I think Pedersen commitments are a gentle starting point for teaching cryptography to anyone!
A **commitment** is a sealed envelope with a message m in it such that:
1. no one can tell what m is in it (hiding)
2. no one can open it to a different m (binding)
Pedersen below 👇
Commitments are very useful: e.g., randomness beacons.
- Each player commits to a random message m_i
- All players exchange their commitments C_i
- All players open their commitments or they're penalized
Final random value = sum of all opened m_i's
(Problematic design, I know)
My point? Pedersen commitments have many applications.
They are also v. simple:
You need:
1. a prime-order group (e.g., elliptic curve)
2. two elements G, H in this group s.t. nobody knows the relation between them
i.e., the discrete logarithm \tau of H w.r.t. G 👇
First, it is very easy to explain why the envelope is "binding": i.e., attacker cannot open it in two different ways.
=> it would allow the attacker to compute \tau, which is supposed to be very hard in (say) elliptic curves 👇
Note that binding holds only under a *computational* assumption.
i.e., it is in fact *possible* to open the envelope to two different messages
it's just *hard* to: such an algorithm would immediately give an algorithm that solves discrete logarithms faster than currently known.
Second, it is very easy to explain why the envelope is "hiding": i.e., no one can tell what m is inside.
=> because, really, Pedersen commitments are just polynomial commitments:
committing to m using randomness r <=> committing to f(X) = m + Xr as C = f(tau) G 👇
Crucially, C hides f(X), and therefore hides (m, r), because there are a bazillion other polynomials f'(X) = m' + X r' with m' != m such that f'(tau) = f(tau).
So, it could be that:
- C commits to m as C = f(tau) G
- C commits to m' also as C = f'(tau) G = f(tau) G
Can't tell!
(FYI: "Bazillion" is a technical term for p, where p is the order of the group.)
You can also guess what my next point was going to be...
Pedersen commitments are a gateway drug into KZG commitments! ()
But that's for another time!
6,05 mil
60
El contenido de esta página lo proporcionan terceros. A menos que se indique lo contrario, OKX no es el autor de los artículos citados y no reclama ningún derecho de autor sobre los materiales. El contenido se proporciona únicamente con fines informativos y no representa las opiniones de OKX. No pretende ser un respaldo de ningún tipo y no debe ser considerado como un consejo de inversión o una solicitud para comprar o vender activos digitales. En la medida en que la IA generativa se utiliza para proporcionar resúmenes u otra información, dicho contenido generado por IA puede ser inexacto o incoherente. Lee el artículo vinculado para obtener más detalles e información. OKX no es responsable del contenido alojado en sitios de terceros. El holding de activos digitales, incluyendo stablecoins y NFT, implican un alto grado de riesgo y pueden fluctuar en gran medida. Debes considerar cuidadosamente si el trading o holding de activos digitales es adecuado para ti a la luz de tu situación financiera.