There’s a nice writeup on group hashes here: https://cronokirby.com/posts/2021/07/on_multi_set_hashing/ https://cronokirby.com/posts/2021/07/on_multi_set_hashin

There’s a nice writeup on group hashes here: https://cronokirby.com/posts/2021/07/on_multi_set_hashing/ https://cronokirby.com/posts/2021/07/on_multi_set_hashing/ In particular, if you choose a group where discrete log is hard (such as prime order elliptic curves), multiset hashing falls out for free