$n_c = 0$ is documented to reduce to BPs, yet there's also a $m \ge 1$ bound

[kayabaNerve]

Is the bound $m \ge 1$ also unnecessary?

If one shims a Pedersen Commitment of the identity, all relevant terms disappear, implying there isn't a distinction between the cases $m = 0$ and $m = 1$. If there is a required term which is so dropped, then it'd appear one would also need the bound the commitment is non-trivial, but what that definition would be is unclear.

[b-g-goodell]

As long as m and n_c are not both zero, the proof still goes through. A previous version had the following LaTeX snippet, which was unintentionally removed.

We extend our definition to the case that $m = 0$ similarly by dropping all terms related to $m$, obtaining statements
\[\texttt{s} = \left(\underline{C}, \underline{c}, \underline{W}_L, \underline{W}_R, \underline{W}_O, \left\{\underline{W}_{k,L}\right\}_{k=1}^{n_c}\right)\] and witnesses 
\[\texttt{w} = \left(\underline{a}_L, \underline{a}_R, \underline{a}_O, \left\{ (\underline{c}_{k,L}, \underline{c}_{k,R}) \right\}_{k=1}^{n_c}, \underline{c}^\prime\right)\]
satisfying the following predicate.
\begin{align*}
\forall k \in [n_c]: C_k =& \underline{c}_{k,L}^\top \underline{G} + \underline{c}_{k,R}^\top \underline{H} + c'_k H\text{, and }\\
\underline{a}_L \circ \underline{a}_R =& \underline{a}_O\text{, and }\\
\underline{c} =& \mat{W}_L \underline{a}_L + \mat{W}_R \underline{a}_R + \mat{W}_O \underline{a}_O + \smash{\sum_{k=1}^{n_c} \mat{W}_{k,L} \underline{c}_{k,L}}
\end{align*}
The case $m=0$ is proposed for use in full-chain membership proofs for Monero \cite{fcmp}. This modifies the relation over which the proving system works, but not the correctness, soundness, etc.

[kayabaNerve]

If m + n_c > 0 is a bound, I again have to ask what the definition of a non-trivial commitment is. As I said, if m is 0, the terms disappear, and if one shims a Pedersen Commitment of the identity, all of the formulae are the exact same except for the fact some coefficients equal to zero (which immediately vanish) are technically present. This means if n_c is 0 and m is 1 but an identity commitment, the proof practically may as well have n_c = m = 0. Since that meets your statement for the proof to still work, either n_c + m = 0 is valid OR there's apparently some class of trivial commitments which need to be stated as insufficient so I may know what that class is.

Additionally, for the following claim in the paper, which is taken as a gesture and not literal nor proven,

We assume n_c ≥ 1, but our discussion extends to the case n_c = 0 by reducing to Bulletproofs arithmetic circuit satisfiability.

This would be an incorrect description of the $n_c = 0$ case, as Bulletproofs itself does not bound $m \ne 0$, to my understanding.

[b-g-goodell]

Is the bound m >= 1 strictly necessary?

It is necessary that (n_c, m) \neq (0,0) or, as you noted, n_c + m >= 1.

If one shims a Pedersen Commitment of the identity, all relevant terms disappear, implying there isn't a distinction between the cases m = 0 and m = 1.

I do not know what it means to shim a Pedersen commitment. If you include any commitments at all, then m is the number of included commitments. Do you mean "if I run the protocol with n_c=0 vectors and m=1 plain Pedersen commitment C and I use a zero value and zero blinder, then all the terms vanish and it seems to collide with the case m=0?"

This case is somewhat vacuous, because anyone can notice the identity and open the commitment; this breaks SHVZK but not correctness or completeness. Verifiers should reject a proof with n_c=0, m=1, and with commitment C=identity in the statement. I'll add a note.

If there is a required term which is so dropped, then it'd appear one would also need the bound the commitment is non-trivial, but what that definition would be is unclear.

I'm not sure what the most general statement would be, but simply rejecting commitments in the V vector or C vector (in the paper notation) which are group identities is sufficient. This introduces a negligible completeness gap, as only one honestly computed commitment is ever the identity except with negligible probability: namely, the commitment with value 0 and blinder 0 leads to an identity commitment, otherwise the committer learns valuePoint + blinderOtherPoint = Identity, breaking the DLP. Like I said, I'll add a note about this.

This would be an incorrect description of the n c = 0 case, as Bulletproofs itself does not bound m ≠ 0 , to my understanding.

If m = 0, then what Pedersen commitment(s) are you opening with your Bulletproofs Arithmetic Circuit Satisfiability argument? The bound m>=1 is implicit in all "commit-then-prove" schemes because you need at least one commitment.

[kayabaNerve]

I mean, the whole idea to have such a commitment would be to satisfy this seemingly arbitrary requirement without caring about how it's satisfied nor any commitments. I don't want to say it is actually arbitrary, I'm just still unclear why this bound exists.

Identity commitments aren't so trivial to reject as the value, blinding factor are part of the witness, not part of the proof. For example, in Monero for output commitments, the mask for a commitment is derived from a shared secret. While that is a cryptographic process, it shows the person opening the commitment does not always sample it from random. Other protocols have more exotic uses of the mask. While they can still be declined, with a completeness gap, and it may be practically fine, it isn't of negligible probability because the choice of mask is undefined.

It also means if you actually need one Pedersen Commitment for which the opening is unknown to others, Monero wouldn't work in this model, as another party knows the same openings.

Note this isn't immediately applicable due to how Monero rerandomizes the commitments, but I'm trying to show why ambiguous requirements on commitments for ambiguous reasons are problematic and ideally wouldn't exist.

If m = 0, then what Pedersen commitment(s) are you opening with your Bulletproofs Arithmetic Circuit Satisfiability argument? The bound m>=1 is implicit in all "commit-then-prove" schemes because you need at least one commitment.

None. You'd be proving that for an arithmetic circuit, you know a witness that satisfies it.

---

I'm still unclear if a commitment, potentially with uniform mask unknown to anyone else, is actually needed for such a proof to be ZK. At this point, I see the solution as always randomly sampling a Pedersen Commitment, such that it's uniform, it's non-identity except with negligible probability, and no other party knows the opening. This would allow proving for the m=0, or m != 0 yet the commitment doesn't meet further additional requirements, cases while still satisfying the bound continuously preserved here. It grows every proof by an element, but I really don't know how else to implement this and be sure in it due to the fact this bound still exists and I still haven't been able to understand it in the slightest. If the bounds can't be clearly formalized, or if it would non-trivially change the statements for which the prover is complete for (such as by requiring all commitment masks be sampled in-proof to ensure they're uniform), I'd recommend such a change be adopted within the document itself.

In general, I'd say it's best if this proof works to all standard expectations, even with no commitments or when the commitments have arbitrary openings though.

[kayabaNerve]

I do acknowledge the latest version contains the text:

Lastly, the edge case (nc, m) = (0, 0) is degenerate, and implies no commitments
are used at all; this case ought to be rejected, as no commit-then-prove scheme
can save a protocol without commitments.

I have no idea what a 'commit-then-prove' scheme is intended to specifically refer to, and I'll note there is the commitments $A_I, A_O$ internal to the proof for the witness even when there's no $\gamma, v, c_k$, but I do know it doesn't seem we are going to understand each other here.

Unfortunately, the conclusion is the paper (as written) cannot be implemented and no library premised on this paper can be argued as safe to use. Because this remains open, we will need someone else to relax the bound or at least establish the definition of non-degenerate cases. That's as the only defined degenerate case is (0, 0), but when I proposed shimming every proof to always have V_0 = identity, that was also rejected as degenerate (proving that the definition of degenerate as the (0, 0) case alone is insufficient).

Thank you for identifying the issues with the protocol prior, working on this documented, and updating the typos. While there's still a pair of outstanding correctness issues AFAICT ( #4 , #6 ), I don't wish to demand/presume your work on them and will again reiterate my thanks for the work prior. Obviously, this would've blown up but didn't, thanks to you, so I do have to truly convey my acknowledgement and gratitude there.