Simple commitment scheme using secure hash functionTransfer and hide ciphertext with hash functions?Commitment scheme using hash functionsWhat are the pros/cons of using symmetric crypto vs. hash in a commitment scheme?PRG variant as a commitment schemeCalculate number of chips to solve bit commitment using hash functionProve if it is a CCA secure CommitmentWhat type of commitment scheme is it?Are all commitment schemes pseudo-random functions?Is this a UC-secure commitment scheme in the ROM?What is the reason of using Pedersen Commitment scheme over HMAC?What is wrong with encryption-based / hash-based commitment schemes?
What's a good pattern to calculate a variable only when it is used the first time?
Output the list of musical notes
How to prevent criminal gangs from making/buying guns?
How can I find files in directories listed in a file?
What modifiers are added to the attack and damage rolls of this unique longbow from Waterdeep: Dragon Heist?
Number in overlapping range
Bringing Power Supplies on Plane?
Do I need to start off my book by describing the character's "normal world"?
Setting up a Mathematical Institute of Refereeing?
What can I do to increase the amount of LEDs I can power with a pro micro?
Does an Irish VISA WARNING count as "refused entry at the border of any country other than the UK?"
How to gracefully leave a company you helped start?
Good textbook for queueing theory and performance modeling
What would cause a nuclear power plant to break down after 2000 years, but not sooner?
Solving a maximum minimum problem
Why do my bicycle brakes get worse and feel more 'squishy" over time?
What is the hottest thing in the universe?
What exactly happened to the 18 crew members who were reported as "missing" in "Q Who"?
Why does this Jet Provost strikemaster have a textured leading edge?
Scam? Phone call from "Department of Social Security" asking me to call back
If a person claims to know anything could it be disproven by saying 'prove that we are not in a simulation'?
How much can I judge a company based on a phone screening?
Sums of binomial coefficients weighted by incomplete gamma
When did Bilbo and Frodo learn that Gandalf was a Maia?
Simple commitment scheme using secure hash function
Transfer and hide ciphertext with hash functions?Commitment scheme using hash functionsWhat are the pros/cons of using symmetric crypto vs. hash in a commitment scheme?PRG variant as a commitment schemeCalculate number of chips to solve bit commitment using hash functionProve if it is a CCA secure CommitmentWhat type of commitment scheme is it?Are all commitment schemes pseudo-random functions?Is this a UC-secure commitment scheme in the ROM?What is the reason of using Pedersen Commitment scheme over HMAC?What is wrong with encryption-based / hash-based commitment schemes?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
$begingroup$
Can I create a simple commitment scheme using a secure hash function?
If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random_string || message)$)
Thank you
hash collision-resistance commitments
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
$endgroup$
add a comment |
$begingroup$
Can I create a simple commitment scheme using a secure hash function?
If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random_string || message)$)
Thank you
hash collision-resistance commitments
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
$endgroup$
$begingroup$
a possible duplicate of Transfer and hide ciphertext with hash functions?
$endgroup$
– kelalaka
Aug 3 at 23:20
add a comment |
$begingroup$
Can I create a simple commitment scheme using a secure hash function?
If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random_string || message)$)
Thank you
hash collision-resistance commitments
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
$endgroup$
Can I create a simple commitment scheme using a secure hash function?
If so, is concatenation with a random secret enough to preserve hiding? (i.e. $C = H( random_string || message)$)
Thank you
hash collision-resistance commitments
hash collision-resistance commitments
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
asked Aug 3 at 22:23
jimourisjimouris
942 silver badges10 bronze badges
942 silver badges10 bronze badges
$begingroup$
a possible duplicate of Transfer and hide ciphertext with hash functions?
$endgroup$
– kelalaka
Aug 3 at 23:20
add a comment |
$begingroup$
a possible duplicate of Transfer and hide ciphertext with hash functions?
$endgroup$
– kelalaka
Aug 3 at 23:20
$begingroup$
a possible duplicate of Transfer and hide ciphertext with hash functions?
$endgroup$
– kelalaka
Aug 3 at 23:20
$begingroup$
a possible duplicate of Transfer and hide ciphertext with hash functions?
$endgroup$
– kelalaka
Aug 3 at 23:20
add a comment |
1 Answer
1
active
oldest
votes
$begingroup$
Yes.
If you publish such a commitment. And you model the hash as a random function it willl not only be preimage resistant but there will be many possible pairs of random string and message which will match the commitment.
If the random string is as big as the hash output most possible message values can produce the commitment for some random string. So even an attacker with infinite compute power will not be able to consistently discover the message, while an attacker with bounded computing power won't be able to learn anything about the message.
When the commitment is revealed, we know the attacker didn't cheat because collision resistance means the committer (With bounded conputing resources) won't be able to produce a commitment which matches two distinct known messages.
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
$endgroup$
$begingroup$
Thanks for your response. Since there will be many possible pairs of $random_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both?
$endgroup$
– jimouris
Aug 4 at 7:39
1
$begingroup$
No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort.
$endgroup$
– Meir Maor
Aug 4 at 8:08
$begingroup$
Okay, got it. Thank you for your help!
$endgroup$
– jimouris
Aug 4 at 8:34
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "281"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f72357%2fsimple-commitment-scheme-using-secure-hash-function%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
Yes.
If you publish such a commitment. And you model the hash as a random function it willl not only be preimage resistant but there will be many possible pairs of random string and message which will match the commitment.
If the random string is as big as the hash output most possible message values can produce the commitment for some random string. So even an attacker with infinite compute power will not be able to consistently discover the message, while an attacker with bounded computing power won't be able to learn anything about the message.
When the commitment is revealed, we know the attacker didn't cheat because collision resistance means the committer (With bounded conputing resources) won't be able to produce a commitment which matches two distinct known messages.
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
$endgroup$
$begingroup$
Thanks for your response. Since there will be many possible pairs of $random_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both?
$endgroup$
– jimouris
Aug 4 at 7:39
1
$begingroup$
No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort.
$endgroup$
– Meir Maor
Aug 4 at 8:08
$begingroup$
Okay, got it. Thank you for your help!
$endgroup$
– jimouris
Aug 4 at 8:34
add a comment |
$begingroup$
Yes.
If you publish such a commitment. And you model the hash as a random function it willl not only be preimage resistant but there will be many possible pairs of random string and message which will match the commitment.
If the random string is as big as the hash output most possible message values can produce the commitment for some random string. So even an attacker with infinite compute power will not be able to consistently discover the message, while an attacker with bounded computing power won't be able to learn anything about the message.
When the commitment is revealed, we know the attacker didn't cheat because collision resistance means the committer (With bounded conputing resources) won't be able to produce a commitment which matches two distinct known messages.
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
$endgroup$
$begingroup$
Thanks for your response. Since there will be many possible pairs of $random_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both?
$endgroup$
– jimouris
Aug 4 at 7:39
1
$begingroup$
No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort.
$endgroup$
– Meir Maor
Aug 4 at 8:08
$begingroup$
Okay, got it. Thank you for your help!
$endgroup$
– jimouris
Aug 4 at 8:34
add a comment |
$begingroup$
Yes.
If you publish such a commitment. And you model the hash as a random function it willl not only be preimage resistant but there will be many possible pairs of random string and message which will match the commitment.
If the random string is as big as the hash output most possible message values can produce the commitment for some random string. So even an attacker with infinite compute power will not be able to consistently discover the message, while an attacker with bounded computing power won't be able to learn anything about the message.
When the commitment is revealed, we know the attacker didn't cheat because collision resistance means the committer (With bounded conputing resources) won't be able to produce a commitment which matches two distinct known messages.
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
$endgroup$
Yes.
If you publish such a commitment. And you model the hash as a random function it willl not only be preimage resistant but there will be many possible pairs of random string and message which will match the commitment.
If the random string is as big as the hash output most possible message values can produce the commitment for some random string. So even an attacker with infinite compute power will not be able to consistently discover the message, while an attacker with bounded computing power won't be able to learn anything about the message.
When the commitment is revealed, we know the attacker didn't cheat because collision resistance means the committer (With bounded conputing resources) won't be able to produce a commitment which matches two distinct known messages.
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
answered Aug 4 at 3:49
Meir MaorMeir Maor
5,9461 gold badge10 silver badges30 bronze badges
5,9461 gold badge10 silver badges30 bronze badges
$begingroup$
Thanks for your response. Since there will be many possible pairs of $random_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both?
$endgroup$
– jimouris
Aug 4 at 7:39
1
$begingroup$
No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort.
$endgroup$
– Meir Maor
Aug 4 at 8:08
$begingroup$
Okay, got it. Thank you for your help!
$endgroup$
– jimouris
Aug 4 at 8:34
add a comment |
$begingroup$
Thanks for your response. Since there will be many possible pairs of $random_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both?
$endgroup$
– jimouris
Aug 4 at 7:39
1
$begingroup$
No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort.
$endgroup$
– Meir Maor
Aug 4 at 8:08
$begingroup$
Okay, got it. Thank you for your help!
$endgroup$
– jimouris
Aug 4 at 8:34
$begingroup$
Thanks for your response. Since there will be many possible pairs of $random_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both?
$endgroup$
– jimouris
Aug 4 at 7:39
$begingroup$
Thanks for your response. Since there will be many possible pairs of $random_string$ and $message$ that generate $C$, does this mean that the binding requirement is not satisfied since I can claim that I committed to either one of the messages? If so, how can I alter my scheme to satisfy both?
$endgroup$
– jimouris
Aug 4 at 7:39
1
1
$begingroup$
No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort.
$endgroup$
– Meir Maor
Aug 4 at 8:08
$begingroup$
No, because finding an alternate pair matching the commitment would mean breaking collision resistance. Note I separated between what is impossible with any computational resources and what is simply unfeasible with any sane amount of computational effort.
$endgroup$
– Meir Maor
Aug 4 at 8:08
$begingroup$
Okay, got it. Thank you for your help!
$endgroup$
– jimouris
Aug 4 at 8:34
$begingroup$
Okay, got it. Thank you for your help!
$endgroup$
– jimouris
Aug 4 at 8:34
add a comment |
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f72357%2fsimple-commitment-scheme-using-secure-hash-function%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
$begingroup$
a possible duplicate of Transfer and hide ciphertext with hash functions?
$endgroup$
– kelalaka
Aug 3 at 23:20