Score:0

Different setup for Pedersen Commitment

tv flag

I have read many question on this website and understood the Pedersen commitment until I came across with this page.

This page, it computes $\mathcal h= g^s \bmod p$ where $s$ is secret, instead of using $h$ and $g$ as a generator of a group $G$ like in first page. Is there a specific reason for this?

Score:1
us flag

In a prime order group, every element except for the identity is a generator. As such, $g^s \bmod p$ will be a generator except with probability $1/q$. This is just one way of ensuring that $h$ is a generator (that is true for generic groups). Note that given $s$, it is possible to decommit to any value. As such, $s$ behaves as a type of trapdoor. This means that the receiver (or some external party). has to choose $h$ and not the committer. In some protocols, this is used by having the receiver choose $h$ and prove that it knows the appropriate $s$ with a zero-knowledge proof of knowledge. This enables the simulator to extract $s$ and use it during the simulation. Of course, in a real execution, it remains secret since the proof is zero knowledge.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.