Questions tagged [commitments]

A commitment scheme is a protocol where one party commits themselves to a secret value without revealing it. At a later point, the value can be revealed.

Filter by
Sorted by
Tagged with
29
votes
4answers
5k views

How to fairly select a random number for a game without trusting a third party?

Several people are playing a game with random events and require a way to produce a random number. (Such as dice rolls or a lottery.) Can this be done such that each player has the power to be ...
14
votes
1answer
741 views

Overview of relations between cryptographic primitives?

Is there a web page that gives a graphical (or, alternatively, a textual) overview of known implications and separations between cryptographic primitives? More specifically, I am looking for ...
17
votes
1answer
8k views

Why is the Pedersen commitment computationally binding?

This is how the Pedersen commitment seems to work: Let $p$ and $q$ be large primes such that $q \mid (p-1)$, let $g$ be a generator of the order-$q$ subgroup of $Z_p^{\star}$. Let $a$ be a random ...
14
votes
1answer
11k views

What is a Pedersen commitment?

I couldn't find any answer providing a high-level overview on what Pedersen commitments are or what they are used for.
5
votes
1answer
222 views

Is authenticated encryption basically a lockable box?

I recently used a custom construction as a commitment scheme, which was taken from the standard picture you give people while explaining commitment schemes. Basically commitment schemes can be ...
3
votes
1answer
167 views

Is it possible I can open pedersen commitments without revealing r?

With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$. In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$, then de-commit by revealing $(m, r)$....
3
votes
2answers
447 views

Prove I know a value $v$ in a Pedersen Commitment without revealing it

Given a Pedersen Commitment: $P = aG + vH$ Where $G$ and $H$ are points in some group. $a$ is a blinding value/mask and $v$ is the value I wish to commit to. Is there a way to prove I know $v$ ...
4
votes
1answer
1k views

Why is the Pedersen commitment perfectly hiding?

I learned today about the Pedersen commitment scheme. A quick reminder (I know there are some variants of this scheme, so I will present the one I learned about): Public parameters - 2 primes $p,q$...
-1
votes
1answer
2k views

Pedersen commitments and addition

For Confidential Transactions a Pedersen commitment is being used. The commitment preserves addition and the commutative property applies: $$C(\text{BF}_1, \text{data}_1) \oplus C(\text{BF}_2, \text{...
12
votes
1answer
4k views

Difference between Pedersen commitment and commitment based on ElGamal

Does any of you know what is the difference between the Pedersen commitment and the commitment that uses the ElGamal encryption scheme? For the sake of completeness, I recall what both of them look ...
4
votes
2answers
970 views

What is the reason of using Pedersen Commitment scheme over HMAC?

I want to implement non-interactive Bit Commitment scheme for messages of arbitrary length. And I am curious, what is the reason of using Pedersen Commitment scheme over Salted Hash (in other words ...
6
votes
2answers
307 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
5
votes
4answers
343 views

Are deterministic adversaries as powerful as probabilistic adversaries?

SOURCE states the following in the proof of Theorem 2: Without loss of generality, I will assume that A is deterministic. If A is randomized, we can determinize it by fixing a sequence of coins ...
4
votes
1answer
815 views

What type of hash functions provides non-malleability of hash digests?

I want to use a hash function for commitments. I don't want an attacker to construct a commitment related to a previously published (but still unopened) commitment. A simple deterministic commitment ...
3
votes
1answer
101 views

How to achieve identity authentication without revealing credentials

I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be ...
1
vote
1answer
81 views

Proving item association without revealing one of the associated items

I'm a total noob when it comes to cryptography but I believe this falls under the "zero knowledge" category. I have two associated pieces of information: tag — known by both parties. Unique per ...
1
vote
1answer
537 views

Zero knowledge set membership protocol

I read that paper Efficient Protocols for Set Membership and Range Proofs of Camenisch et. al that describes the zero knowledge range proof. The paper applications looks interesting like if you want ...
0
votes
0answers
74 views

A card game (for mental poker or any other card game)

I thought of a way to produce trustless card game in a flexible way. One feature that I want is it should be flexible (It should work for any type of card game, though I indeed started it as a ...