7
$\begingroup$

Obviously, it's possible to create a commitment scheme comm(r, S) by using a hash function H and computing H(S||r). This scheme is secure under the assumption that H is collision and preimage resistant, which (IMO) is a lighter cryptographic assumption than the discrete log assumption.

So I guess my question is, why are commitment schemes like Pedersen commitments used which do require the latter assumption? What efficiency or security benefits they bring? And are there still any benefits to using hash commitments?

$\endgroup$
5
$\begingroup$

The hash-based commitment scheme you are sketching is in fact not secure under collision resistance and preimage resistance of the hash function. For hiding, you need to assume that the hash function you are using behaves like a random oracle (i.e., whenever queried on a new value it returns a uniformly random value from the output domain of the hash function, and for every repeated query it answers consistently).

The random oracle assumption is an idealizing assumption which is considered to be a rather strong assumption compared to the discrete log assumption.

$\endgroup$
  • $\begingroup$ Interesting. Out of curiosity, is there a way to massage the hash-based scheme so that it doesn't depend on the RO assumption? And is there a good resource on commitment schemes in general? (I never learned about commitment schemes properly, so...) $\endgroup$ – Ian MathWiz Jan 15 '18 at 20:06
  • 1
    $\begingroup$ For example, you could have a look at these lecture notes by Yevgeniy Dodis. $\endgroup$ – dade Jan 15 '18 at 20:40
  • $\begingroup$ "you need to assume that the hash function you are using behaves like a random oracle" that's what hash functions assume though $\endgroup$ – David 天宇 Wong May 15 '18 at 7:41
  • $\begingroup$ @IanMathWiz, c.f. also this, this, this and this. First link also notes that a Pedersen commitment value is structured not randomized, thus not suitable where structure could be exploited or random model is otherwise required. $\endgroup$ – Shelby Moore III Jan 28 at 5:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.