Tag Info

New answers tagged

2

There is one subtle problem with your proposed protocol: unless $f$ is restricted to commutative functions, the lottery can choose to reveal one of two values. Here's how he does it: the lottery selects $p1$ and $p2$ as per the protocol, and publishes $p1\times p2, f$. However, when it comes time to reveal the committed value, and the lottery sees that the ...


7

You could use HMAC for this. HMAC is available in pretty much every crypto library out there. The process would work like this. Randomly pick A and C. For simplicity, let's assume they are strings (of any length). Compute $B=HMAC(A,C)$. Publish $B$. Once someone guesses $A$, you publish $C$. Anyone can then verify that $B=HMAC(A,C)$. As long as a good hash ...


1

The commitment is the receiver's output from the protocol's initial phase, and the opening value is a witness that the commitment is to whatever it's to. The 'Binding' and 'Hiding' properties are defined w.r.t. the commitment scheme.



Top 50 recent answers are included