This preview shows pages 1–8. Sign up to view the full content.
This preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full DocumentThis preview has intentionally blurred sections. Sign up to view the full version.
View Full Document
Unformatted text preview: Mutual Commitments c circlecopyrt Eli Biham  August 18, 2010 440 Mutual Commitments (16) Example  Coin Toss Coin Toss : Alice and Bob want to toss a coin. Easy to do when they are in the same room. How can they toss a coin over the phone? Solution : Alice tosses a coin and conveys the result to Bob. Problem : Alice can choose any result. Solution : Alice and Bob each tosses a coin and then they send the results to each other. The coin toss result is the XOR of both tosses. Problem : The one who sends the result first has no influence on the result, while the second can choose any result. Note : There is a strong dependency on the simultaneous publication of the result. c circlecopyrt Eli Biham  August 18, 2010 441 Mutual Commitments (16) † Coin Toss Alice and Bob want to toss a coin over the phone. If Alice commits to a bit, and promises not to change her choice after Bob tells her about his coin toss, we get that the protocol: Alice: Chooses a bit b A . Bob: Chooses a bit b B . Bob → Alice: b B . Alice → Bob: b A . Both: b = b A ⊕ b B . is secure. c circlecopyrt Eli Biham  August 18, 2010 442 Mutual Commitments (16) Coin Toss (cont.) It is clear that Bob cannot choose the result of the coin toss. On the other hand, Alice was committed to b A before knowing b B and therefore she cannot choose the result of the coin toss, as well. Thus, we want to ensure that Alice does not change her choice after hearing b B . c circlecopyrt Eli Biham  August 18, 2010 443 Mutual Commitments (16) Bit Commitment This protocol is a building block for the construction of other protocols, and we will use it later. Objective : Alice chooses a bit b and uses it in some protocol, with Bob. Bob needs to make sure that Alice uses b and not b , but Alice prefers not to reveal b . The Model : • Alice sends a commitment C on b to Bob, from which b cannot be reconstructed. • Revealment phase: later Alice reveals b to Bob, and Bob checks the commitment. c circlecopyrt Eli Biham  August 18, 2010 444 Mutual Commitments (16) Bit Commitment (cont.) Example : Let f be a oneway permutation and let B be a hardcore predicate of f . Then Alice and Bob can perform the following BC protocol: • Alice chooses b , and a random number r (100bit number) such that B ( r ) = b . • Alice sends the commitment C = f ( r ) to Bob. Later for the revealment phase: • Alice sends b and r to Bob. • Bob checks whether C = f ( r ) and b = B ( r ). If not then Alice cheated, Otherwise Bob concludes that Alice indeed committed to b . What goes wrong when B is not a hardcore predicate? What goes wrong when f is not a permutation? c circlecopyrt Eli Biham  August 18, 2010 445 Mutual Commitments (16) † Bit Commitment (cont.) RSA based example : Alice chooses n = p · q,e, d as in RSA, and a random number 0 ≤ r < n with parity b (or another hardcore predicate B ( r ) = b ), and sends n,e and r e (mod n ) to Bob....
View Full
Document
 Spring '11
 YanivCarmeli

Click to edit the document details