Score:0

Making commitment scheme on elliptic curves perfectly binding

cn flag

So, the question is, a commitment scheme on elliptic curve is given.

Initialisation phase:

  1. There is an elliptic curve EC, generator point $G$ over $GF(p)$, which creates a group, and random prime number $e$.
  2. Choose an $x$.
  3. Calculate $M = x \cdot G$.
  4. Calculate $M' = e \cdot M$.
  5. Extract $xM$, where $xM$ is an $x$ coordinate of $M$.
  6. Calculate $H = xM \cdot G$.

EC, $G$, $e$ are public parameters, $x$ is a private parameter.

Commitment is defined as follows: $C = x \cdot G + r \cdot H$.

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

It is possible to calculate $C = x \cdot G + r \cdot H$ and $C = x' \cdot G + r' \cdot H'$. Therefore, it is possible to calculate $r' = (x + r \cdot xM - x') / x'M$.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose $H$ as another generator point.

Are there any other ways to make this commitment perfectly binding?

Score:2
gd flag

If I'm not wrong: first got a Pedersen commitment (computationally binding & theoretically hiding), then "transform" it in an ElGamal commitment (theoretically binding & computationally hiding), nice primer in 1

poncho avatar
my flag
Nice! To summarize what's in the link, you generate the commitment as the two points $mG + rH, rG$ (where $m$ is the value you're committing to). That works...
Score:0
my flag

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

Actually, it's not even computationally binding, as the committer knows the discrete log of $H$ (it's $xM$), and so he can trivially open the commitment any way he wants.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose H as another generator point.

Pedersen commitments cannot be made perfectly binding, because no matter how you choose $H$, it would be possible (although, in practice, computationally infeasible, or so we hope) to compute the discrete log, and so it'd be possible to open the commitment with different values.

For a commitment to be perfectly binding, then what must happen is that, for any possible commitment, there is only one possible secret that it can open to; Pedersen doesn't fulfill that.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.