zec
/
zips
mirror of https://github.com/zcash/zips.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Rename "raw" to "homomorphic" Pedersen commitments 

Signed-off-by: Daira Hopwood <daira@jacaranda.org>
This commit is contained in:
Daira Hopwood 2018-03-06 22:34:18 +00:00
parent 77ee3b4fc4
commit b198e08388
1 changed files with 21 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
protocol/protocol.tex
View File

@ -567,6 +567,9 @@ electronic commerce and payment, financial privacy, proof of work, zero knowledg
\newcommand{\windowedPedersenCommitment}{\term{windowed Pedersen commitment}} \newcommand{\windowedPedersenCommitment}{\term{windowed Pedersen commitment}}
\newcommand{\windowedPedersenCommitments}{\term{windowed Pedersen commitments}} \newcommand{\windowedPedersenCommitments}{\term{windowed Pedersen commitments}}
\newcommand{\WindowedPedersenCommitment}{\titleterm{Windowed Pedersen Commitment}} \newcommand{\WindowedPedersenCommitment}{\titleterm{Windowed Pedersen Commitment}}
\newcommand{\homomorphicPedersenCommitment}{\term{homomorphic Pedersen commitment}}
\newcommand{\homomorphicPedersenCommitments}{\term{homomorphic Pedersen commitments}}
\newcommand{\HomomorphicPedersenCommitment}{\titleterm{Homomorphic Pedersen Commitment}}
\newcommand{\distinctXCriterion}{\term{distinct-$x$ criterion}} \newcommand{\distinctXCriterion}{\term{distinct-$x$ criterion}}
% Conventions % Conventions
@ -729,8 +732,6 @@ electronic commerce and payment, financial privacy, proof of work, zero knowledg
\newcommand{\AuthProvePrivate}{\mathsf{rsk}} \newcommand{\AuthProvePrivate}{\mathsf{rsk}}
\newcommand{\AuthProveBase}{\mathcal{H}} \newcommand{\AuthProveBase}{\mathcal{H}}
\newcommand{\AuthProvePublic}{\mathsf{rk}} \newcommand{\AuthProvePublic}{\mathsf{rk}}
\newcommand{\ValueCommitBase}{\mathcal{V}}
\newcommand{\TrapdoorBase}{\mathcal{R}}
\newcommand{\NotePosition}{\mathsf{pos}} \newcommand{\NotePosition}{\mathsf{pos}}
\newcommand{\NotePositionBase}{\mathcal{J}} \newcommand{\NotePositionBase}{\mathcal{J}}
\newcommand{\NullifierRand}{\mathsf{nr}} \newcommand{\NullifierRand}{\mathsf{nr}}
@ -1253,8 +1254,8 @@ electronic commerce and payment, financial privacy, proof of work, zero knowledg
\newcommand{\MixingPedersenHash}{\mathsf{MixingPedersenHash}} \newcommand{\MixingPedersenHash}{\mathsf{MixingPedersenHash}}
\newcommand{\WindowedPedersenCommitAlg}{\mathsf{WindowedPedersenCommit}} \newcommand{\WindowedPedersenCommitAlg}{\mathsf{WindowedPedersenCommit}}
\newcommand{\WindowedPedersenCommit}[1]{\WindowedPedersenCommitAlg_{#1}} \newcommand{\WindowedPedersenCommit}[1]{\WindowedPedersenCommitAlg_{#1}}
\newcommand{\RawPedersenCommitAlg}{\mathsf{RawPedersenCommit}} \newcommand{\HomomorphicPedersenCommitAlg}{\mathsf{HomomorphicPedersenCommit}}
\newcommand{\RawPedersenCommit}[1]{\RawPedersenCommitAlg_{#1}} \newcommand{\HomomorphicPedersenCommit}[1]{\HomomorphicPedersenCommitAlg_{#1}}
\newcommand{\Digits}{\mathsf{Digits}} \newcommand{\Digits}{\mathsf{Digits}}
\newcommand{\PedersenRangeOffset}{\Delta} \newcommand{\PedersenRangeOffset}{\Delta}
\newcommand{\Mask}{\mathsf{Mask}} \newcommand{\Mask}{\mathsf{Mask}}
@ -4637,35 +4638,35 @@ instantiated using $\WindowedPedersenCommitAlg$ as follows:
\sapling{ \sapling{
\nsubsubsubsection{Raw Pedersen commitments} \label{concreterawcommit} \nsubsubsubsection{Homomorphic Pedersen commitments} \label{concretehomomorphiccommit}
The windowed Pedersen commitments defined in the preceding section are The windowed Pedersen commitments defined in the preceding section are
highly efficient, but they do not support the homomorphic property we highly efficient, but they do not support the homomorphic property we
need when instantiating $\ValueCommit{}$ (see \crossref{spendsandoutputs} need when instantiating $\ValueCommit{}$ (see \crossref{spendsandoutputs}
and \crossref{saplingbalance}). and \crossref{saplingbalance}).
In order to support this property, we also define \quotedterm{raw} In order to support this property, we also define \quotedterm{homomorphic}
\xPedersenCommitments as follows: \xPedersenCommitments as follows:
\begin{formulae} \begin{formulae}
\item $\RawPedersenCommit{\ValueCommitRand}(D, \Value) := \item $\HomomorphicPedersenCommit{\ValueCommitRand}(D, \Value) :=
\scalarmult{\Value}{\ValueCommitBase} + \scalarmult{\ValueCommitRand}{\FindGroupJHashOf{D, \ascii{}}}$ \scalarmult{\Value}{\FindGroupJHashOf{D}, \ascii{v}} + \scalarmult{\ValueCommitRand}{\FindGroupJHashOf{D, \ascii{}}}$
\end{formulae} \end{formulae}
See \crossref{cctrawcommit} for rationale and efficient circuit implementation See \crossref{ccthomomorphiccommit} for rationale and efficient circuit implementation
of this function. of this function.
The commitment scheme $\ValueCommit{}$ specified in \crossref{abstractcommit} is The commitment scheme $\ValueCommit{}$ specified in \crossref{abstractcommit} is
instantiated using $\RawPedersenCommit{}$ as follows: instantiated using $\HomomorphicPedersenCommit{}$ as follows:
\begin{formulae} \begin{formulae}
\item $\ValueCommit{\ValueCommitRand}(\Value) := \item $\ValueCommit{\ValueCommitRand}(\Value) :=
\RawPedersenCommit{\ValueCommitRand}(\ascii{Zcash\_cv}, \Value)$. \HomomorphicPedersenCommit{\ValueCommitRand}(\ascii{Zcash\_cv}, \Value)$.
\end{formulae} \end{formulae}
\begin{securityrequirements} \begin{securityrequirements}
\item $\RawPedersenCommitAlg$ must be a computationally binding and at least \item $\HomomorphicPedersenCommitAlg$ must be a computationally binding and at least
computationally hiding \commitmentScheme, for a given personalization input $D$. computationally hiding \commitmentScheme, for a given personalization input $D$.
\item $\ValueCommitAlg$ must be a computationally binding and at least \item $\ValueCommitAlg$ must be a computationally binding and at least
computationally hiding \commitmentScheme. computationally hiding \commitmentScheme.
@ -8431,19 +8432,20 @@ This can be implemented in:
for a total of $... \smult \ell + 756$ constraints. for a total of $... \smult \ell + 756$ constraints.
\nsubsubsection{Raw Pedersen commitments} \label{cctrawcommit} \nsubsubsection{\HomomorphicPedersenCommitment} \label{ccthomomorphiccommit}
The \windowedPedersenCommitments defined in the preceding section are The \windowedPedersenCommitments defined in the preceding section are
highly efficient, but they do not support the homomorphic property we highly efficient, but they do not support the homomorphic property we
need when instantiating $\ValueCommit{}$ (see \crossref{spendsandoutputs} need when instantiating $\ValueCommit{}$ (see \crossref{saplingbalance}
and \crossref{saplingbalance}). and \crossref{spendsandoutputs}).
In order to support this property, we also define ``raw'' Pedersen commitments as \introlist
follows: In order to support this property, we also define \homomorphicPedersenCommitments
as follows:
\begin{formulae} \begin{formulae}
\item $\RawPedersenCommit{\ValueCommitRand}(D, \Value) = \item $\HomomorphicPedersenCommit{\ValueCommitRand}(D, \Value) =
\scalarmult{\Value}{\ValueCommitBase} + \scalarmult{\ValueCommitRand}{\FindGroupJHashOf{D, ascii{}}}$ \scalarmult{\Value}{\FindGroupJHashOf{D, \ascii{v}}} + \scalarmult{\ValueCommitRand}{\FindGroupJHashOf{D, \ascii{}}}$
\end{formulae} \end{formulae}
In the case that we need for $\ValueCommit{}$, In the case that we need for $\ValueCommit{}$,