Q:

Public-key generation - primes reuse

Given the following Trap-door Commitment scheme 

Secret key receiver: $x_B \in_u Z_q$
Public key receiver: $y_B = g^{x_B} \mod p$

Here, $p=q*k+1$ for two primes $p,q$ and $k \in Z$. And $g$ is the generator of subgrup $G_q$ of $Z_p^{*}$, of order $q$.
To the sender commit $w \in Z_q$, he selects $r \in_u Z_q$, the commitment is $c=g^wy_B^r \mod p$. To open a commitment, he sends $(w,r)$. 
My question is: if I want create milions of theses public-secret keys for milions of different senders, could I reuse $p,q$?

A:

Fix a group $G$ of large prime order $q$.  Fix a generator $g \in G$.  For a public key $h \in G$ other than the identity, a message $m \in \mathbb Z/q\mathbb Z$, and randomization $r \in \mathbb Z/q\mathbb Z$, define the commitment $c = g^m h^r$.
Fix $h$.  Suppose $r$ is uniformly distributed in $\mathbb Z/q\mathbb Z$.  Then $h^r$ is uniformly distributed in $G$, since $G$ has prime order so $h$ is a generator, and so as long as $x$ is independent of $r$, $c = g^m h^r$ is also uniformly distributed.  Hence an adversary given the commitment $c$ learns nothing about the message $m$, no matter what the distribution on $m$ is—the commitment is information-theoretically hiding.
Suppose you have a random algorithm $A\colon G \to (\mathbb Z/q\mathbb Z)^4$ that, given $h$, computes $(m, r, m', r') = A(h)$ with $m \ne m'$ such that $g^m h^r = g^{m'} h^{r'}$ with high probability.  Then necessarily $r \ne r'$, and $g^{(m - m')(r' - r)^{-1}} = h$, i.e. $(m - m')(r' - r)^{-1}$ is the discrete log of $h$ in base $g$, so that we can solve the discrete log problem in $G$ with high probability and negligible additional cost by the random algorithm $A'(h) = (m - m')(r' - r)^{-1} \bmod q$ where $(m, r, m', r') = A(h)$.  Thus, an algorithm that can break the commitment can be used as a subroutine in an algorithm to compute discrete logs with high probability at negligible additional cost—the commitment is computationally binding.
Of course, whoever knows $x$ such that $h = g^x$ can break commitments by computing $r' = (m - m') x^{-1} + r$ for any messages $m$ and $m'$ of their choice.  So the group should be chosen to make it nigh impossible for anyone to compute $x = \log_g h$, but just like in finite-field Diffie–Hellman or Schnorr signatures or DSA, the same group can be used by many key pairs $(x, g^x)$.
What group should we use as $G$?  To thwart generic discrete log algorithms like Pollard's $\rho$, $q$ must be at least $2^{256}$ or so.  The two obvious choices are a Schnorr group, i.e. an order-$q$ subgroup of $(\mathbb Z/p\mathbb Z)^\times$ where $p$ must be at least $2^{2048}$ or so to thwart index calculus, or a group on some elliptic curve $E/k$ over some field $k$ of at least $2^{256}$ elements or so.  Although the adversary's powers are somewhat more limited than in the Diffie–Hellman setting where they learn $\gamma^x$ for any $\gamma$ of their choice, there are many more criteria than these: for a finite field, $p$ must be chosen to resist the SNFS; for an elliptic curve, there is a host of things to worry about.

