Pedersen bit is 0 or 1 (Schnorr OR)

Commit C = g^b h^r with b in {0,1}, then prove (without opening the commitment) that b is binary using a disjunctive Schnorr proof + Fiat–Shamir — same primitive as the gap called out in Ex3.

Parameters

Use a prime p and gcd(g,p)=1 (toy: 223, 4, 3 match the Rust tests).

b (0 or 1) r (blinding) g h p

Result

C = g^bh^r—

verify_ok (from prove)—

Re-verify—

Proof JSON

—