crypto-slides-16-mcommit.1x1

crypto-slides-16-mcommit.1x1 - Mutual Commitments c...

Info iconThis preview shows pages 1–8. Sign up to view the full content.

View Full Document Right Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: Mutual Commitments c circlecopyrt Eli Biham - August 18, 2010 440 Mutual Commitments (16) Example - Coin Toss Coin Toss : Alice and Bob want to toss a coin. Easy to do when they are in the same room. How can they toss a coin over the phone? Solution : Alice tosses a coin and conveys the result to Bob. Problem : Alice can choose any result. Solution : Alice and Bob each tosses a coin and then they send the results to each other. The coin toss result is the XOR of both tosses. Problem : The one who sends the result first has no influence on the result, while the second can choose any result. Note : There is a strong dependency on the simultaneous publication of the result. c circlecopyrt Eli Biham - August 18, 2010 441 Mutual Commitments (16) † Coin Toss Alice and Bob want to toss a coin over the phone. If Alice commits to a bit, and promises not to change her choice after Bob tells her about his coin toss, we get that the protocol: Alice: Chooses a bit b A . Bob: Chooses a bit b B . Bob → Alice: b B . Alice → Bob: b A . Both: b = b A ⊕ b B . is secure. c circlecopyrt Eli Biham - August 18, 2010 442 Mutual Commitments (16) Coin Toss (cont.) It is clear that Bob cannot choose the result of the coin toss. On the other hand, Alice was committed to b A before knowing b B and therefore she cannot choose the result of the coin toss, as well. Thus, we want to ensure that Alice does not change her choice after hearing b B . c circlecopyrt Eli Biham - August 18, 2010 443 Mutual Commitments (16) Bit Commitment This protocol is a building block for the construction of other protocols, and we will use it later. Objective : Alice chooses a bit b and uses it in some protocol, with Bob. Bob needs to make sure that Alice uses b and not b , but Alice prefers not to reveal b . The Model : • Alice sends a commitment C on b to Bob, from which b cannot be reconstructed. • Revealment phase: later Alice reveals b to Bob, and Bob checks the commitment. c circlecopyrt Eli Biham - August 18, 2010 444 Mutual Commitments (16) Bit Commitment (cont.) Example : Let f be a one-way permutation and let B be a hardcore predicate of f . Then Alice and Bob can perform the following BC protocol: • Alice chooses b , and a random number r (100-bit number) such that B ( r ) = b . • Alice sends the commitment C = f ( r ) to Bob. Later for the revealment phase: • Alice sends b and r to Bob. • Bob checks whether C = f ( r ) and b = B ( r ). If not then Alice cheated, Otherwise Bob concludes that Alice indeed committed to b . What goes wrong when B is not a hardcore predicate? What goes wrong when f is not a permutation? c circlecopyrt Eli Biham - August 18, 2010 445 Mutual Commitments (16) † Bit Commitment (cont.) RSA based example : Alice chooses n = p · q,e, d as in RSA, and a random number 0 ≤ r < n with parity b (or another hardcore predicate B ( r ) = b ), and sends n,e and r e (mod n ) to Bob....
View Full Document

Page1 / 31

crypto-slides-16-mcommit.1x1 - Mutual Commitments c...

This preview shows document pages 1 - 8. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online