Consider the following commitment scheme, where $x$ belongs to $\langle g\rangle$ and $u$ is uniformly chosen from $\mathbb{Z}_n$:

$$\mathsf{commit}(u,x) = g^u\cdot x$$

Is it binding and hiding?


The scheme is clearly hiding: the value $g^u\cdot x$ distributes uniformly at random when $u$ is.

However, it is not at all binding: for a given commitment $c$, the sender, assuming he can compute inverse of an element in the group, can find many pairs, more accurately, as many as the size of the group, $u,x$ for which $c=g^u\cdot x$.

  • $\begingroup$ It is trivial to find another pair u',x' matching the commitment. It is however difficult to do this with meaningfull x' assuming most x' aren't meaningful. $\endgroup$ – Meir Maor Feb 3 '18 at 6:11
  • 1
    $\begingroup$ @MeirMaor In my opinion this is still a security issue, in the same way as when collisions of a hash function are meaningful. $\endgroup$ – Daniel Feb 3 '18 at 9:31
  • $\begingroup$ I'm not saying I recommend using such a scheme. Just trying to provide a more complete answer. $\endgroup$ – Meir Maor Feb 3 '18 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.