Skip to main content

Questions tagged [commitments]

A commitment scheme is a protocol where one party commits themselves to a secret value without revealing it. At a later point, the value can be revealed.

Filter by
Sorted by
Tagged with
2 votes
0 answers
47 views

Efficient NOT in set proof?

I am looking for a solution for a very specific problem, I have one, but I am not statisfied with it and it feels there must be a much more efficient way to do this. I have a hashed value of 256 bits. ...
ovanwijk's user avatar
  • 155
2 votes
3 answers
160 views

How to anonymously vote?

I have a group of $n$ people (say small constant). Each person votes for $A$ or $B$, and we want to know who won without knowing each individual's vote. How would one design a scheme for this? My ...
adbforlife's user avatar
0 votes
0 answers
31 views

Hash-based Polynomial Commitment Scheme for Small Polynomials

I am building a SNARK project which needs to use PCS (polynomial commitment scheme). Because of some constraints, I want the field of PCS to have no additional structures and thus I only want to use ...
andy's user avatar
  • 1
2 votes
0 answers
48 views

Succinct proof of evaluation of known polynomial

Consider the zeroes polynomial $$ zeroes_n(X) = \prod_{0\leq i< n} (X-i) . $$ Fix a large prime $p$, and fix some $n$ that is less than $p$ but which may still be very large (e.g. $p\approx 2^{256}...
Jim's user avatar
  • 131
0 votes
1 answer
45 views

Zero knowlede proof of linear relations

Suppose a prover publishes two perfectly hiding commitments for $s_1,s_2$, i.e. two Pedersen commitments $C_1=g^{s_1}h^{r_1}$ and $C_2=g^{s_2}h^{r_2}$ such that $s_1,s_2,r_1,r_2$ are secret field ...
Itamar Lishansky's user avatar
1 vote
0 answers
46 views

Simulating physical envelops: Will commitments work in this case?

I want to simulate following physical activity in cryptography. Person X has written integers 1, 2, ..., 10 in seperate paper slips. He needs to distribute these slips to 10 people without knowing ...
user60588's user avatar
  • 307
2 votes
1 answer
58 views

Equality check with Pedersen commitments

Does the Pedersen commitment scheme allow for checking whether two commitments are made - say by different people - for the same value?
user60588's user avatar
  • 307
1 vote
1 answer
54 views

Winner and individual vote counts in online voting in DRE-i and DRE-ip

I have seen few well-known related papers on online voting : DRE-i, DRE-ip and this one. They have explained most of the process such as vote casting and vote tallying. But I did not find when and ...
user60588's user avatar
  • 307
1 vote
0 answers
62 views

A problem involving Commitments

Suppose there is a set $P=\{p_1, p_2, ..,p_l\}$ of stock buyers who can make commitments to a share $s_i$ in a set $S=\{s_1,s_2,...,s_m\}$ of shares for an amount $a_i$ in a set $A=\{a_1,a_2,...,a_n\}$...
user60588's user avatar
  • 307
0 votes
0 answers
40 views

Blob for Commitments

I am currently reading the paper Multiparty Unconditional Secure Protocols (https://dl.acm.org/doi/10.1145/62212.62214). They use blob for commitments. The purpose of blobs is to allow a participant $...
Crypto_researcher's user avatar
2 votes
0 answers
66 views

Cryptographic accumulator via function composition

I am looking for an alternative to RSA accumulators, and I am wondering if the following option based on function composition might fit the bill. It seems like an obvious tweak on RSA accumulators, ...
Carson Farmer's user avatar
0 votes
1 answer
87 views

Generators g,h of the Pedersen commitment

I am aware that in the Pedersen commitment scheme, the relationship between g and h must be unknown in terms of discrete logarithms. Knowing the relationship would be insecure as it would break the ...
clemdcz's user avatar
0 votes
0 answers
17 views

[error reducing techinique in lattice based commitment]

I am aware there are many techniques to reduce the error of lattice-based homomorphic encryption. But is there any technique to deal with lattice-based homomorphic commitment, e.g., More Efficient ...
js wang's user avatar
  • 327
2 votes
2 answers
120 views

Is it possible to check pedersen commitment is of postive or negative number without knowing the original value

I generated a Pedersen commitment for a given account balance (say, 10) and stored it in the ledger. Now, when I debit 15 tokens from the same account, I first retrieve the Pedersen commitment of 10 ...
Prady Tej's user avatar
0 votes
0 answers
40 views

How can I determine if the result of subtracting two Pedersen commitments is negative or positive?

I'm using Pedersen commitments to maintain the account balance in the ledger. Assume that when I create the account, I record the Pedersen commitment of 0 in a ledger (here, the blinding factor and ...
Prady Tej's user avatar
1 vote
1 answer
141 views

Proof of non membership in a Verkle Tree?

According to the author of the original paper[1], Verkle Trees basically let you save space (typically bandwidth, which can be expensive) by replacing a secure hash with a vector commitment scheme, ...
afm's user avatar
  • 111
0 votes
0 answers
45 views

Is the NIZK constructed based on Pedersen commitment transparent?

It is well-known that, in the setup phase of Pedersen commitment, it is necessary to generate $g,h\in G$. Then a user can compute $c = g^vh^r$ to commit the value $v$. Is a trusted center needed to ...
user109993's user avatar
2 votes
0 answers
153 views

Equality of ElGamal plaintext & Pedersen commitment message

Let's imagine two entities: Bob and Alice. Bob's public key is $B = bG$. Alice's public key is $A = aG$. Alice encrypts her number $n$ with Bob's public key so Bob could decrypt it ($n$ is small ...
Seed Barret's user avatar
1 vote
1 answer
87 views

Where & how is the 2nd group used in the KZG Commitment Scheme in case the 2 groups are not the same?

This is about the KZG Polynomial Commitment Scheme In Section 2, it's written We use the notation $e : \mathbb G \times \mathbb G \mapsto \mathbb G_T$ to denote a symmetric (type 1) bilinear pairing....
user93353's user avatar
  • 2,295
0 votes
1 answer
103 views

Given pedersen commitments of some elements, how to prove that the sum of only one subset of these elements is equal to the given element θ?

Assume that Prover have $n$ pedersen commitments ($V_{a_1},V_{a_2},\cdots,V_{a_n}$ where $V_{a_i}=G \cdot a_i + H \cdot r_{a_i}$) of $n$ elements $a_1,a_2,\cdots,a_n$. The Prover have another element $...
user105684's user avatar
1 vote
1 answer
87 views

Interpolating polynomial discrete log

This is taken from page 16 of Stacking Sigmas Essentially, let $0<t<\ell$ be integer values smaller than a certain prime modulus $q$. We have a set $\mathcal{X}$ with $|\mathcal{X}|=\ell-t+1$, $[...
Cristian Baeza's user avatar
1 vote
1 answer
94 views

Is it possible to batch ZKP proofs from different polynomials but same point?

According to the ZKP MOOC lecture by Dan Boneh, it is possible to batch proofs from different polynomials and different points into a single group element: Nonetheless, I haven't been able to find ...
Dani Vilardell's user avatar
0 votes
1 answer
51 views

Public commitments to subsets

Problem Suppose there is an entity with some users. The users are split into subsets (determined by the entity) and the entity needs to create public commitments to these subsets such that only a user ...
Stent's user avatar
  • 5
1 vote
0 answers
195 views

Quantum-safe algorithm for hiding cryptocurrency transaction amount [closed]

I have a decentralized coin system that I am trying to develop. Each coin can be split up into 1,000,000 units. I've been looking for a quantum-safe and practical (efficient) algorithm to send ...
rapt's user avatar
  • 91
0 votes
1 answer
154 views

Verification in Bulletproof commitment scheme

I am reviewing the ZKP course, represented by the university of Berkley (https://zk-learning.org/). In pages 44 of lecture 6 that is attached below (https://zk-learning.org/assets/lecture6.pdf), the ...
tesoke's user avatar
  • 181
0 votes
0 answers
61 views

Can homomorphic property of a commitment scheme be harmful?

Homomorphic properties turn out to be very useful, e.g., for achieving secure multiparty computation. As a concrete example, homomorphic commitments can be used as a building block for secure ...
user1035648's user avatar
1 vote
1 answer
55 views

Hiding and binding property of Goldwasser-Micali like bit commitment scheme

Let $N=pq$ be an RSA modulus, that is, $p$ and $q$ are large, distinct primes. Let $J_{N}=\{y\in\mathbb{Z}^{*}_{N}:(\frac{y}{N})_{J}=1\}$ denote the set of all integers in $\mathbb{Z}^{*}_{N}$ with ...
user1035648's user avatar
0 votes
1 answer
46 views

implementing pedersen commtiment using lib sodium

Hi I want to implement pedersen commitment ontop of lib sodium Below is what I am trying to do: comm1: m1G+r1H comm2: m2G+r2H comm3: (m1+m2)G+(r1+r2)H comm4: comm1+comm2 and comm3 should equals ...
js wang's user avatar
  • 327
2 votes
1 answer
127 views

How to find second subgroup for ECC Pairing?

Pretty new to ECC Pairings. I am trying to understand KZG Commitments from multiple sources. I found this blog beginner friendly and easier to understand. However, I'm stuck at ECC Pairings and having ...
Razor Sharp's user avatar
0 votes
2 answers
167 views

Hiding property of Elgamal-like bit commitment

An Elgamal-like bit commitment scheme: Let $\langle g \rangle$ be a group of order $n$, where $n$ is a large prime. Let $h\in_{R}\langle g \rangle\setminus\{1\}$ denotes a random group element such ...
user1035648's user avatar
2 votes
0 answers
89 views

Poly-commitment based on Bulletproofs

I am reviewing the ZKP course, represented by the university of Berkley (https://zk-learning.org/). In pages 41 and 42 of lecture 6 that is attached below (https://zk-learning.org/assets/lecture6.pdf),...
tesoke's user avatar
  • 181
5 votes
1 answer
150 views

The rigorous proof in the commitment based on CRHF

I'm reading about the lecture of Yevgeniy Dodis. In his lecture 14, section 2.3.2, gives a commitment construction based on CRHF, but the proof of hiding is high-level. I want to know the rigorous ...
constantine's user avatar
3 votes
1 answer
152 views

Division of two Elliptic curve points in KZG polynomial commitment scheme!

I have some issue to understand the verify round of the KZG polynomial commitment scheme. The following diagram is associated to the scheme. I appreciate any help. To verify, the verifier should ...
tesoke's user avatar
  • 181
1 vote
1 answer
173 views

How to deal with Pedersen commitment message or randomness overflow?

For EC Pedersen commitment: The two generators are G and H. Two messages and randomness are $m_1$, $m_2$, $r_1$, $r_2$, so the two Pedersen commitments are $Gm_1+Hr_1$ and $Gm_2+Hr_2$. When adding ...
js wang's user avatar
  • 327
2 votes
1 answer
294 views

Implementing a Merkle tree using a 128 bit hash function?

I need to implement a Merkle tree using a 128 bit hash function. In general, any hash function that guarantees pre-image, second pre-image and collission resistance should be fine to implement a ...
Lorenzo's user avatar
  • 149
2 votes
1 answer
106 views

Is a Pedersen commitment still secure when r is either 0 or 1?

Specifically if we know the $r$ takes values from the set $\{0,1\}$and $c=g^r*h^m$ does the hiding property still hold? I think I already managed to prove that the binding property holds due to the ...
GeorgeT's user avatar
  • 23
2 votes
1 answer
96 views

Hiding sum of vectors. Hardness based on CVP

This is the problem Let $\mathcal{L}$ be a lattice and $v_1,v_2,\ldots,v_n\notin\mathcal{L}$. Given the values $a_1,\ldots,a_n$ such that $$a_1=\lfloor v_1\rceil+v_2+\ldots+v_n$$ $$a_2=v_1+\lfloor v_2\...
Cristian Baeza's user avatar
1 vote
1 answer
189 views

Looking for efficient implementations for Pedersen commitment

Hi I am currently developing a research project, but it seems that my implementation of Pedersen commitment is not efficient. I wonder if there are any efficient implementation of Pedersen ...
js wang's user avatar
  • 327
2 votes
1 answer
53 views

Can we pad witness of bulletproof and dory to be exponential size?

Bulletproof and dory reduce the witness size by a half during each interaction, until the witness is compressed to be only one element. But what about the witness is not precisely exponential size? ...
Walker's user avatar
  • 61
5 votes
1 answer
782 views

How to reveal/prove some personal information later

I want to put some personal info like name and email in e.g. some program that I release to the public but I don't want anybody be able to retrieve those personal info and only when I want they can ...
Maloo's user avatar
  • 53
2 votes
1 answer
455 views

What is the difference between those two KZG Polynomial Commitment Schemes?

In short what are the differences (pros & cons) between multiplying by powers of Tau (from this lecture https://youtu.be/tAdLHQVW) and raising to powers of Tau (from this lecture https://youtu.be/...
ShAr's user avatar
  • 160
2 votes
1 answer
197 views

Pedersen commitments equivalence

Is there a zero-knowledge proof that proves that two Pedersen commitments commit the same value?
Fiono's user avatar
  • 567
2 votes
1 answer
73 views

How to multiply the Pedersen Commitment of two numbers?

Given two numbers $x_1$, $x_2$ and their respective binding numbers, $b_1$ and $b_2$, let's take their Pedersen Commitment to be $C(x_n, b_n)$ $\forall n=1,2$. What is $C(x_1 * x_2, b_1 * b_2)$?
Jim's user avatar
  • 123
2 votes
1 answer
412 views

In the Kate/KZG Polynomial Commitment Scheme, in which Polynomial Ring should the polynomial to be committed be?

In the Kate Polynomial Commitment scheme, a commitment of a Polynomial $f(x)$ at $x=s$ is defined as $Com_f = f(s).G$ where $G$ is the generator of the Elliptic Curve of prime order which is used. So ...
user93353's user avatar
  • 2,295
1 vote
1 answer
222 views

What is a practical application of evaluating at a point in the Kate Polynomial Commitment Scheme?

I understand how the Kate Polynomial Commitment Scheme Evaluation Proof works however, I don't understand what is the purpose of it? In general, in a commitment scheme, Peggy commits to message & ...
user93353's user avatar
  • 2,295
3 votes
1 answer
113 views

Question about the soundness of using a pairing map in the Kate Polynomial Commitment Scheme

I am looking at the paper on Kate Polynomial Commitments. On Page 7, VerifyEval, the verifier checks the following to verify commitment. $e(\mathcal C, g) \stackrel {?}{=} e(w_i, \frac {g(\alpha)}{g(i)...
user93353's user avatar
  • 2,295
5 votes
2 answers
127 views

Coin flipping without commitments or random oracles

It's well known that two parties, Alice and Bob, can flip a fair coin using commitments. Alice picks a random number $a \in \mathbb{Z}_q$ and computes $c_a = Com(a, r_a)$ where $r_a \xleftarrow{R} \...
Ari's user avatar
  • 178
3 votes
1 answer
128 views

Why is Lagrange interpolation required in Batch Opening case of KZG/Kate PCS?

From here - Batch Opening of KZG PCS One can prove multiple evaluations $(\phi(e_i) = y_i)_{i\in I}$,for arbitrary points $e_i$ using a constant-sized KZG batch proof, $\pi_I = g^{q_I(\tau)}$, where \...
user93353's user avatar
  • 2,295
0 votes
1 answer
38 views

Unable to find the Appendices of the Kate Polynomial Commitments paper

I am looking at the paper on Kate Polynomial Commitments. The paper refers to Appendix A & Appendix B but it's not available with the document. Does anyone know where I find the full paper with ...
user93353's user avatar
  • 2,295
2 votes
2 answers
236 views

Proving same value in ciphertext and Pedersen commitment Using Sigma Zero Knowledge

Let we have 2 generator $G$ and $H$ in any elliptic curve. A prover creates a ciphertext with Homomorphic ElGamal, $(r_1G,\;mG + r_1P)$ such that $r_1$ is random and $P$ is public key of the prover. ...
midmotor's user avatar

1
2 3 4 5 6