As we know the well-known hash-based commitment is as follows:

  • Prover: given a message $m$, it:

    (1) picks a fresh random value $r$

    (2) computes $H(r||m)=c$.

  • Verifier: given $c$ and the commitment opening: $(r,m)$, checks $H(r||m)=c$

Question: Am I right that in the random oracle model, the above scheme is IND-CPA?


Indistinguishability under chosen message attacks (IND-CPA) is a security definition for encryption schemes and not for commitments. So we cannot claim that a commitment scheme is IND-CPA.

Notice that the above scheme cannot be an encryption since there is no encryption/decryption key. In fact, if the hash function has a larger domain than range, there may be multiple pairs $(m,r)$ that map to the same $c$ and one cannot know which one is the correct (even if they were all powerful).

It is true, however, that the scheme you propose is hiding: for any two messages $m_0,m_1$ it holds that $H(r,m_0)$ and $H(r,m_1)$ are indistinguishable in the random oracle model.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.