Proof of computationally binding correct?

Question

I have defined the following commitment scheme and would like to prove that it is statistically hiding and computationally binding, but I'm not sure if my proof is accurate:

For $h$, a collision resistant hash function, I defined the following scheme:

$C(b, 1^n)$:

$r \leftarrow U_n$ // random uniform string of length $n$

$s \leftarrow U_n$

Output $(h(s), r, \langle r, s \rangle \oplus b)$

Proofs:

Computationally binding:

Let $A$ be a PPT algorithm. Then:

$$ \Pr_{(s,s')\leftarrow A(1^n)}\big[ \langle r, s \rangle \oplus 0 = \langle r, s \rangle \oplus 1 \text{ }\wedge \text{ } h(s)=h(s')\big] \leq \Pr_{(s,s')\leftarrow A(1^n)}\big[ h(s)=h(s')\big] \leq negl(n)$$

where the last transition is since the $h$ is assumed to be a collision resistant hash function.

Statistically hiding (~ denotes statistically indistinguishable from):

$$ C(0) = (h(s), r, \langle r, s \rangle \oplus 0) = (h(s), r, \langle r, s \rangle) \sim (h(s), r, U) \sim (h(s), r, U\oplus 1) \sim (h(s), r, \langle r, s \rangle \oplus 1)=C(1)$$

I am mainly concerned with the computationally binding part since this is not a family of hash functions, so the last transition doesn't feel right.

Is this right? Any comments would be greatly appreciated.

Answer 1

The binding should be fine. You cannot change $b$ for the same commitment without changing $<r,s>$. Since $r$ is part of commitment, you can only change $s$ which should be infeasible because $h$ is collision resistant. What do you mean by $h$ is not a family of hash functions? Why should it be?

I am less confident about the hiding part. If $h$ does not need to be pre-image resistant, we can just define $h$ as $h(s)=s$ and the commitment is not hiding at all. I therefore assume you really mean a secure hash function. So the question is "Is it possible for $h$ to reveal enough information about $s$ that given a random $r$ and $h(s)$ gives a significant advantage in distinguishing $<r,s> \oplus 1$ from $<r,s> \oplus 0$ and still be a secure hash function?" Because if such a hash function exists the part after your "=" in the first line of your proof does not hold.

EDIT:

$<r,s>$ is a hardcore predicate of $f(s,r)=h(s),r$ so no such $h$ does exist as long as $h$ is secure hash function (both one way and collision resistant). But it only makes it computationally hiding not necessarily statistically hiding.