Reducing Complexity Assumptions
for
Statistically-Hiding Commitment
Iftach Haitner Omer Horviz
Jonathan Katz Chiu-Yuen Koo
Ruggero Morselli Ronen Shaltiel
1
Bit-Commitment (BC)
A two-phase protocol between the sender,
S, and the receiver, R.
Commit-phase – S commits to a bit
value, b, without revealing its value to
R.
Reveal-phase – S reveals b to R and
proves that this is the value he had
committed to (in the commit-phase).
2
Bit-Commitment cont.
Commit-phase
S
b
R
3
Bit-Commitment cont.
Reveal-phase
R
S
b
4
Bit-Commitment cont.
Hiding – R does not learn the value of b
during the commit-phase.
Binding – S cannot prove (in the revealphase) that he had committed to a
different value than the one he had
really committed to.
5
Different Types Of BitCommitment.
Computationally-hiding perfectly-binding BC:
R does not get (through the commit-phase) any
computational-knowledge about b. S cannot
(whatsoever) “cheat” in the reveal-phase.
Statistically-hiding computationally-binding
BC: R does not get any noticeable information
about b. A computationally-bounded S cannot
“cheat” in the reveal-phase.
Perfectly-hiding computationally-binding BC:
R does not get any information about b. …
6
Different Types Of BitCommitment (comparison).
In order to break the Computationallyhiding perfectly-binding protocol, R
needs to get super-polynomial powers
anytime after the commit-phase.
In order to break the Statistically-hiding
computationally-binding protocol, S
needs to get super-polynomial powers
before the end of the reveal-phase.
7
The importance of stat. –
hiding comp. binding BC
Building block in constructions of
Statistically Zero-Knowledge
arguments.
 Other cryptographic applications
(e.g., Coin-flipping protocols).

8
Previous Implementations




Number
theoretic
assumptions*
(BKK,
What are
the minimal
general
BCC).
hardness assumptions that
yield Statistically-hiding
Claw-free
permutations* (GK).
computationally-binding
BC? (DPP,
Collision
resistance hash functions
HM).
Do one-way functions suffice?
One-way permutations* (NOVY).
* : Perfectly-hiding.
9
Our Result
Statistically-hiding computationallybinding BC using approximable-size
one-way functions.
Approx.-size OWF – a OWF f is an approx.size if we can efficiently approximate the
number of pre-images of any y2 Im(f).
Any regular OWF is an approx.- size one.
Regular OWF - a OWF f is regular if there
exists a constant r s.t. the number of preimages of any y2 Im(f) is r.
10
The NOVY protocol
A
BC
protocol
based
on
an
underlying
Perfectly-hiding computationally-binding
function f:{0,1}n ! {0,1}n
BC based on one-way permutations.
I.
If f is a permutation then the
protocol is perfectly-hiding.
II. If f is a permutation and one-way
then the protocol is computationallybinding.
11
One–Way Functions


One–way function (OWF):
f:{0,1}n!{0,1}m is a OWF if
for any ppt A,
PrxÃ{0,1}n[A(f(x)) 2 f-1(f(x))] = neg(n)
One–way function on range:
for any ppt A,
PryÃImage(f) [A(y)2 f-1(y)] = neg(n)
 Any regular-OWF is also one-way on range.
12
(,)-balanced Distribution.
D is (,)-balanced
{0,1}n
Bad
For all zBad :
|PryÃD[y = z ] - 1/2n|
· /2n.
•|Bad| · 2n.
• PryÃD[y2 Bad] ·.
f:{0,1}n !{0,1}m is (,)-balanced if
f(Un) is (,)-balanced.
13
Example…
{0,1}n
Bad
 D is (1/4, 1/3)-
balanced
D
14
-hiding Bit-Commitment
-hiding BC: A BC is -hiding if from
R’s point of view, after the commitphase, the statistical-difference between
the cases when b=0 and b=1 is at most
.
A statistically-hiding BC is a neg-hiding
BC (neg is a negligible function of n).
15
The NOVY protocol (restated)
A generic scheme of BC protocol based
an underlying
function a
Theontask:
Implementing
f:{0,1}n ! {0,1}m
balanced one-way function
I.on range
If f is a using
one-way function on range
then
the
protocol
is
computationallyapproximable-size OWF.
binding.
II. If f is (,)-balanced then the
protocol is (+)-hiding.
16
Universal-Hashing
Let H be a family of functions from
{0,1}n!{0,1}m.
H is a k-universal hash family, if the
output of a uniformly chosen h2H over k
distinct elements in {0,1}n, are k
independent random variables in {0,1}m.
17
Hashing Lemma
{0,1}n
S-1(z)
h
h
{0,1}m
z
Each element in {0,1}mhÃH,
has about
theH is kwhere
expected number of pre-images w.r.t. h
(i.e., |S|¢2-m) in S. universal
Where the estimation gets better as k and
|S| get bigger and m gets smaller.
18
Balanced One-Way Function
On Range From Regular OWF
{0,1}n
g-1(z)
f
{0,1}l(n)
g(h,x) ≡ h(f(x)),h
Im(f)
h
(z)
hh-1-1(z)
{0,1}m
zz
m=?
m=n-log(r)–log(cn)
m has about the
 3n-universality of H - each z2{0,1}
hÃH
where
Hsmall
r-regular
OWF
If
m
is
too
g(U
g ish, in Im(f).
samen)number of pre-images, w.r.t.
3n-universal
m
m
=
n-log(r)
m
g
is
not
-n
universal
,1/2)-balanced
m has
 r-regularity of f - each z2{0,1}(2
about the same
guaranteed
to
constant
m
one-way
on
range
n
number of pre-images, w.r.t. g, in(|{0,1}
{0,1} .| = |Im(f)|)
be one-way.
function.
19
{0,1}mbalanced..
 g is “rather”
Danger!
m
-n
(2 ,1/2)-balanced
Claim: g is
one-way on range function.



g is (2-n,1/2)-balanced.
g is one-way – (by our choice of m) a given output
element in {0,1}m does not have “too-many” (up to
polynomially many) pre-images, w.r.t. h2H, in
Im(f). We can reduce the hardness of g to the
hardness of f.
g is one-way on range- there are about the same
number of pre-images per output element. Similar
to the regular OWF case.
20
Getting Statiscally–Hiding
Computationally-Binding BC
When using g with the NOVY protocol we
achieve
1/2-hiding computationally-binding BC.
The amplification into statistically-hiding
computationally-binding BC is done
through a standard secret-sharing
technique.
21
Balanced One-Way Function On
Range From Approx.-Size OWF
The following construction was given by
[Häastad, Impagliazzo, Levin & Luby].
Let f:{0,1}n!{0,1}m be an approx.-size OWF
and let for y2{0,1}m, D(y) ≡ log(|f-1(y)|).
g(h,x) ≡ f(x),h(x)1...D(f(x)),h,0(n-D(f(x)))
x
f
f(x)
h(x)1…D(f(x))+2
h
0(n-D(f(x)-2)
h
22
From Approx.-Size OWF cont.
Thm [HILL]: g is “almost” 1-1 one-way
function.
Hence by plugging g in the construction for
regular OWF we get
(2-n,1/2)-balanced one-way function on range.
Using secret-sharing we get statiscally–hiding
computationally-binding BC.
23
Open Problems

Stat-hiding comp.-binding BC from any
OWF?
It suffices to give a construction for semihonest R.


Black-Box separation between Stathiding comp.-binding BC and OWF?
Efficient round complexity?
24