Given a secret key x and a commitment to it comm(x) where comm(x) is both binding and hiding (it can be for example $g^x$ or some homomorphic encryption). Given public parameters $P_1,...,P_k$, comm(x), and an index i, is there a scheme, other than fully homomorphic encryption, to to compute $H(P_1,...,P_{i-1},x,P_{i+1},...,P_k)$ (where H is some collision resistant hash function that act as a random oracle both on x and over public parameters $P_i$'s)?

  • $\begingroup$ The whole point of using a blinding factor is to ensure that the bytes of 𝑥 for the commitment 𝑐𝑜𝑚𝑚(𝑥) cannot be known by an observer, and therefore cannot be concatenated into the hash input. Perhaps you are referring to a more elaborate scheme that would involve blind interaction with the owner of the secret key $x$? $\endgroup$
    – knaccc
    Jun 30, 2022 at 18:28
  • $\begingroup$ Actually, if you could do that (without interacting with the committer), you could use that to test potential values of $x$, hence showing that your commitment scheme wasn't hiding... $\endgroup$
    – poncho
    Jun 30, 2022 at 18:52
  • $\begingroup$ @knaccc You are right. And If there was another way to compute this hash without concatenating x, then this hash would not be collision resistant. Thanks! $\endgroup$
    – Doron
    Jun 30, 2022 at 20:48
  • $\begingroup$ @poncho perhaps you could argue that this hash is a random oracle and therefore you could not gain any significant information on x. But basically you are right. $\endgroup$
    – Doron
    Jun 30, 2022 at 20:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy