I think Pedersen commitments are a gentle starting point for teaching cryptography to anyone!
A **commitment** is a sealed envelope with a message m in it such that:
1. no one can tell what m is in it (hiding)
2. no one can open it to a different m (binding)
Pedersen below 👇
Commitments are very useful: e.g., randomness beacons.
- Each player commits to a random message m_i
- All players exchange their commitments C_i
- All players open their commitments or they're penalized
Final random value = sum of all opened m_i's
(Problematic design, I know)
My point? Pedersen commitments have many applications.
They are also v. simple:
You need:
1. a prime-order group (e.g., elliptic curve)
2. two elements G, H in this group s.t. nobody knows the relation between them
i.e., the discrete logarithm \tau of H w.r.t. G 👇
First, it is very easy to explain why the envelope is "binding": i.e., attacker cannot open it in two different ways.
=> it would allow the attacker to compute \tau, which is supposed to be very hard in (say) elliptic curves 👇
Note that binding holds only under a *computational* assumption.
i.e., it is in fact *possible* to open the envelope to two different messages
it's just *hard* to: such an algorithm would immediately give an algorithm that solves discrete logarithms faster than currently known.
Second, it is very easy to explain why the envelope is "hiding": i.e., no one can tell what m is inside.
=> because, really, Pedersen commitments are just polynomial commitments:
committing to m using randomness r <=> committing to f(X) = m + Xr as C = f(tau) G 👇
Crucially, C hides f(X), and therefore hides (m, r), because there are a bazillion other polynomials f'(X) = m' + X r' with m' != m such that f'(tau) = f(tau).
So, it could be that:
- C commits to m as C = f(tau) G
- C commits to m' also as C = f'(tau) G = f(tau) G
Can't tell!
(FYI: "Bazillion" is a technical term for p, where p is the order of the group.)
You can also guess what my next point was going to be...
Pedersen commitments are a gateway drug into KZG commitments! ()
But that's for another time!
6,77 тис.
60
Вміст на цій сторінці надається третіми сторонами. Якщо не вказано інше, OKX не є автором цитованих статей і не претендує на авторські права на матеріали. Вміст надається виключно з інформаційною метою і не відображає поглядів OKX. Він не є схваленням жодних дій і не має розглядатися як інвестиційна порада або заохочення купувати чи продавати цифрові активи. Короткий виклад вмісту чи інша інформація, створена генеративним ШІ, можуть бути неточними або суперечливими. Прочитайте статтю за посиланням, щоб дізнатися більше. OKX не несе відповідальності за вміст, розміщений на сторонніх сайтах. Утримування цифрових активів, зокрема стейблкоїнів і NFT, пов’язане з високим ризиком, а вартість таких активів може сильно коливатися. Перш ніж торгувати цифровими активами або утримувати їх, ретельно оцініть свій фінансовий стан.