Is there any cryptographic obfuscation scheme that will let me obfuscate a program that reveals my secret, if you reveal yours?
Formalization. Let $C(\cdot),V(\cdot)$ be a secure commitment scheme. In other words, $C(x,r)$ is a commitment to $x$ under randomness $r$, and $V(\cdot)$ is the corresponding verification function, so that $V(C(x,r),x,r)=1$ and $V(C(x,r),x',r')=0$ if $x\ne x'$.
For instance, one example commitment scheme is $C(x,r) = H(x \;||\; r)$ and $V(c,x,r)=1$ if $H(x \;||\; r)=c$, $0$ otherwise; where $H$ is a cryptographic hash function.
Suppose Alice has a secret $x$, and she publishes a commitment $c=C(x,r)$ to her secret. Suppose Bob has a secret $y$ of his own. Can Bob build a obfuscated program $P$ so that, when you run $P$ on input $x,r$, it outputs Bob's secret $y$, but the source code of $P$ doesn't reveal anything about Bob's secret to someone who doesn't know Alice's secret?
To make this precise, we can define the function $f$ by $f(w,q) = y$ if $V(c,w,q)=1$ and $f(w,q)=0$ otherwise (in fact I don't really care what the output is, in the latter case, as long as it doesn't reveal anything about $y$).
My question. Can Bob obfuscate $f$ to get a program $P$ that computes the same functionality as $f$ (so $P(w,q)=f(w,q)$ for all $w,q$), but where the source code of $P$ reveals nothing about $y$?
Can this be done in a way that is efficient enough to be practical? I am fine with a solution for any commitment scheme of your choice: you can co-design the commitment scheme and the obfuscation method. I am fine with the random oracle model and any plausible cryptographic hardness assumptions you might want to make.
Motivation. This would help with the construction of cryptographic fair exchange protocols, where intuitively we want Bob's secret to be revealed if Alice's is (except there are many more details I'm omitting that are out of scope for purposes of this question).
One thing that makes me think it might be doable is that this is a lot like a point function, which we do know how to obfuscate. The difference here is that the obfuscator (Bob) does not know Alice's secret $x$ -- he only knows the commitment $c$ -- whereas the standard methods for obfuscating a point function would require Bob to know the secret value $x$. So, the standard methods for obfuscating point functions do not immediately solve this problem... but can they be adjusted or extended somehow? Alternatively, I know there have been recent breakthroughts in indistinguishability obfuscation; might those help with this obfuscation task?