Given a secret key x and a commitment to it comm(x) where comm(x) is both binding and hiding (it can be for example $g^x$ or some homomorphic encryption). Given public parameters $P_1,...,P_k$, comm(x), and an index i, is there a scheme, other than fully homomorphic encryption, to to compute $H(P_1,...,P_{i-1},x,P_{i+1},...,P_k)$ (where H is some collision resistant hash function that act as a random oracle both on x and over public parameters $P_i$'s)?
4
-
$\begingroup$ The whole point of using a blinding factor is to ensure that the bytes of 𝑥 for the commitment 𝑐𝑜𝑚𝑚(𝑥) cannot be known by an observer, and therefore cannot be concatenated into the hash input. Perhaps you are referring to a more elaborate scheme that would involve blind interaction with the owner of the secret key $x$? $\endgroup$– knacccJun 30, 2022 at 18:28
-
$\begingroup$ Actually, if you could do that (without interacting with the committer), you could use that to test potential values of $x$, hence showing that your commitment scheme wasn't hiding... $\endgroup$– ponchoJun 30, 2022 at 18:52
-
$\begingroup$ @knaccc You are right. And If there was another way to compute this hash without concatenating x, then this hash would not be collision resistant. Thanks! $\endgroup$– DoronJun 30, 2022 at 20:48
-
$\begingroup$ @poncho perhaps you could argue that this hash is a random oracle and therefore you could not gain any significant information on x. But basically you are right. $\endgroup$– DoronJun 30, 2022 at 20:50
Add a comment
|