New answers tagged commitments
2
I wonder why this is a requirement?
If the prover knows what $s$ is, they can open the commitment to any value they want.
Suppose that the commitment was $c = g^x h^r$, where $x$ is the originally committed value.
Then, if the prover knows $s$, then he can take an arbitrary value $y$ and compute $r' = r + s^{-1}(x - y)$; then, he can open the commitment as $...
1
There are many academic works on finding a curve for a given order.
1994 - Georg-Johann LayHorst G. Zimmer - Constructing elliptic curves with given group order over large finite fields
A procedure is developed for constructing elliptic curves with given group order over large finite fields. The generality of the construction allows an arbitrary choice of ...
-1
In the Paper for the curve25519 Bernstein described how he got the parameters for the curve. For security reasons it was important for him to have prime orders, for efficiency reasons it was important to have small parameters for the curve. He then iterated over parameters starting at zero to find an elliptic curve with a wanted order. I think this is still ...
0
and, if I'm not wrong, a possible way to add the randomness proposed by @poncho leads you to Pedersen commitments... which, by the way, have reversed properties strengths: theoretically hiding (thanks to introduced randomness) and computationally binding (because finding two couples $(randomness_{0}$,$m_{0})$ and $(randomness_{1}$,$m_{1})$ opening the same ...
1
Obviously, this scheme is not perfectly hiding. But assuming the discrete logarithm is hard, receiver or an adversary can't determine the committed message prior to reveal, so I believe this provides computational hiding.
If the receiver had no other information about $m$, then you would be correct.
On the other hand, we typically assume that he has some ...
2
Statistical hiding for a commitment is not about the distribution of inputs associated with a given commitment output, but rather the distribution of commitment outputs associated with a given pair of messages.
What you need to show is that for any two fixed messages, the total variation distance between the two distributions of outputs is small. Now, the ...
1
The definition of soundness for an interactive (zero-knowledge) proof says that no prover can convince a verifier of a false statement (i.e., one not in the language in question), except with tiny probability. In your “Bob in the middle” scenario the statement is true—the graph is 3-colorable—so there is no violation of soundness if “Bob” proves it by ...
2
A small comments: the Damgard-Fujisaki commitment scheme, which you are referring to, does not depend on the strong RSA assumption. If you instantiate it (for example) over RSA group, it is perfectly hiding, and binding under the factorization assumption. However, the soundness of the zero-knowledge protocol for proving relations between integers committed ...
Top 50 recent answers are included
