This preview shows page 1. Sign up to view the full content.
Unformatted text preview: If the message did not contain Bob’s random string, Alice could secretly decrypt the message she handed Bob with a variety of keys until she found one that gave her a bit other than the one she committed to. Since the bit has only two possible values, she is certain to find one after only a few tries. Bob’s random string prevents her from using this attack; she has to find a new message that not only has her bit inverted, but also has Bob’s random string exactly reproduced. If the encryption algorithm is good, the chance of her finding this is minuscule. Alice cannot change her bit after she commits to it. Bit Commitment Using One-Way Functions
This protocol uses one-way functions: (1) Alice generates two random-bit strings, R1 and R2. R1,R2 (2) Alice creates a message consisting of her random strings and the bit she wishes to commit to (it can actually be several bits). (R1,R2,b) (3) Alice computes the one-way function on the message and sends the result, as well as one of the random strings, to Bob. H(R1,R2,b),R1 This transmission from Alice is evidence of commitment. Alice’s one-way function in step (3) prevents Bob from inverting the function and determining the bit. When it comes time for Alice to reveal her bit, the protocol continues: (4) Alice sends Bob the original message. (R1,R2,b) (5) Bob computes the one-way function on the message and compares it and R1, with the value and random string he received in step (3). If they match, the bit is valid. The benefit of this protocol over the previous one is that Bob does not have to send any messages. Alice sends Bob one message to commit to a bit and another message to reveal the bit. Bob’s random string isn’t required because the result of Alice’s commitment is a message operated on by a one-way function. Alice cannot cheat and find another message (R1,R2´,b´), such that H(R1,R2´,b´) = H(R1,R2,b). By sending Bob R1 she is committing to the value of b. If Alice didn’t keep R2 secret, then Bob could compute both H(R1,R2,b) a...
View Full Document
- Fall '10