Score:1

How to deal with Pedersen commitment message or randomness overflow?

cn flag

For EC Pedersen commitment: The two generators are G and H. Two messages and randomness are $m_1$, $m_2$, $r_1$, $r_2$, so the two Pedersen commitments are $Gm_1+Hr_1$ and $Gm_2+Hr_2$.

When adding these two, I got a new Pedersen commitment as $G(m_1+m_2)+H(r_1+r_2)$ with message $m_1+m_2$ and randomness $r_1+r_2$. But then what if the message $m_1+m_2$(or randomness $r_1+r_2$) overflows?

For example messages are in field mod 2^64, than if message becomes some 2^64+1, it would become 1. As G*(2^64+1) should not equal to G*1, unless G has the order of 2^64.

Score:2
my flag

But then what if the message $m_1+m_2$(or randomness $r_1+r_2$) overflows
For example messages are in field mod 2^64, than if message becomes some 2^64+1, it would becomes 1

With Pedersen, the points $G, H$ have a prime order (lets call that $q$); when you add the two commitments, you effectively get $G(m_1 + m_2 \bmod q) + H(r_1 + r_2 \bmod q)$. It doesn't matter how you thought about the messages before you generated the commitments. For example, you always picked the $m_1, m_2$ values from 0 to $2^{64}-1$ and think of them as values from $\mathbb{Z}_{2^{64}}$, Pederson will still add them modulo $q$.

BTW: you really do need to pick the $r_1, r_2$ values randomly from 0 to $q-1$ - otherwise, you lose the hiding property. For example, if you did select $r_1 \in [0, 2^{64}-1]$ (and the attacker knew that), then he could test whether a specific $m_1$ value was likely what was committed to with $O(2^{32})$ effort, which is quite practical.

But then what if the message $m_1+m_2$(or randomness $r_1+r_2$) overflows

Nothing special happens; the logical additions happen modulo $q$, no big deal; they'll wrap around. Of course, if you do select $m_1, m_2 \in [0, 2^{64}-1]$ (which is quite safe, unlike the case of $r_1, r_2$), that addition won't wrap (because $q \ggg 2^{64}$, at least, for any curve which is actually secure)

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.