密码算法与协议3_密钥的确认

In the special case that the committed value is a bit, that is, x {0, 1}, one speaks of a bit commitment scheme.
2016/1/8 11
Security Requirements
The security requirements for a bit commitment scheme are the following. The commitment must be binding, i.e.,
proofs and secure multi-party computation.
2016/1/8
4
Commitment Scheme
A commitment scheme consists of two protocols, called

commit and reveal ,
between two parties, usually called the sender and the receiver. In many cases, the protocols commit and reveal can be defined in terms of a single algorithm, requiring no interaction between the sender and receiver at all. Such commitment schemes are non-interactive.

to write the value on a piece of paper, put it in a box, and lock the box with a padlock. The locked box is then given to the other party, but you keep the key. At a later time, you present the key to the other party who may then open the box, and check its contents.

Choose a random x such that
Y=f(b,x)=mbx2 mod n
To open blob(b),

just review b and x, use the encryption to verify: y=f(b,x)=mbx2 mod n Concealing : 如果平方剩余问题不可解，no information on b will be revealed Binding: if not, then exist x1,x2, commit(x1,,1) = commit(x2,,0), mx12=x22 mod n, then m= (x2x1-1)2 (mod n), it is contradiction to the condition.
2016/1/8
3
Application of Commitment
Note that party B sees the commitment of A before choosing its bit bB, so no information on bit bA should leak from the commitment on bA. Similarly, party A could try to influence the value of the resulting bit b (after seeing the bit bB) by opening the commitment on bA as a commitment on 1-bA. Clearly, party A should not be able to “change its mind” in such a way!
2016/1/8
7
Following Commit Phase
Receiver should not have gained any information about X

Information theoretic? Computationally? No two different and valid openings exist It is computationally infeasible to find two different valid openings


2016/1/8
10
Definition
Let commit : {0, 1}k × {0, 1}* {0, 1}* be a deterministic polynomial time algorithm, where k is a security parameter. A (noninteractive) commitment scheme consists of two protocols between a sender and a receiver:
Furthermore, the commitment must be hiding, i.e.,
Party A commits to a random bit value bA R {0, 1} by sending a commitment on bA to party B. Party B then replies by sending a bit value bB R {0, 1} to A. Finally, party A opens the commitment and sends bA to B. Both parties take b = bAbB as the common random bit.
Chapter 3.
Commitment Schemes
2016/1/8
1
Introduction
The functionality of a commitment scheme is commonly introduced by means of the following analogy. Suppose you need to commit to a certain value, but you don’t want to reveal it right away. For example, the committed value is a sealed bid in some auction scheme. One way to do this is
2016/1/8
5
Commitment Protocol
Commit Phase
Sender
X
Receiver
Sender is bound to X Reveal Phase
Sender
X
Receiver
Receiver can verify X was the value in the box


Commit protocol: To commit to a value x {0, 1}*, the sender computes C = commit(r, x), where r R {0, 1}k, and sends C to the receiver. Reveal protocol: To open commitment C = commit(r, x), the sender sends r and x to the receiver. The receiver computes commit(r, x) and verifies that it is equal to the previously received commitment.
Sender should be bound to X

2016/1/8
8
Bit Commitment by Encryption(Example 1)
Let K = (n = pq, e, d) be an RSA key To commit a bit b, we could do the following
Generating mutually random bits is a basic part of many protocols. Commitments are used as an auxiliary tool in many cryptographic applications, such as zero-knowledge

Choose a random x such that x is even if b = 0 x is odd if b = 1 Let blob(b) = xe mod n
To open blob(b),

just review x, use the encryption to check!
Concealing:b不参与其中运算 Binding: 不存在x1(odd),x2(even), x1e = x2emod n
2016/1/8 9
Bit Commitment by Encryption(Example 2)
Let K = (n = pq, p, q primes, m QR(n) ) , (n,m) published To commit a bit b, we could do itment: Locking a Bit in a Secure Box
f: {0,1} X Y is bit commitment scheme if for a randomly chosen x from X