# Vector set commitments generalize Schnorr and utxo proof of ownership

**URL:** <https://forum.grin.mw/t/vector-set-commitments-generalize-schnorr-and-utxo-proof-of-ownership/10075>\
**Category:** Research\
**Created:** [October 10, 2022, 11:09am UTC](https://forum.grin.mw/t/vector-set-commitments-generalize-schnorr-and-utxo-proof-of-ownership/10075 "2022-10-10T11:09:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tromp](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.grin.mw/tromp/32/22_2.png) [@tromp](https://forum.grin.mw/u/tromp)\
**Post date:** [October 10, 2022, 11:09am UTC](https://forum.grin.mw/t/vector-set-commitments-generalize-schnorr-and-utxo-proof-of-ownership/10075/1 "2022-10-10T11:09:04Z")

</div>

Reading Adam Gibson’s “From Zero (Knowledge) to Bulletproofs” [1], I noticed how the zero knowledge argument of knowledge of a set of vectors generalizes both Schnorr signatures (as a proof of knowledge of discrete log), and MW utxo ownership proofs (as a proof of knowledge of both blinding factor and value in a Pedersen commitment).

Suppose a prover knows a set of m vectors **x** 1 … **x** m each of length N, and forms vector commitments

- C1 = r1 \* G + **x** 1 \* **H**
- C2 = r2 \* G + **x** 2 \* **H**  
…
- Cm = rm \* G + **x** m \* **H**

where **H** denotes a vector of Nothing-Up-My-Sleeve points H1 … HN and **x** \* **H** denotes the linear combination x1 \* H1 + x2 \* H2 + … + xN \* HN.

To prove knowledge of the vectors to a verifier, the prover picks a random new vector commitment

- C0 = r0 \* G + **x** 0 \* **H**

and receives a challenge from the verifier in the form of a single scalar e.  
They then show the scalar s = Σmi=0 ei \* ri and the vector **z** = Σmi=0 ei \* **x** i

and the verifier may check that

Σmi=0 ei \* Ci = s \* G + **z** \* **H**

For a single vector (m=1) which is empty (N=0) this can be seen to reduce to a regular Schnorr signature on a public key C1 = r1 \* G.

For a single vector (m=1) of length N=1 this reduces to a proof of ownership/knowledge of a Pedersen Commitment C1 = r1 \* G + x1 \* H.

[1] [from0k2bp/from0k2bp.pdf at master · AdamISZ/from0k2bp · GitHub](https://github.com/AdamISZ/from0k2bp/blob/master/from0k2bp.pdf)

---

<div class="post-metadata">

**Author:** ![oryhp](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.grin.mw/oryhp/32/2923_2.png) [@oryhp](https://forum.grin.mw/u/oryhp)\
**Post date:** [October 10, 2022, 12:04pm UTC](https://forum.grin.mw/t/vector-set-commitments-generalize-schnorr-and-utxo-proof-of-ownership/10075/2 "2022-10-10T12:04:19Z")

</div>

That’s a very cool abstraction. Not sure how this would be abstracted further, but it makes me wonder what else can be done with this.