0
$\begingroup$

The probability that a probabilistic polynomial adversary corrupting the sender can finds two pairs $(m,r)$ such that the output of the random oracle $c$ is the same (break the binding property) is negligible. At the same time, the probability that a probabilistic polynomial adversary corrupting the sender finds a pair $(m,r)$ starting from the commitment $c$ (break the hiding property) is negligible. Is there any difference between the case in which the adversary is semi-honest or active in this context? The only threat I see is that an active adversary could change the message of the sender, but this is not relevant since the sender could have chosen that message.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
0
$\begingroup$

There is no active attack an adversary could do, so the random oracle commitment is secure in (both the passive and) the active adversary model.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.