# Mercurial Commitments with Applications to Zero-Knowledge Sets

- First Online:

- Received:

DOI: 10.1007/s00145-012-9122-9

- Cite this article as:
- Chase, M., Healy, A., Lysyanskaya, A. et al. J Cryptol (2013) 26: 251. doi:10.1007/s00145-012-9122-9

## Abstract

We introduce a new flavor of commitment schemes, which we call *mercurial commitments*. Informally, mercurial commitments are standard commitments that have been extended to allow for *soft* decommitment. Soft decommitments, on the one hand, are not binding but, on the other hand, cannot be in conflict with true decommitments.

We then demonstrate that a particular instantiation of mercurial commitments has been implicitly used by Micali, Rabin and Kilian to construct *zero-knowledge sets*. (A *zero-knowledge set* scheme allows a Prover to (1) commit to a set *S* in a way that reveals nothing about *S* and (2) prove to a Verifier, in zero-knowledge, statements of the form *x*∈*S* and *x*∉*S*.) The rather complicated construction of Micali et al. becomes easy to understand when viewed as a more general construction with mercurial commitments as an underlying building block.

By providing mercurial commitments based on various assumptions, we obtain several different new zero-knowledge set constructions.