Questions tagged [commitments]

A commitment scheme is a protocol where one party commits themselves to a secret value without revealing it. At a later point, the value can be revealed.

Filter by
Sorted by
Tagged with
0
votes
0answers
85 views

Can Pedersen commitment be used in pairing groups?

For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
1
vote
1answer
138 views

Question of proving the opening of Pedersen Commitment

Given an opening $(m, r)$ of a Pedersen commitment $c = g^m h^r$, where $g, h$ are the generators of a group $G$ with prime order $q$ (public), a PPT prover wants to prove to a verifier the opening of ...
0
votes
0answers
120 views

Computational Binding of Pedersen Commitment

Let us assume that Alice and Bob are playing a game. Alice first commits her value chosen from $\{0,1\}$ via Pedersen commitment scheme and sends the commitment to Bob. Then Bob sends his value chosen ...
0
votes
0answers
81 views

Does Schnorr identification protocol using commitment scheme?

In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are ...
0
votes
1answer
50 views

Is the random oracle commitment scheme secure against PPT active adversaries?

The probability that a probabilistic polynomial adversary corrupting the sender can finds two pairs $(m,r)$ such that the output of the random oracle $c$ is the same (break the binding property) is ...
0
votes
1answer
135 views

Computational binding implies Perfect hiding?

Given a commitment scheme which is computationally binding (based on some conjectured hard problem, say), does it also imply that the scheme is unconditionally hiding? My idea was: Since the scheme ...
4
votes
1answer
247 views

Is it possible I can open pedersen commitments without revealing r?

With setup $p$ and $q$ where $p = 2q + 1$, and $g$ and $h$ is the generator with order $q$. In Pedersen commitment, I commit the value m with $c=g^m h^r \bmod p$, then de-commit by revealing $(m, r)$....
0
votes
1answer
74 views

What does the "x" operator stands for in cryptography?

I am studying commitment scheme and in of the notes from the class this statement comes up. I'd like to know exactly what the X = M x R mean, since I don't seem to understand how the "x" operator ...
0
votes
1answer
116 views

Is the hash-based commitment IND-CPA?

As we know the well-known hash-based commitment is as follows: Prover: given a message $m$, it: (1) picks a fresh random value $r$ (2) computes $H(r||m)=c$. Verifier: given $c$ and the commitment ...
2
votes
1answer
196 views

Can I prove in zero knowledge that the public key corresponding to a secret that I committed is in the Accumulator?

I have a set of users in my system, each having a private/public keypair of a digital signature scheme. I also have an accumulator in my system, where all the public keys of the users are accumulated. ...
0
votes
1answer
345 views

Is Commitment Scheme with hash function is a perfectly hiding scheme?

If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding? $m$ is the message $r$ is a random value In commit stage, $$ c = C(m, r)$$ In reveal stage, by ...
1
vote
0answers
49 views

How to securely and noninteractively generate a blinding factor in MimbleWimble Pedersen commitment?

I'm working on a prototype which will use MimbleWimble Confidential Assets transaction protocol using Cosmos as the blockchain layer. In my prototype a user is always sending a whole amount to another ...
1
vote
2answers
333 views

Sigma protocol with Pedersen commitment and Hash function

Suppose I construct a Pedersen commitment as $g^m h^r$. I could pick the randomness in a "pseudo-random" fashion, such that $r = H(m)$. My questions are as follows: Given that $H$ is collision-...
3
votes
0answers
131 views

Statistically Binding Commitments

Is it possible to ever have a commitment scheme that is statistically binding but not perfectly binding? The sender would be computationally unbounded, hence could always computationally trudge ...
2
votes
1answer
193 views

How can a public-key encryption scheme be used to construct a commitment scheme in the CRS model?

For a PKE scheme $(Gen, Enc, Dec)$, the most 'obvious' idea is to commit to an encryption of a bit and in the reveal phase maybe send $r_g$, $r_e$ where $r_g$ is the randomness of $Gen$ and $r_e$ is ...
1
vote
0answers
164 views

Zero knowledge proof that ElGamal ciphertext encrypts the opening of Pedersen commitment

Given ElGamal ciphertext for a message $m$ with a random $r$ as $(c_1,c_2) \gets (g^r, g^my^r)$ for a public key $y$, and a Pedersen commitment $C \gets g^xh^r$, I have been able to create a proof ...
1
vote
1answer
124 views

Commitment based on authencticated encryption

Let $(E,D)$ be the encryption/decryption of an authenticated encryption scheme. Consider the following commitment scheme. Generate a random key $k$. Commit to $m$ by sending $c=E_k(m)$. Reveal $m$ by ...
0
votes
1answer
49 views

Orthogonal generators of a group in Lelantus protocol

In the Lelantus Paper, the authors mentionned this: In our case, the commitment key ck specifies a prime-order group G and three orthogonal group generators $g, h_1$ and $h_2$. G is mentioned in ...
0
votes
0answers
87 views

Prove knowledge of signature on committed value

Assume that a prover $P$, has previously obtained a signature $\sigma$ on a value $x$ from a verifier $V$. At a later stage, $P$ produces a Pedersen commitment $C$, to this value: $C = g^x h^r$ I'm ...
2
votes
0answers
105 views

Verify commitment C commits to the same value that E encrypts

Given the following (using additive notation): $G$ - generator of an elliptic curve group of order $q$ $s$ - secret drawn uniformly from the distribution $1..q$ $k$ and $K$ - a private public keypair ...
3
votes
1answer
363 views

Which groups to use for Pedersen Commitments

I have been reading about Pedersen Commitments, and have come across some contradictory examples, which is confusing. Just focusing on simple commitment of scalars (not EC points or vectors), then I ...
2
votes
0answers
68 views

Commitment to a degree of a polynomial

Is there a way to commit to a degree of a polynomial without committing to every single one of its coefficients? The problem I am trying to solve is to prove that two polynomials are the same in a ...
2
votes
1answer
469 views

Zero knowledge proof for opening of Pedersen commit and discrete logarithm

I am looking for a proof of knowledge as such: $PK\{ (x,r) : C = g^xh^r \land V = g^x\}$ Where $C, V, g$ and $h$ are public information and $x$ and $r$ is known only to the prover. I.e. I have a ...
4
votes
1answer
438 views

Commitment to a polynomial

$A(x) \bmod B(x) = C(x)$ and $A(x) \bmod D(x) = E(x)$: A dealer knows $A(x)$ polynomial, which is a secret. He distributes $C(x)$ and $E(x)$ privately to $X$ and $Y$, respectively. $B(x)$ and $D(x)$ ...
2
votes
1answer
404 views

Simple commitment scheme using secure hash function

Can I create a simple commitment scheme using a secure hash function? If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random\_string || message)$) Thank you
4
votes
1answer
146 views

How to sign commited group elements?

I'm actually searching some particular primitive compatible with Groth-Sahai commitment. I would like to know a signature scheme (on group elements), such that there exists an algorithm $\mathtt{...
1
vote
1answer
164 views

Constant size commitment to a bivariate polynomial

In this paper by Kate et al, a constant size polynomial commitment scheme is described. The commitment scheme assumes a public reference string: \begin{align*} \Big\{ \{ g^{ \tau^i }, g^{ \alpha \...
1
vote
1answer
414 views

What is wrong with encryption-based / hash-based commitment schemes?

In the slides to my information security class it is stated without explanation that a encryption-based commitment scheme defined as follows is broken: Commit: P outputs c = Enck(m) Reveal: P sends k ...
1
vote
0answers
199 views

Efficient protocols for set membership proofs with private sets

I found the paper on Efficient Protocols for Set Membership and Range Proofs in which efficient protocols for the following problem are discussed: Given a commitment $C_v$ to a value $v$ we want show ...
0
votes
1answer
44 views

How to determine r' in pederson commitment?

Can someone help me with that question? Assuming that someone knows $log_g(h)$ so that he can calculate any message $m'$ for commitment $c$, how to determine $r'$ in?
2
votes
1answer
87 views

Are Fujisaki commitments binding if the factorization of the group is known?

If I understand correctly, a Fujisaki commitment is as follows: $g^m \cdot h^r $ mod $n$, where $m$ is a message, $r$ is a random number, there exists $a$ such that $h^a = g$, and $n$ is an RSA ...
3
votes
1answer
235 views

Verifiable Encryption of a Pedersen Commitment

Can the Verifiable Encryption of a Discrete Logarithm scheme of the paper https://www.shoup.net/papers/verenc.pdf (page 19) be used to verify that a ciphertext encrypts the same value committed in a ...
1
vote
0answers
43 views

Gennaro multi trapdoor commitment scheme

In the Scheme Based on the SDH Assumption (page 11 of the paper https://link.springer.com/content/pdf/10.1007%2F978-3-540-28628-8_14.pdf), how does the commitment get revealed with the master trapdoor ...
3
votes
1answer
201 views

What information does $g^x$ reveal about $x$?

Let $p$ be a large prime number. Let $G$ be a subgroup of $\mathbb{Z}_p^*$ with order $q$ - again a large prime. Let $g$ be a generator of $G$. Consider the following standard protocol for ...
2
votes
1answer
256 views

Pedersen commitments in bulletproofs

In Bulletproofs range proof, Pedersen commitments look like $C=aG+bH$ If I need to proof several values' range proof and keep G as constant, do I need to change H everytime? I have found it doesn't ...
7
votes
0answers
474 views

What's the difference among Vector Commitment, Zero-knowledge Set, Zero-knowledge Accumulator, and Zero-knowledge Elementary Database?

Vector commitment allows one to commit to an ordered sequence of $q$ value ($m_1,\cdots,m_q$) in such a way that one can later open the commitment at specific positions(e.g., prove that $m_i$ is the $...
2
votes
1answer
132 views

Honest Verifier Zero-Knowledge Game for Sigma Protocols

I am looking for how an adversary to special HVZK would work. In Boneh and Shoup's book (BonehShoup) they have Attack Game 20.4 for special cHVZK. Here, the adversary produces a pair (x,y) (witness ...
0
votes
1answer
71 views

Selectively opening only a few commitments

I have k messages $m_1,m_2...m_k$ and I want to commit to all of them but open only a few of them -- as asked by Bob. Each message is of $n$ bits. Show how one can commit to all the $k$ messages and ...
1
vote
0answers
124 views

Prove that two commitments are commitments to the same value

Let $x$ be the secret value, $(n,a,b,c)$ a public key, $(n_C, g, h)$ the commitment public key. Furthermore let $r, r_C$ be two random numbers. Define $C = g^x h^{r_C} \bmod n_C$, $C_x = a^x b^r \...
2
votes
2answers
95 views

Zero Knowledge for Low Entropy Witness

For any PPT prover ($p$) and verifier ($v$), imagine I have a low entropy witness, say smaller than $2^8$. Now, let us say I have a dlog statement in the form of $y = g^w$. Theory says I could use a ...
2
votes
1answer
381 views

Disjunctive zero knowledge proof of equality of committed values

I have read on ZK proof of equality of committed values, that is for $g^xh^y$ and $g^{x'}h^{y'}$, prove in ZK that $x = x'$ (can also be generalized if generators are different using sigma-protocols). ...
1
vote
1answer
56 views

Can 2 bit commitment protocols be secure when sent together with the same bit

Suppose I have 2 bit commitment schemes, C1 and C2 which are computationally hiding.Suppose I commit the same bit using both and send them to an adversary who knows that the same bit was committed. Is ...
2
votes
1answer
350 views

trapdoor commitment from lattice-based assumptions?

I'm wondering that is there any equivocal commitment scheme (i.e., trapdoor commitment) can be constructed from lattice-based assumptions? I know there are a lot of commitment schemes from lattices as ...
1
vote
0answers
86 views

Simple reduction of commitments to one way functions

I am looking for an explicit and simple reduction of commitments to one way functions. I don't care about the number of rounds, only simplicity. I am aware of the simple reductions you can find in ...
0
votes
1answer
155 views

How to change the following commitment scheme to Pedersen commitment?

In my question here Zero knowledge set membership protocol The suggested solution allows a prover to choose a commitment $C$. Then, A trusted third party ($T$) can validate if $C$ is valid or not. ...
4
votes
3answers
1k views

Pedersen commitment in elliptic curves

I try to understand Pedersen commitment in elliptic curves over finite fields. I could use some clarification. Let's say we have two generators $G$ and $H$. Is that required that $G$ and $H$ are ...
2
votes
2answers
177 views

How do I create a cryptographic signature and commitment scheme with accountable evidence?

This is a weird one... I am looking for a method which I don't even know how to call, nor whether it actually exists! Given a pair of asymmetric keys $s_{k}/P_{k}$ and defining $Sig_{k} \dagger B_{i}$...
1
vote
1answer
641 views

Zero knowledge set membership protocol

I read that paper Efficient Protocols for Set Membership and Range Proofs of Camenisch et. al that describes the zero knowledge range proof. The paper applications looks interesting like if you want ...
0
votes
1answer
65 views

Commitment which allows negative proof

I need to create a commitment to a value X such that I can provide either proof that the commitment is to X or proof that the commitment is not to some other given value Y != X. If I use a simple ...
0
votes
0answers
61 views

Prove I know a value v in a set s.t. K = H(v) [duplicate]

Is it possible to prove that I know a value v in a finite set, such that the hash of the value v is K. Where v is private and K is public