All-but-k Mercurial Commitments and their Applications †

We introduce and formally define all-but-k mer- curial commitments, a new kind cryptographic commitment that generalizes standard mercurial and non-mercurial (vec- tor) commitments. We provide two concrete constructions for all-but-k mercurial commitments: the first is for committing to unordered lists (i.e., to multisets) and the second is for committing to ordered lists (i.e., to vectors). Both of our constructions build on Kate et al.'s polynomial commitments, leveraging the algebraic structure of polynomials to fine tune the ordinary binding property of mercurial commitments. To facilitate these constructions, we give novel zero-knowledge protocols for 1) proving knowledge of a point on a committed polynomial, 2) arguing knowledge of the committed polyno- mial itself, and 3) arguing that a committed polynomial has degree at most k.