I think Pedersen commitments are a gentle starting point for teaching cryptography to anyone!
A **commitment** is a sealed envelope with a message m in it such that:
1. no one can tell what m is in it (hiding)
2. no one can open it to a different m (binding)
Pedersen below 👇
Commitments are very useful: e.g., randomness beacons.
- Each player commits to a random message m_i
- All players exchange their commitments C_i
- All players open their commitments or they're penalized
Final random value = sum of all opened m_i's
(Problematic design, I know)
My point? Pedersen commitments have many applications.
They are also v. simple:
You need:
1. a prime-order group (e.g., elliptic curve)
2. two elements G, H in this group s.t. nobody knows the relation between them
i.e., the discrete logarithm \tau of H w.r.t. G 👇
First, it is very easy to explain why the envelope is "binding": i.e., attacker cannot open it in two different ways.
=> it would allow the attacker to compute \tau, which is supposed to be very hard in (say) elliptic curves 👇
Note that binding holds only under a *computational* assumption.
i.e., it is in fact *possible* to open the envelope to two different messages
it's just *hard* to: such an algorithm would immediately give an algorithm that solves discrete logarithms faster than currently known.
Second, it is very easy to explain why the envelope is "hiding": i.e., no one can tell what m is inside.
=> because, really, Pedersen commitments are just polynomial commitments:
committing to m using randomness r <=> committing to f(X) = m + Xr as C = f(tau) G 👇
Crucially, C hides f(X), and therefore hides (m, r), because there are a bazillion other polynomials f'(X) = m' + X r' with m' != m such that f'(tau) = f(tau).
So, it could be that:
- C commits to m as C = f(tau) G
- C commits to m' also as C = f'(tau) G = f(tau) G
Can't tell!
(FYI: "Bazillion" is a technical term for p, where p is the order of the group.)
You can also guess what my next point was going to be...
Pedersen commitments are a gateway drug into KZG commitments! ()
But that's for another time!
7,33 t.
60
Tällä sivulla näytettävä sisältö on kolmansien osapuolten tarjoamaa. Ellei toisin mainita, OKX ei ole lainatun artikkelin / lainattujen artikkelien kirjoittaja, eikä OKX väitä olevansa materiaalin tekijänoikeuksien haltija. Sisältö on tarkoitettu vain tiedoksi, eikä se edusta OKX:n näkemyksiä. Sitä ei ole tarkoitettu minkäänlaiseksi suositukseksi, eikä sitä tule pitää sijoitusneuvontana tai kehotuksena ostaa tai myydä digitaalisia varoja. Siltä osin kuin yhteenvetojen tai muiden tietojen tuottamiseen käytetään generatiivista tekoälyä, tällainen tekoälyn tuottama sisältö voi olla epätarkkaa tai epäjohdonmukaista. Lue aiheesta lisätietoa linkitetystä artikkelista. OKX ei ole vastuussa kolmansien osapuolten sivustojen sisällöstä. Digitaalisten varojen, kuten vakaakolikoiden ja NFT:iden, omistukseen liittyy suuri riski, ja niiden arvo voi vaihdella merkittävästi. Sinun tulee huolellisesti harkita, sopiiko digitaalisten varojen treidaus tai omistus sinulle taloudellisessa tilanteessasi.