2
$\begingroup$

Can I create a simple commitment scheme using a secure hash function?

If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random\_string || message)$)

Thank you

$\endgroup$
3
$\begingroup$

Yes. If you publish such a commitment. And you model the hash as a random function it willl not only be preimage resistant but there will be many possible pairs of random string and message which will match the commitment. If the random string is as big as the hash output most possible message values can produce the commitment for some random string. So even an attacker with infinite compute power will not be able to consistently discover the message, while an attacker with bounded computing power won't be able to learn anything about the message.

When the commitment is revealed, we know the attacker didn't cheat because collision resistance means the committer (With bounded conputing resources) won't be able to produce a commitment which matches two distinct known messages.

$\endgroup$
  • $\begingroup$ Thanks for your response. Since there will be many possible pairs of $random\_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both? $\endgroup$ – jimouris Aug 4 at 7:39
  • 1
    $\begingroup$ No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort. $\endgroup$ – Meir Maor Aug 4 at 8:08
  • $\begingroup$ Okay, got it. Thank you for your help! $\endgroup$ – jimouris Aug 4 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.