Polynomial Commitments

We introduce and formally define polynomial commitment schemes, and provide two efficientconstructions. A polynomial commitment scheme allows a committer to commit to a polynomialwith a short string that can be used by a verifier to confirm claimed evaluations of the committedpolynomial. Although the homomorphic commitment schemes in the literature can be used toachieve this goal, the sizes of their commitments are linear in the degree of the committedpolynomial. On the other hand, polynomial commitments in our schemes are of constant size(single elements). The overhead of opening a commitment is also constant; even opening multipleevaluations requires only a constant amount of communication overhead. Therefore, our schemesare useful tools to reduce the communication cost in cryptographic protocols. On that front, weapply our polynomial commitment schemes to four problems in cryptography: verifiable secretsharing, zero-knowledge sets, credentials and content extraction signatures.