# Prove if it is a CCA secure Commitment

Assume we have a IND-CCA-secure PKC (Public-Key-Cryption) and we construct a commitment-scheme(commit, reveal) with that IND-CCA-secure PKC (so that commitment should be IND-CCA-secure too). But how can I prove that? I am a beginner and have absolute zero idea how such a proof works.
My idea: "the reveal-step" from commitment-scheme is uselss. so we can cut it? I heard something about reduction. But how does it work? Can anyone explain the reduction by using the example above step by step? Thank you!

• As the answer below states IND-CCA does not really make sense for commitment schemes. Additionally, it is not really possible to say anything about the security of this commitment scheme without knowing how it is derived from the IND-CCA public key encryption scheme. Oct 25, 2016 at 11:25
• Thank you firstfore. Is it possible to say that the commit-phase is cca-secure if we choose the cca-secure pkc (something like rsa with one-time-signature) for sending messages? Because both are nearly the same thing. And if yes, the commitment scheme is perfectly hiding, right? Oct 26, 2016 at 8:48

The security property IND-CCA does not fit with commitment schemes. The IND-CCA game is specified in a certain way, and is usually used w.r.t. encryption schemes. However, a commitment scheme can be more general, because you don't need to be able to reverse the process like decryption.

A very simple model for a commitment scheme is that you have a one-way function with two inputs. One of them is the element you are commiting to, and the other is random. In the unveil phase you show them both, and it can be verified by applying the one-way function on those inputs. Those random coins are required for some security properties.

For the security properties of commitment schemes, there are two properties to look at:

• Hiding property: If it is computationally hiding, then it is a difficult problem to find a matching input. If it is unconditionally hiding, then there exists a way to unveil a commitment to every valid input. Basically this is similar to the principle of perfect secrecy.
• Binding property: If it is computationally binding, then it is hard to unveil a commitment to any other element, which was not the original input. If it is perfectly binding, then it is not possible to unveil an element to anything else than the original input.

It is easy to see, that unconditionally hiding and perfectly binding are contradictions to each other, and in fact it is impossible to have them at the same time. But there are commitment schemes which are unconditionally hiding and computationally binding, and there are schemes which are computationally hiding and perfectly binding:

• $G$ is a prime order group where the DLOG problem is hard, with generator $g$. Then commit to an integer $x$ (in matching bounds) as $Com(x) = g^x$. Unveil is just showing $x$. This is computationally hiding and unconditionally binding.
• Pedersen commitment: $G$ again a prime order group where the dlog problem is hard with two generators $g,h$, commit to $x$ as $Com(x,r) = g^xh^r$ with a random integer $r$. In order to unveil, both $x$ and $r$ are shown. This scheme is unconditionally hiding, because if you knew $log_g(h)$, then it would be possible to unveil any value $x$ by calculating the matching value $r$. However, under the assumption that the commiter does not know that discrete logarithm, the scheme is computationally binding.

Besides that, it was one of the first results shown in the UC framework, that it is impossible to realize UC-secure commitments. But it was also shown, that the additional assumption of a common referecne string allows the construction of such a UC-secure commitment scheme.

• Thank you very much for your fast anwser. My question may be missleading. The main focus of my question was about the reduction. A special IND-CCA-secure PKC is given including its proof and a commitment is constructed with this PKE scheme. How does a reduction work, so that we can show the commitment is CCA-secure. too. Oct 25, 2016 at 10:36
• It can be possible to create a commitment scheme from an encryption scheme. The Pedersen commitment and the ElGamal encryption have a lot in common - but they are different things and have different security properties. But I don't think you can generalize this for any IND-CPA or IND-CCA encryption scheme. And a commitment can not be IND-CCA, because that security game is defined for public key encryption. And it does not make any sense to apply this definition to commitment schemes. Finally: If you have a specific encryption scheme in mind, you should put that in the question.
– tylo
Oct 26, 2016 at 11:28
• link But someone defnied here cca security for commitment(look at my link). Or am I wrong? Like on page 4. And how you can construct such one on page 5. Oct 26, 2016 at 12:39
• The problem is, that they re-used the abbreviation "CCA", which in the context of encryption schemes means "chosen ciphertext attack". In that paper, they explicitly defined "CCA" to stand for "chosen commitment attack", with the definition in section 2.8 of that paper. And then they have "CCA secure commitments", not "IND-CCA", which is the term for encryption schemes. I think the main problem here is, that you call yourself a beginner, and the paper you just referenced (which should have been in the question in the first place) is not suitable for that level.
– tylo
Oct 26, 2016 at 13:10
• Thank you again for your fast anwser. Is it possible to say that the commit-phase is chosen-ciphertext-secure if we use the chosen-ciphertexta-secure pkc (something like rsa with one-time-signature) for sending messages? Because both are nearly the same thing. And if yes, the commitment scheme is perfectly hiding, right? And at the end, we can say that commitment-scheme is chosen-commitment-secure? (ps: my tutor just gave me that paper...) Oct 26, 2016 at 13:53