Questions tagged [commitments]
A commitment scheme is a protocol where one party commits themselves to a secret value without revealing it. At a later point, the value can be revealed.
144
questions
1
vote
0answers
12 views
How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?
In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about ...
3
votes
2answers
48 views
How to show that Cx is a commitment to a integer of length lm
With reference to Jan Camenisch and Anna Lysyanskaya's paper A Signature Scheme with Efficient Protocols, in proceedings of SCN 2002, I need some help to understand How to verify that $C_x$ is a ...
0
votes
0answers
65 views
regarding usage of hashing
I have a question regarding pitfalls of using only encryption.
Suppose Bob and Alice want to flip a coin over a network. Alice proposes the following protocol.
Alice randomly selects a value X ∈ {0,1}...
0
votes
0answers
21 views
Subset-sum Problem & Commitment Schemes
In this question I asked about a subset sum hash. Would it be possible to adapt that into a commitment scheme by keeping M private and revealing it at a later time? Would this be secure for some size ...
0
votes
0answers
67 views
Zero Knowledge Set Membership proof
ZK set membership:
I am trying to create my own zero knowledge set membership proof for a commitment to an element in the set for small sets. I am a beginner in such works, so can someone help me find ...
3
votes
1answer
88 views
How to achieve identity authentication without revealing credentials
I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be ...
4
votes
0answers
145 views
Computationally binding commitment
A Computationally Binding commitment scheme is defined as a tuple of protocols $(\mathsf{Keygen}, \mathsf{Com}, \mathsf{Open})$, that along with correctness guarantees that for all PPT algorithms the ...
1
vote
1answer
36 views
Constant size commitment to a membership of a fixed size of elements
Suppose there is a global set of $n$ elements, out of which I want to commit to $2n/3$ elements, i.e., anyone can take my commitment and test what $2n/3$ of the possible $n$ elements I committed to.
...
4
votes
2answers
61 views
Sigma proofs for Pedersen commitments arithmetic under different bases
I was wondering if it's possible to prove an equality of openings between $3$ Pedersen commitments $P\cdot Q$ and $R$ when $P, Q, R$ have different commitment keys.
Suppose that commitment $R$ commits ...
0
votes
0answers
13 views
Sigma-Protocol to prove a commitment to a commitment
Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (...
0
votes
0answers
36 views
Can Pedersen commitment be used in pairing groups?
For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
1
vote
1answer
68 views
Question of proving the opening of Pedersen Commitment
Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
43 views
Computational Binding of Pedersen Commitment
Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
0
votes
0answers
39 views
Does Schnorr identification protocol using commitment scheme?
In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are ...
0
votes
1answer
38 views
Is the random oracle commitment scheme secure against PPT active adversaries?
The probability that a probabilistic polynomial adversary corrupting the sender can finds two pairs $(m,r)$ such that the output of the random oracle $c$ is the same (break the binding property) is ...
0
votes
1answer
48 views
Computational binding implies Perfect hiding?
Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding?
My idea was: Since the scheme ...
0
votes
0answers
46 views
Range Proofs based on Polynomial Commitment Scheme (PCS)
I have been trying to implement the PCS-based Range Proofs as described here.
My code is in a public repository.
I am not able to understand this part:
This w_cap is a linear combination of f and ...
2
votes
1answer
157 views
Is it possible I can open pedersen commitments without revealing r?
With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$.
In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$,
then de-commit by revealing $(m, r)$....
0
votes
1answer
64 views
What does the “x” operator stands for in cryptography?
I am studying commitment scheme and in of the notes from the class this statement comes up.
I'd like to know exactly what the X = M x R mean, since I don't seem to understand how the "x" operator ...
0
votes
1answer
48 views
Is the hash-based commitment IND-CPA?
As we know the well-known hash-based commitment is as follows:
Prover: given a message $m$, it:
(1) picks a fresh random value $r$
(2) computes $H(r||m)=c$.
Verifier: given $c$ and the commitment ...
1
vote
1answer
85 views
Can I prove in zero knowledge that the public key corresponding to a secret that I committed is in the Accumulator?
I have a set of users in my system, each having a private/public keypair of a digital signature scheme. I also have an accumulator in my system, where all the public keys of the users are accumulated.
...
0
votes
0answers
37 views
Is it correct using Sigma Protocol to do the knowledge proof?
For this background,
the prover knows a secret $x$ for $h=gx$. Prove to the verifier that he knows $x$.
(I know $h=gx$ is not a NP problem, I just want to practice the Sigma Protocol)
Step 1 : $P \...
0
votes
1answer
93 views
Is Commitment Scheme with hash function is a perfectly hiding scheme?
If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding?
$m$ is the message
$r$ is a random value
In commit stage,
$$ c = C(m, r)$$
In reveal stage, by ...
1
vote
0answers
32 views
How to securely and noninteractively generate a blinding factor in MimbleWimble Pedersen commitment?
I'm working on a prototype which will use MimbleWimble Confidential Assets transaction protocol using Cosmos as the blockchain layer.
In my prototype a user is always sending a whole amount to ...
1
vote
2answers
178 views
Sigma protocol with Pedersen commitment and Hash function
Suppose I construct a Pedersen commitment as $g^m h^r$. I could pick the randomness in a "pseudo-random" fashion, such that $r = H(m)$. My questions are as follows:
Given that $H$ is collision-...
2
votes
0answers
60 views
Statistically Binding Commitments
Is it possible to ever have a commitment scheme that is statistically binding but not perfectly binding?
The sender would be computationally unbounded, hence could always computationally trudge ...
2
votes
1answer
69 views
How can a public-key encryption scheme be used to construct a commitment scheme in the CRS model?
For a PKE scheme $(Gen, Enc, Dec)$, the most 'obvious' idea is to commit to an encryption of a bit and in the reveal phase maybe send $r_g$, $r_e$ where $r_g$ is the randomness of $Gen$ and $r_e$ is ...
1
vote
0answers
62 views
Zero knowledge proof that ElGamal ciphertext encrypts the opening of Pedersen commitment
Given ElGamal ciphertext for a message $m$ with a random $r$ as $(c_1,c_2) \gets (g^r, g^my^r)$ for a public key $y$, and a Pedersen commitment $C \gets g^xh^r$, I have been able to create a proof ...
1
vote
1answer
65 views
Commitment based on authencticated encryption
Let $(E,D)$ be the encryption/decryption of an authenticated encryption scheme. Consider the following commitment scheme.
Generate a random key $k$. Commit to $m$ by sending $c=E_k(m)$.
Reveal $m$ by ...
0
votes
1answer
41 views
Orthogonal generators of a group in Lelantus protocol
In the Lelantus Paper, the authors mentionned this:
In our case, the commitment key ck specifies a prime-order group G and three orthogonal group generators $g, h_1$ and $h_2$.
G is mentioned in ...
0
votes
0answers
67 views
Prove knowledge of signature on committed value
Assume that a prover $P$, has previously obtained a signature $\sigma$ on a value $x$ from a verifier $V$. At a later stage, $P$ produces a Pedersen commitment $C$, to this value:
$C = g^x h^r$
I'm ...
2
votes
0answers
102 views
Verify commitment C commits to the same value that E encrypts
Given the following (using additive notation):
$G$ - generator of an elliptic curve group of order $q$
$s$ - secret drawn uniformly from the distribution $1..q$
$k$ and $K$ - a private public keypair
...
1
vote
1answer
152 views
Which groups to use for Pedersen Commitments
I have been reading about Pedersen Commitments, and have come across some contradictory examples, which is confusing.
Just focusing on simple commitment of scalars (not EC points or vectors), then I ...
2
votes
0answers
53 views
Commitment to a degree of a polynomial
Is there a way to commit to a degree of a polynomial without committing to every single one of its coefficients?
The problem I am trying to solve is to prove that two polynomials are the same in a ...
2
votes
1answer
245 views
Zero knowledge proof for opening of Pedersen commit and discrete logarithm
I am looking for a proof of knowledge as such:
$PK\{ (x,r) : C = g^xh^r \land V = g^x\}$
Where $C, V, g$ and $h$ are public information and $x$ and $r$ is known only to the prover.
I.e. I have a ...
3
votes
1answer
317 views
Commitment to a polynomial
$A(x) \bmod B(x) = C(x)$ and $A(x) \bmod D(x) = E(x)$:
A dealer knows $A(x)$ polynomial, which is a secret. He distributes $C(x)$ and $E(x)$ privately to $X$ and $Y$, respectively. $B(x)$ and $D(x)$ ...
2
votes
1answer
208 views
Simple commitment scheme using secure hash function
Can I create a simple commitment scheme using a secure hash function?
If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random\_string || message)$)
Thank you
1
vote
0answers
67 views
How to sign comitted group elements?
I'm actually searching some particular primitive compatible with Groth Sahai commitment.
I would like to know a signature scheme (on group elements), such that there exists an algorithm $\mathtt{...
2
votes
1answer
104 views
Constant size commitment to a bivariate polynomial
In this paper by Kate et al, a constant size polynomial commitment scheme is described.
The commitment scheme assumes a public reference string:
\begin{align*}
\Big\{
\{ g^{ \tau^i }, g^{ \alpha \...
1
vote
1answer
208 views
What is wrong with encryption-based / hash-based commitment schemes?
In the slides to my information security class it is stated without explanation that a encryption-based commitment scheme defined as follows is broken:
Commit: P outputs c = Enck(m)
Reveal: P sends k ...
1
vote
0answers
126 views
Efficient protocols for set membership proofs with private sets
I found the paper on Efficient Protocols for Set Membership and Range Proofs in which
efficient protocols for the following problem are discussed:
Given a commitment $C_v$ to a value $v$ we want show ...
0
votes
1answer
42 views
How to determine r' in pederson commitment?
Can someone help me with that question? Assuming that someone knows $log_g(h)$ so that he can calculate any message $m'$ for commitment $c$, how to determine $r'$ in?
2
votes
1answer
81 views
Are Fujisaki commitments binding if the factorization of the group is known?
If I understand correctly, a Fujisaki commitment is as follows: $g^m \cdot h^r $ mod $n$, where $m$ is a message, $r$ is a random number, there exists $a$ such that $h^a = g$, and $n$ is an RSA ...
3
votes
1answer
164 views
Verifiable Encryption of a Pedersen Commitment
Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a ...
1
vote
0answers
40 views
Gennaro multi trapdoor commitment scheme
In the Scheme Based on the SDH Assumption (page 11 of the paper https://link.springer.com/content/pdf/10.1007%2F978-3-540-28628-8_14.pdf), how does the commitment get revealed with the master trapdoor ...
3
votes
1answer
185 views
What information does $g^x$ reveal about $x$?
Let $p$ be a large prime number. Let $G$ be a subgroup of $\mathbb{Z}_p^*$ with order $q$ - again a large prime. Let $g$ be a generator of $G$.
Consider the following standard protocol for ...
2
votes
1answer
219 views
Pedersen commitments in bulletproofs
In Bulletproofs range proof, Pedersen commitments look like $C=aG+bH$
If I need to proof several values' range proof and keep G as constant, do I need to change H everytime?
I have found it doesn't ...
6
votes
0answers
322 views
What's the difference among Vector Commitment, Zero-knowledge Set, Zero-knowledge Accumulator, and Zero-knowledge Elementary Database?
Vector commitment allows to commit to an ordered sequence of $q$ value ($m_1,\cdots,m_q$) in such a way that one can later open the commitment at specific positions(e.g., prove that $m_i$ is the $i$-...
2
votes
1answer
101 views
Honest Verifier Zero-Knowledge Game for Sigma Protocols
I am looking for how an adversary to special HVZK would work. In Boneh and Shoup's book (BonehShoup) they have Attack Game 20.4 for special cHVZK.
Here, the adversary produces a pair (x,y) (witness ...
0
votes
1answer
66 views
Selectively opening only a few commitments
I have k messages $m_1,m_2...m_k$ and I want to commit to all of them but open only a few of them -- as asked by Bob. Each message is of $n$ bits. Show how one can commit to all the $k$ messages and ...
