that ElGamal ciphertext encrypts the opening of Pedersen commitment
Given ElGamal ciphertext for a message $m$ with a random $r$ as $(c_1,c_2) \gets (g^r, g^my^r)$ for a public key $y$, and a Pedersen commitment $C \gets g^xh^r$, I have been able to create a proof ...
1
vote
1answer
58 views
Commitment based on authencticated encryption
Let $(E,D)$ be the encryption/decryption of an authenticated encryption scheme. Consider the following commitment scheme.
Generate a random key $k$. Commit to $m$ by sending $c=E_k(m)$.
Reveal $m$ by ...
0
votes
1answer
41 views
Orthogonal generators of a group in Lelantus protocol
In the Lelantus Paper, the authors mentionned this:
In our case, the commitment key ck specifies a prime-order group G and three orthogonal group generators $g, h_1$ and $h_2$.
G is mentioned in ...
0
votes
0answers
59 views
Prove knowledge of signature on committed value
Assume that a prover $P$, has previously obtained a signature $\sigma$ on a value $x$ from a verifier $V$. At a later stage, $P$ produces a Pedersen commitment $C$, to this value:
$C = g^x h^r$
I'm ...
2
votes
0answers
102 views
Verify commitment C commits to the same value that E encrypts
Given the following (using additive notation):
$G$ - generator of an elliptic curve group of order $q$
$s$ - secret drawn uniformly from the distribution $1..q$
$k$ and $K$ - a private public keypair
...
1
vote
1answer
121 views
Which groups to use for Pedersen Commitments
I have been reading about Pedersen Commitments, and have come across some contradictory examples, which is confusing.
Just focusing on simple commitment of scalars (not EC points or vectors), then I ...
2
votes
0answers
50 views
Commitment to a degree of a polynomial
Is there a way to commit to a degree of a polynomial without committing to every single one of its coefficients?
The problem I am trying to solve is to prove that two polynomials are the same in a ...
2
votes
1answer
209 views
Zero knowledge proof for opening of Pedersen commit and discrete logarithm
I am looking for a proof of knowledge as such:
$PK\{ (x,r) : C = g^xh^r \land V = g^x\}$
Where $C, V, g$ and $h$ are public information and $x$ and $r$ is known only to the prover.
I.e. I have a ...
2
votes
1answer
284 views
Commitment to a polynomial
$A(x) \bmod B(x) = C(x)$ and $A(x) \bmod D(x) = E(x)$:
A dealer knows $A(x)$ polynomial, which is a secret. He distributes $C(x)$ and $E(x)$ privately to $X$ and $Y$, respectively. $B(x)$ and $D(x)$ ...
2
votes
1answer
174 views
Simple commitment scheme using secure hash function
Can I create a simple commitment scheme using a secure hash function?
If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random\_string || message)$)
Thank you
1
vote
0answers
65 views
How to sign comitted group elements?
I'm actually searching some particular primitive compatible with Groth Sahai commitment.
I would like to know a signature scheme (on group elements), such that there exists an algorithm $\mathtt{...
2
votes
1answer
88 views
Constant size commitment to a bivariate polynomial
In this paper by Kate et al, a constant size polynomial commitment scheme is described.
The commitment scheme assumes a public reference string:
\begin{align*}
\Big\{
\{ g^{ \tau^i }, g^{ \alpha \...
1
vote
1answer
157 views
What is wrong with encryption-based / hash-based commitment schemes?
In the slides to my information security class it is stated without explanation that a encryption-based commitment scheme defined as follows is broken:
Commit: P outputs c = Enck(m)
Reveal: P sends k ...
1
vote
0answers
114 views
Efficient protocols for set membership proofs with private sets
I found the paper on Efficient Protocols for Set Membership and Range Proofs in which
efficient protocols for the following problem are discussed:
Given a commitment $C_v$ to a value $v$ we want show ...
0
votes
1answer
42 views
How to determine r' in pederson commitment?
Can someone help me with that question? Assuming that someone knows $log_g(h)$ so that he can calculate any message $m'$ for commitment $c$, how to determine $r'$ in?
2
votes
1answer
77 views
Are Fujisaki commitments binding if the factorization of the group is known?
If I understand correctly, a Fujisaki commitment is as follows: $g^m \cdot h^r $ mod $n$, where $m$ is a message, $r$ is a random number, there exists $a$ such that $h^a = g$, and $n$ is an RSA ...
3
votes
1answer
138 views
Verifiable Encryption of a Pedersen Commitment
Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a ...
1
vote
0answers
40 views
Gennaro multi trapdoor commitment scheme
In the Scheme Based on the SDH Assumption (page 11 of the paper https://link.springer.com/content/pdf/10.1007%2F978-3-540-28628-8_14.pdf), how does the commitment get revealed with the master trapdoor ...
3
votes
1answer
184 views
What information does $g^x$ reveal about $x$?
Let $p$ be a large prime number. Let $G$ be a subgroup of $\mathbb{Z}_p^*$ with order $q$ - again a large prime. Let $g$ be a generator of $G$.
Consider the following standard protocol for ...
2
votes
1answer
210 views
Pedersen commitments in bulletproofs
In Bulletproofs range proof, Pedersen commitments look like $C=aG+bH$
If I need to proof several values' range proof and keep G as constant, do I need to change H everytime?
I have found it doesn't ...
6
votes
0answers
277 views
What's the difference among Vector Commitment, Zero-knowledge Set, Zero-knowledge Accumulator, and Zero-knowledge Elementary Database?
Vector commitment allows to commit to an ordered sequence of $q$ value ($m_1,\cdots,m_q$) in such a way that one can later open the commitment at specific positions(e.g., prove that $m_i$ is the $i$-...
2
votes
1answer
90 views
Honest Verifier Zero-Knowledge Game for Sigma Protocols
I am looking for how an adversary to special HVZK would work. In Boneh and Shoup's book (BonehShoup) they have Attack Game 20.4 for special cHVZK.
Here, the adversary produces a pair (x,y) (witness ...
0
votes
1answer
64 views
Selectively opening only a few commitments
I have k messages $m_1,m_2...m_k$ and I want to commit to all of them but open only a few of them -- as asked by Bob. Each message is of $n$ bits. Show how one can commit to all the $k$ messages and ...
1
vote
0answers
97 views
Prove that two commitments are commitments to the same value
Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers.
Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
1
vote
2answers
77 views
Zero Knowledge for Low Entropy Witness
For any PPT prover ($p$) and verifier ($v$), imagine I have a low entropy witness, say smaller than $2^8$. Now, let us say I have a dlog statement in the form of $y = g^w$. Theory says I could use a ...
2
votes
1answer
243 views
Disjunctive zero knowledge proof of equality of committed values
I have read on ZK proof of equality of committed values, that is for $g^xh^y$ and $g^{x'}h^{y'}$, prove in ZK that $x = x'$ (can also be generalized if generators are different using sigma-protocols). ...
1
vote
1answer
52 views
Can 2 bit commitment protocols be secure when sent together with the same bit
Suppose I have 2 bit commitment schemes, C1 and C2 which are computationally hiding.Suppose I commit the same bit using both and send them to an adversary who knows that the same bit was committed. Is ...
2
votes
1answer
195 views
trapdoor commitment from lattice-based assumptions?
I'm wondering that is there any equivocal commitment scheme (i.e., trapdoor commitment) can be constructed from lattice-based assumptions? I know there are a lot of commitment schemes from lattices as ...
1
vote
0answers
66 views
Simple reduction of commitments to one way functions
I am looking for an explicit and simple reduction of commitments to one way functions.
I don't care about the number of rounds, only simplicity.
I am aware of the simple reductions you can find in ...
0
votes
1answer
120 views
How to change the following commitment scheme to Pedersen commitment?
In my question here Zero knowledge set membership protocol
The suggested solution allows a prover to choose a commitment $C$. Then, A trusted third party ($T$) can validate if $C$ is valid or not. ...
4
votes
3answers
826 views
Pedersen commitment in elliptic curves
I try to understand Pedersen commitment in elliptic curves over finite fields. I could use some clarification.
Let's say we have two generators $G$ and $H$.
Is that required that $G$ and $H$ are ...
2
votes
2answers
135 views
How do I create a cryptographic signature and commitment scheme with accountable evidence?
This is a weird one... I am looking for a method which I don't even know how to call, nor whether it actually exists!
Given a pair of asymmetric keys $s_{k}/P_{k}$ and defining $Sig_{k} \dagger B_{i}$...
1
vote
1answer
442 views
Zero knowledge set membership protocol
I read that paper Efficient Protocols for Set Membership and Range Proofs of Camenisch et. al that describes the zero knowledge range proof. The paper applications looks interesting like if you want ...
