Skip to main content
expanded on part about second option
Source Link
user991
user991

Yes. $\:$ If one uses a secure symmetric cipher properly, then the commitment scheme will be unconditionally binding, length-revealing, otherwise computationally hiding, and produce commitments whose length is grows linearly with the length of the message. $\:$ If one uses a collision-resistant
hash properly, then the commitment scheme will be unconditionally hiding, computationally binding,
and produce commitments whose length is independent of the message's length.


"If at the 'opening', I have to reveal $r$ (a random number concatenated with the
messaged at the time of hashing) and $m$ (the message), why not reveal the key
used for encryption for everybody to decipher the message and so confirm it?"

As elaborated on in poncho's answer, the second option would not be binding.
In order to use the symmetric cipher properly for commitment,
one would also need to commit to the key $\:$ Additionallyin a way that is actually binding.
Additionally, the first option would not be using the hash properly, and if there
there is any collision-resistant hash then there is a collision-resistant hash such
such that the first option would not even computationally hide all-but-length.

Yes. $\:$ If one uses a secure symmetric cipher properly, then the commitment scheme will be unconditionally binding, length-revealing, otherwise computationally hiding, and produce commitments whose length is grows linearly with the length of the message. $\:$ If one uses a collision-resistant
hash properly, then the commitment scheme will be unconditionally hiding, computationally binding,
and produce commitments whose length is independent of the message's length.


"If at the 'opening', I have to reveal $r$ (a random number concatenated with the
messaged at the time of hashing) and $m$ (the message), why not reveal the key
used for encryption for everybody to decipher the message and so confirm it?"

As elaborated on in poncho's answer, the second option would not be binding. $\:$ Additionally, the first option would not be using the hash properly, and if there is any collision-resistant hash then there is a collision-resistant hash such that the first option would not even computationally hide all-but-length.

Yes. $\:$ If one uses a secure symmetric cipher properly, then the commitment scheme will be unconditionally binding, length-revealing, otherwise computationally hiding, and produce commitments whose length is grows linearly with the length of the message. $\:$ If one uses a collision-resistant
hash properly, then the commitment scheme will be unconditionally hiding, computationally binding,
and produce commitments whose length is independent of the message's length.


"If at the 'opening', I have to reveal $r$ (a random number concatenated with the
messaged at the time of hashing) and $m$ (the message), why not reveal the key
used for encryption for everybody to decipher the message and so confirm it?"

As elaborated on in poncho's answer, the second option would not be binding.
In order to use the symmetric cipher properly for commitment,
one would also need to commit to the key in a way that is actually binding.
Additionally, the first option would not be using the hash properly, and if
there is any collision-resistant hash then there is a collision-resistant hash
such that the first option would not even computationally hide all-but-length.

Source Link
user991
user991

Yes. $\:$ If one uses a secure symmetric cipher properly, then the commitment scheme will be unconditionally binding, length-revealing, otherwise computationally hiding, and produce commitments whose length is grows linearly with the length of the message. $\:$ If one uses a collision-resistant
hash properly, then the commitment scheme will be unconditionally hiding, computationally binding,
and produce commitments whose length is independent of the message's length.


"If at the 'opening', I have to reveal $r$ (a random number concatenated with the
messaged at the time of hashing) and $m$ (the message), why not reveal the key
used for encryption for everybody to decipher the message and so confirm it?"

As elaborated on in poncho's answer, the second option would not be binding. $\:$ Additionally, the first option would not be using the hash properly, and if there is any collision-resistant hash then there is a collision-resistant hash such that the first option would not even computationally hide all-but-length.