Select Topic Area

Question

Body

Pedersen Commitment Homomorphic Addition Issue

Hey everyone,

I'm working on implementing Pedersen Commitments using Circom and hit a snag with the homomorphic addition property. I was hoping to get some insights or see if anyone else has faced something similar.

What I Did

Pedersen Commit Template

Here's the Circom code I used for the Pedersen commitment:

pragma circom 2.0.0;

include "pedersen.circom";
include "bitify.circom";
include "babyjub.circom"; // Make sure to include Baby Jubjub

template PedersenCommit() {
    signal input value;  // Value to commit (m)
    signal input random; // Randomness (r)

    signal output C[2];   // Commitment point C = mG + rH

    // Convert value and random to 254 bits
    component value2bits = Num2Bits_strict();
    value2bits.in <== value;

    component random2bits = Num2Bits_strict();
    random2bits.in <== random;

    // Combine m and r into a 508-bit array
    signal combined_bits[508];
    for (var i = 0; i < 254; i++) {
        combined_bits[i] <== value2bits.out[i];
        combined_bits[254 + i] <== random2bits.out[i];
    }

    // Use Pedersen template for commitment
    component pedersen = Pedersen(508);
    for (var i = 0; i < 508; i++) {
        pedersen.in[i] <== combined_bits[i];
    }

    // Output the commitment point
    C[0] <== pedersen.out[0];
    C[1] <== pedersen.out[1];

    // Verify C is on the curve
    component check = BabyCheck();
    check.x <== C[0];
    check.y <== C[1];
}

component main = PedersenCommit();

Aggregating Commitments

To test the homomorphic property, I created an aggregation template to add two commitment points:

pragma circom 2.0.0;

include "pedersen.circom";
include "babyjub.circom";

template AggregateCommitments() {
    signal input C1_x;
    signal input C1_y;
    signal input C2_x;
    signal input C2_y;

    signal output C_out_x;
    signal output C_out_y;

    // Add the two points
    component adder = BabyAdd();
    adder.x1 <== C1_x;
    adder.y1 <== C1_y;
    adder.x2 <== C2_x;
    adder.y2 <== C2_y;

    C_out_x <== adder.xout;
    C_out_y <== adder.yout;

    // Verify all points are on the curve
    component check1 = BabyCheck();
    check1.x <== C1_x;
    check1.y <== C1_y;

    component check2 = BabyCheck();
    check2.x <== C2_x;
    check2.y <== C2_y;

    component check_out = BabyCheck();
    check_out.x <== C_out_x;
    check_out.y <== C_out_y;
}

component main = AggregateCommitments();

Test Cases

I tested with two inputs:

1. Commitment 1:

   {
       "value": "5",
       "random": "5" 
   }
   

   Commitment Output:

   [
       "8632754251503980025279545143365407525014983526794480434837386382778276550213",
       "553923350532259022072280900015500407454577651854808586098015884302916530613"
   ]
   

2. Commitment 2:

   {
       "value": "10",
       "random": "10"
   }
   

   Commitment Output:

   [
       "281065951831955713171118499611882264300592827803016062313304681509713783056",
       "17303890468958011041581384467163521310911831671977627835160788903704069000353"
   ]
   

Aggregation Attempt

I tried adding two commitments of (5, 5):

Input Commitments:

{
    "C1_x": "8632754251503980025279545143365407525014983526794480434837386382778276550213",
    "C1_y": "553923350532259022072280900015500407454577651854808586098015884302916530613",
    "C2_x": "8632754251503980025279545143365407525014983526794480434837386382778276550213",
    "C2_y": "553923350532259022072280900015500407454577651854808586098015884302916530613"
}

Expected Result:

[
    "281065951831955713171118499611882264300592827803016062313304681509713783056",
    "17303890468958011041581384467163521310911831671977627835160788903704069000353"
]

Actual Result:

[
    "3270345565825403619318971239747590566508681416771691638704802377437902788714",
    "11568677323209925060885114239010635606111290221031884651229507908476386407897"
]

The actual result doesn't match the expected C(10,10), which breaks the homomorphic property.

Any Ideas?

Has anyone faced similar issues with Pedersen Commitments in Circom? Any pointers on what I might be missing or debugging steps would be awesome!

Thanks in advance!