New answers tagged commitments
1
No, the proposed commitment scheme is not perfectly hiding. Depending on what you require from the hash function, it may not be hiding at all.
If you only require collision resistance (which would be the standard security property of a hash function) you cannot prove the construction even computationally hiding. This is because a collision resistant hash ...
1
Given that $H$ is collision-resistant, does the security properties of the Pedersen commitment still hold? (i.e. is it still hiding and binding?)
Hiding. No, the resulting commitment scheme cannot possibly be hiding anymore, because the commitment function $m \rightarrow g^mh^{H(m)}$ is a deterministic function. Recall that by definition, a commitment ...
2
This is no longer a secure commitment. Note that there should not be any way to efficiently verify if a given commitment value $c$ is to a message $m$. However, once you derive the randomness in this way, an attacker could try to guess $m$ and verify if this guess is correct by checking if $g^m\cdot h^{H(m)} = c$. Thus, this is not a secure commitment scheme....
Top 50 recent answers are included
