In the slides to my information security class it is stated without explanation that a encryption-based commitment scheme defined as follows is broken:
- Commit: P outputs c = Enck(m)
- Reveal: P sends k to V. V decrypts c and learns m = Deck(c)
Similarly, a hash-based commitment scheme (using cryptographic hash function H) defined as follows is also stated to be broken:
- Commit: P outputs c = H(m)
- Reveal: P sends m to V. V verifies that c = H(m).
Why are these schemes broken with respect to hiding and binding?
The only reasons I can think of that these schemes might be broken are the following:
- In the encryption-based scheme, the encryption might reveal something about the length of the message, breaking the principle of hiding. However, this could be addressed by padding the messages to a fixed length.
- In the hash-based scheme, two hashes might collide, breaking the principle of binding.
Are there any other reasons these schemes are not valid commitment schemes?