Questions tagged [commitments]
A commitment scheme is a protocol where one party commits themselves to a secret value without revealing it. At a later point, the value can be revealed.
161
questions
0
votes
0answers
22 views
Zero-knowledge proof of knowledge of a plaintext in exponential ElGamal
Consider the exponential ElGamal cryptosystem over some group $G$ with generator $g$. Let $m$ be a plaintext, and $(R, C) = (g^r, g^m \cdot y^r)$ an encryption thereof for some public key $y$.
Assume ...
0
votes
0answers
22 views
UC-secure commitment in the ROM
Looking at the question Is this a UC-secure commitment scheme in the ROM?, I was wondering, is the commitment scheme proposed in the answer (which uses $H(M||r)$ as commit) secure in the UC-model, ...
0
votes
0answers
33 views
Why are the fully homomorphic encryption algorithms the commitment?
Is there some references about the commitment scheme based on FHE ? Why could the BFV, CKKS, BGV algorithm be convert to commitment? How ?
2
votes
0answers
39 views
How does the rejection sampling lemma work in the proof of HVZK?
In this protocol,
Q1: how does the commitment work? What if the prover sends $\textbf{t}$ directly, and then sends $s_m,s_r,s_{\textbf{e}}$?
Q2: How does the rejection sampling lemma work?
refer to ...
0
votes
0answers
30 views
Is the BFV homomorphic encryption scheme a commitment scheme?
The BFV scheme can be described as:
Public Key: $(p_0, p_1)$
To encrypt a plaintext $m$, the ciphertext is : $(c_0, c_1) , c_0= up_0+\Delta m + e_0, c_1=up_1 + e_1$
0
votes
1answer
41 views
Difference between a Polynomial Opening & a Polynomial Commitment
Going through the literature led me to think I understood the difference between these two things, but thinking about I am not actually certain. Could you help me correct my definitions of these two ...
1
vote
0answers
39 views
Hash as encryption used by Monero
Monero uses a Pedersen commitment $yG + bH$ to obfuscate the value of a transaction, where $b$ is the value and $y$ is the blinding factor.
For the receiver to know both variables, it uses a Diffie-...
0
votes
0answers
40 views
Why is the proof on the commitment correct?
In the paper "Efficient Zero-Knowledge Proofs for Commitments from Learning with Errors over Rings", they gave a commitment from Ring-LWE: to commit to a polynomial $m$ in $Rq(Zq[x]/(x^n+1))$...
1
vote
1answer
49 views
All fully homomorphic encryptions (FHE) are converted into homomorphic commitments?
The GSW one of the FHE scheme is widely used as a homomorphic commitment scheme to build lattice based ABE, homomorphic signatures and NIZK and so on. But I cannot find other FHE schemes to be ...
0
votes
0answers
24 views
Does resuing pederson commitment preserve the hiding property?
Assume you have a pedersen commitment scheme where the commitment is:
$$\mathcal C_1 =C(m,r)=g^m\cdot h^r$$
with $g,h$ being public generators in a public group $(G,\cdot)$ in which the discrete ...
1
vote
0answers
35 views
Question about hiding commitment scheme for integers
Given a generic group $\mathbb{G}$ of an unknown order (such as a $3000$-bit RSA group) and a randomly generated element $g \in \mathbb{G}$, is the commitment scheme $\mathrm{Com}(x)= g^x$ not ...
0
votes
0answers
76 views
A card game (for mental poker or any other card game)
I thought of a way to produce trustless card game in a flexible way. One feature that I want is it should be flexible (It should work for any type of card game, though I indeed started it as a ...
0
votes
0answers
44 views
Multiplication of a Pedersen commitment 10 times
Suppose I have a Pedersen Commitment $cm(x,r) = g^xh^r$ where $g,h$ are generators of group $G$ of prime order $p$. Based on $cm$, I want to create a commitment $cm' = (10\cdot x,r')$, without of ...
0
votes
0answers
35 views
Is there a concept of Pedersen commitment “in the base”?
This question Can Elgamal be made additively homomorphic and how could it be used for E-voting?
says ElGamal can be made homomorphic over multiplication. So you can have $(g^r, h^r g^m)$ (i.e., ...
0
votes
1answer
54 views
Notation for commitment schemes
I was reading this set of lecture notes on commitment schemes, where they define a commitment scheme $\text{Com}(b, r) = f(r), h(r) \oplus b$ as a secure commitment scheme. In this case, $f : \{0,1\}^...
0
votes
0answers
90 views
Non-interactive zero-knowledge proof system for a language undecidable in polynomial time
I am studying through some material in an online course, and there is an exercise which I could not figure out. The problem is this:
Let $L$ be a language that is not decidable in polynomial time (...
5
votes
0answers
65 views
Understanding anonymous credentials. Does someone understand how it works?
After reading a series of papers CL01 CL02 CL04, I feel like I understand the intuition behind the anonymous credential framework but I don't understand some details the mathematics behind it.
I ...
0
votes
2answers
72 views
Constructing a commitment scheme from two (possibly defective) commitment schemes
If we have two commitment schemes Com1 and Com2, which are possibly defective (in the sense of not satisfying hiding or binding properties), is it possible to construct a commitment scheme which does ...
1
vote
0answers
25 views
How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?
In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about ...
3
votes
2answers
66 views
How to show that Cx is a commitment to a integer of length lm
With reference to Jan Camenisch and Anna Lysyanskaya's paper A Signature Scheme with Efficient Protocols, in proceedings of SCN 2002, I need some help to understand How to verify that $C_x$ is a ...
0
votes
0answers
113 views
regarding usage of hashing
I have a question regarding pitfalls of using only encryption.
Suppose Bob and Alice want to flip a coin over a network. Alice proposes the following protocol.
Alice randomly selects a value X ∈ {0,1}...
0
votes
0answers
26 views
Subset-sum Problem & Commitment Schemes
In this question I asked about a subset sum hash. Would it be possible to adapt that into a commitment scheme by keeping M private and revealing it at a later time? Would this be secure for some size ...
0
votes
0answers
83 views
Zero Knowledge Set Membership proof
ZK set membership:
I am trying to create my own zero knowledge set membership proof for a commitment to an element in the set for small sets. I am a beginner in such works, so can someone help me find ...
3
votes
1answer
102 views
How to achieve identity authentication without revealing credentials
I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be ...
4
votes
0answers
162 views
Computationally binding commitment
A Computationally Binding commitment scheme is defined as a tuple of protocols $(\mathsf{Keygen}, \mathsf{Com}, \mathsf{Open})$, that along with correctness guarantees that for all PPT algorithms the ...
1
vote
1answer
45 views
Constant size commitment to a membership of a fixed size of elements
Suppose there is a global set of $n$ elements, out of which I want to commit to $2n/3$ elements, i.e., anyone can take my commitment and test what $2n/3$ of the possible $n$ elements I committed to.
...
4
votes
2answers
137 views
Sigma proofs for Pedersen commitments arithmetic under different bases
I was wondering if it's possible to prove an equality of openings between $3$ Pedersen commitments $P\cdot Q$ and $R$ when $P, Q, R$ have different commitment keys.
Suppose that commitment $R$ commits ...
0
votes
0answers
19 views
Sigma-Protocol to prove a commitment to a commitment
Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (...
0
votes
0answers
54 views
Can Pedersen commitment be used in pairing groups?
For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
1
vote
1answer
90 views
Question of proving the opening of Pedersen Commitment
Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
60 views
Computational Binding of Pedersen Commitment
Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
0
votes
0answers
54 views
Does Schnorr identification protocol using commitment scheme?
In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are ...
0
votes
1answer
40 views
Is the random oracle commitment scheme secure against PPT active adversaries?
The probability that a probabilistic polynomial adversary corrupting the sender can finds two pairs $(m,r)$ such that the output of the random oracle $c$ is the same (break the binding property) is ...
0
votes
1answer
81 views
Computational binding implies Perfect hiding?
Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding?
My idea was: Since the scheme ...
0
votes
0answers
62 views
Range Proofs based on Polynomial Commitment Scheme (PCS)
I have been trying to implement the PCS-based Range Proofs as described here.
My code is in a public repository.
I am not able to understand this part:
This w_cap is a linear combination of f and ...
2
votes
1answer
177 views
Is it possible I can open pedersen commitments without revealing r?
With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$.
In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$,
then de-commit by revealing $(m, r)$....
0
votes
1answer
66 views
What does the “x” operator stands for in cryptography?
I am studying commitment scheme and in of the notes from the class this statement comes up.
I'd like to know exactly what the X = M x R mean, since I don't seem to understand how the "x" operator ...
0
votes
1answer
72 views
Is the hash-based commitment IND-CPA?
As we know the well-known hash-based commitment is as follows:
Prover: given a message $m$, it:
(1) picks a fresh random value $r$
(2) computes $H(r||m)=c$.
Verifier: given $c$ and the commitment ...
1
vote
1answer
102 views
Can I prove in zero knowledge that the public key corresponding to a secret that I committed is in the Accumulator?
I have a set of users in my system, each having a private/public keypair of a digital signature scheme. I also have an accumulator in my system, where all the public keys of the users are accumulated.
...
0
votes
1answer
186 views
Is Commitment Scheme with hash function is a perfectly hiding scheme?
If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding?
$m$ is the message
$r$ is a random value
In commit stage,
$$ c = C(m, r)$$
In reveal stage, by ...
1
vote
0answers
38 views
How to securely and noninteractively generate a blinding factor in MimbleWimble Pedersen commitment?
I'm working on a prototype which will use MimbleWimble Confidential Assets transaction protocol using Cosmos as the blockchain layer.
In my prototype a user is always sending a whole amount to ...
1
vote
2answers
230 views
Sigma protocol with Pedersen commitment and Hash function
Suppose I construct a Pedersen commitment as $g^m h^r$. I could pick the randomness in a "pseudo-random" fashion, such that $r = H(m)$. My questions are as follows:
Given that $H$ is collision-...
2
votes
0answers
85 views
Statistically Binding Commitments
Is it possible to ever have a commitment scheme that is statistically binding but not perfectly binding?
The sender would be computationally unbounded, hence could always computationally trudge ...
2
votes
1answer
111 views
How can a public-key encryption scheme be used to construct a commitment scheme in the CRS model?
For a PKE scheme $(Gen, Enc, Dec)$, the most 'obvious' idea is to commit to an encryption of a bit and in the reveal phase maybe send $r_g$, $r_e$ where $r_g$ is the randomness of $Gen$ and $r_e$ is ...
1
vote
0answers
105 views
Zero knowledge proof that ElGamal ciphertext encrypts the opening of Pedersen commitment
Given ElGamal ciphertext for a message $m$ with a random $r$ as $(c_1,c_2) \gets (g^r, g^my^r)$ for a public key $y$, and a Pedersen commitment $C \gets g^xh^r$, I have been able to create a proof ...
1
vote
1answer
97 views
Commitment based on authencticated encryption
Let $(E,D)$ be the encryption/decryption of an authenticated encryption scheme. Consider the following commitment scheme.
Generate a random key $k$. Commit to $m$ by sending $c=E_k(m)$.
Reveal $m$ by ...
0
votes
1answer
44 views
Orthogonal generators of a group in Lelantus protocol
In the Lelantus Paper, the authors mentionned this:
In our case, the commitment key ck specifies a prime-order group G and three orthogonal group generators $g, h_1$ and $h_2$.
G is mentioned in ...
0
votes
0answers
76 views
Prove knowledge of signature on committed value
Assume that a prover $P$, has previously obtained a signature $\sigma$ on a value $x$ from a verifier $V$. At a later stage, $P$ produces a Pedersen commitment $C$, to this value:
$C = g^x h^r$
I'm ...
2
votes
0answers
103 views
Verify commitment C commits to the same value that E encrypts
Given the following (using additive notation):
$G$ - generator of an elliptic curve group of order $q$
$s$ - secret drawn uniformly from the distribution $1..q$
$k$ and $K$ - a private public keypair
...
1
vote
1answer
222 views
Which groups to use for Pedersen Commitments
I have been reading about Pedersen Commitments, and have come across some contradictory examples, which is confusing.
Just focusing on simple commitment of scalars (not EC points or vectors), then I ...
