String Commitment Research Articles

Information-Theoretically Secure String Commitments Based on Packet Reordering Channels

Realizing fundamental cryptographic primitives with unconditional security is a central topic in information-theoretic cryptography. These primitives can be realized based on physical assumptions, such as the existence of noisy channels, an upper bound on the storage capacity, or the laws of quantum mechanics. Palmieri and Pereira [1] demonstrated that delays in communication channels can be used as a reasonable and effective assumption to obtain an unconditionally secure oblivious transfer protocol against honest-but-curious adversaries. While any oblivious transfer protocol secure against malicious adversaries can be used to implement commitment, the reduction does not work if the oblivious transfer protocol is only secure against honest-but-curious adversaries. Thus, the question of obtaining a secure commitment protocol based on channel delays is still open. In this paper, we provide a concrete protocol for implementing string commitments based on packet reordering – a consequence of channel delays in packet networks.

A Private Quantum Bit String Commitment.

We propose an entanglement-based quantum bit string commitment protocol whose composability is proven in the random oracle model. This protocol has the additional property of preserving the privacy of the committed message. Even though this property is not resilient against man-in-the-middle attacks, this threat can be circumvented by considering that the parties communicate through an authenticated channel. The protocol remains secure and private (but not composable) if we realize the random oracles as physical unclonable functions (PUFs) in the so-called bad PUF model.

On the Efficiency of Classical and Quantum Secure Function Evaluation

We provide bounds on the efficiency of secure one-sided output two-party computation of arbitrary finite functions from trusted distributed randomness in the statistical case. From these results we derive bounds on the efficiency of protocols that use different variants of OT as a black-box. When applied to implementations of OT, these bounds generalize most known results to the statistical case. Our results hold in particular for transformations between a finite number of primitives and for any error. In the second part we study the efficiency of quantum protocols implementing OT. While most classical lower bounds for perfectly secure reductions of OT to distributed randomness still hold in the quantum setting, we present a statistically secure protocol that violates these bounds by an arbitrarily large factor. We then prove a weaker lower bound that does hold in the statistical quantum setting and implies that even quantum protocols cannot extend OT. Finally, we present two lower bounds for reductions of OT to commitments and a protocol based on string commitments that is optimal with respect to both of these bounds.

Quantum key distribution based on orthogonal states allows secure quantum bit commitment

For more than a decade, it was believed that unconditionally secure quantum bit commitment (QBC) is impossible. But based on a previously proposed quantum key distribution scheme using orthogonal states, here we build a QBC protocol in which the density matrices of the quantum states encoding the commitment do not satisfy a crucial condition on which the no-go proofs of QBC are based. Thus, the no-go proofs could be evaded. Our protocol is fault-tolerant and very feasible with currently available technology. It reopens the venue for other ‘post-cold-war’ multi-party cryptographic protocols, e.g. quantum bit string commitment and quantum strong coin tossing with an arbitrarily small bias. This result also has a strong influence on the Clifton–Bub–Halvorson theorem which suggests that quantum theory could be characterized in terms of information-theoretic constraints.

TWO-WAY QUANTUM-BIT-STRING COMMITMENT

Due to the high cost of the qubit generating device (QGD) (the single photon source), QGD may not be available at the same time in both communicating parties (Alice and Bob) who have to execute the quantum bit string commitment (QBSC) protocol for some application environments. All the existing QBSC protocols allow one-way commitment i.e., only the party (Bob) who possesses the QGD is allowed to commit a bit string to Alice who does not have the QGD, but not the other way around. However, what happens if Alice, who does not have the QGD, is required to commit a bit string to Bob? The current QBSC protocols fail to provide a solution in this case. Therefore, the purpose of this paper is to allow Alice, who is not equipped with the QGD, to commit a bit string to Bob who has the QGD. With our proposed protocol, together with previously proposed QBSC protocols, Alice and Bob can perform two-way commitment, even though Bob is the only party who is equipped with the QGD.

Possibility, impossibility, and cheat sensitivity of quantum-bit string commitment

Unconditionally secure nonrelativistic bit commitment is known to be impossible in both the classical and the quantum worlds. But when committing to a string of n bits at once, how far can we stretch the quantum limits? In this paper, we introduce a framework for quantum schemes where Alice commits a string of n bits to Bob in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are twofold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the security criteria, no good schemes can exist: a+b is at least n. If, however, we use a more liberal criterion of security, the accessible information, we construct schemes where a=4 log2 n+O(1) and b=4, which is impossible classically. We furthermore present a cheat-sensitive quantum bit string commitment protocol for which we give an explicit tradeoff between Bob's ability to gain information about the committed string, and the probability of him being detected cheating.

New Binding-Concealing Trade-Offs for Quantum String Commitment

String commitment schemes are similar to the well-studied bit commitment schemes in cryptography with the difference that the committing party, say $\mathsf {Alice}$, is supposed to commit a long string instead of a single bit to another party, say $\mathsf {Bob}$. Similar to bit commitment schemes, such schemes are supposed to be binding, i.e., $\mathsf {Alice}$cannot change her choice after committing, and concealing, i.e., $\mathsf {Bob}$cannot find $\mathsf {Alice}$’s committed string before $\mathsf {Alice}$reveals it. Ideal commitment schemes are known to be impossible. Even if some degree of cheating is allowed, Buhrman et al. (quant-ph/0504078, Nov. 2007) have recently shown that there are some binding-concealing trade-offs that any quantum string commitment scheme ( $\mathsf {QSC}$) must follow. They showed trade-offs both in the scenario of single execution of the protocol and in the asymptotic regime of sufficiently large number of parallel executions of the protocol. We present here new trade-offs in the scenario of single execution of a $\mathsf {QSC}$protocol. Our trade-offs also immediately imply the trade-off shown by Buhrman et al. in the asymptotic regime. We show our results by making a central use of an important information theoretic tool called the substate theorem due to Jain et al. (Proceedings of the 43rd Annual IEEE Symposium on Foundations of Computer Science, pp. 429–438, 2002). Our techniques are quite different from that of Buhrman et al. (quant-ph/0504078, Nov. 2007) and may be of independent interest.

Quantum bit string commitment protocol using polarization of mesoscopic coherent states

In this work, we propose a quantum bit string commitment protocol using polarization of mesoscopic coherent states. The protocol is described and its security against brute force and quantum cloning machine attack is analyzed.

Security of Quantum Bit String Commitment Depends on the Information Measure

Unconditionally secure nonrelativistic bit commitment is known to be impossible in both the classical and the quantum world. However, when committing to a string of n bits at once, how far can we stretch the quantum limits? In this Letter, we introduce a framework of quantum schemes where Alice commits a string of n bits to Bob, in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are twofold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the security criteria, no good schemes can exist: a + b is at least n. If, however, we use a more liberal criterion of security, the accessible information, we construct schemes where a = 4log2(n) + O(1) and b = 4, which is impossible classically. Our findings significantly extend known no-go results for quantum bit commitment.

Group covariant protocols for quantum string commitment

We study the security of quantum string commitment (QSC) protocols with group covariant encoding scheme. First we consider a class of QSC protocol, which is general enough to incorporate all the QSC protocols given in the preceding literatures. Then among those protocols, we consider group covariant protocols and show that the exact upperbound on the binding condition can be calculated. Next using this result, we prove that for every irreducible representation of a finite group, there always exists a corresponding nontrivial QSC protocol which reaches a level of security impossible to achieve classically.

Zero-Knowledge Proofs and String Commitments Withstanding Quantum Attacks

The concept of zero-knowledge (ZK) has become of fundamental importance in cryptography. However, in a setting where entities are modeled by quantum computers, classical arguments for proving ZK fail to hold since, in the quantum setting, the concept of rewinding is not generally applicable. Moreover, known classical techniques that avoid rewinding have various shortcomings in the quantum setting.<br /> <br />We propose new techniques for building <em>quantum</em> zero-knowledge (QZK) protocols, which remain secure even under (active) quantum attacks. We obtain computational QZK proofs and perfect QZK arguments for any NP language in the common reference string model. This is based on a general method converting an important class of classical honest-verifier ZK (HVZK) proofs into QZK proofs. This leads to quite practical protocols if the underlying HVZK proof is efficient. These are the first proof protocols enjoying these properties, in particular the first to achieve perfect QZK.<br /> <br />As part of our construction, we propose a general framework for building unconditionally hiding (trapdoor) string commitment schemes, secure against quantum attacks, as well as concrete instantiations based on specific (believed to be) hard problems. This is of independent interest, as these are the first unconditionally hiding string commitment schemes withstanding quantum attacks.<br /> <br />Finally, we give a partial answer to the question whether QZK is possible in the plain model. We propose a new notion of QZK, <em>non-oblivious verifier</em> QZK, which is strictly stronger than honest-verifier QZK but weaker than full QZK, and we show that this notion can be achieved by means of efficient (quantum) protocols.

Computational Collapse of Quantum State with Application to Oblivious Transfer

Quantum 2-party cryptography differs from its classical counterpart in at least one important way: Given black-box access to a perfect commitment scheme there exists a secure 1-2 <em>quantum</em> oblivious transfer. This reduction proposed by Crépeau and Kilian was proved secure against any receiver by Yao, in the case where perfect commitments are used. However, quantum commitments would normally be based on computational assumptions. A natural question therefore arises: What happens to the security of the above reduction when computationally secure commitments are used instead of perfect ones?<br /> <br />In this paper, we address the security of 1-2 QOT when computationally binding string commitments are available. In particular, we analyse the security of a primitive called <em>Quantum Measurement Commitment</em> when it is constructed from unconditionally concealing but computationally binding commitments. As measuring a quantum state induces an irreversible collapse, we describe a QMC as an instance of ``computational collapse of a quantum state''. In a QMC a state appears to be collapsed to a polynomial time observer who cannot extract full information about the state without breaking a computational assumption.<br /> <br />We reduce the security of QMC to a <em>weak</em> binding criteria for the string commitment. We also show that <em>secure</em> QMCs implies QOT using a straightforward variant of the reduction above.

Quantum bit string commitment.

A bit string commitment protocol securely commits N classical bits so that the recipient can extract only M<N bits of information about the string. Classical reasoning suggests that bit string commitment implies bit commitment and hence, given the Mayers-Lo-Chau theorem, that nonrelativistic quantum bit string commitment is impossible. Not so: there exist nonrelativistic quantum bit string commitment protocols, with security parameters epsilon and M, that allow A to commit N=N(M,epsilon) bits to B so that A's probability of successfully cheating when revealing any bit and B's probability of extracting more than N'=N-M bits of information about the N bit string before revelation are both less than epsilon. With a restrictive definition of security against A, N can be taken to be O(exp(CN')) for a positive constant C. I briefly discuss possible applications.

On the Computational Collapse of Quantum Information

We analyze the situation where computationally binding string commitment schemes are used to force the receiver of a BB84 encoding of a classical bitstring to measure upon reception. Since measuring induces an irreversible collapse to the received quantum state, even given extra information after the measurement does not allow the receiver to evaluate reliably some predicates apply to the classical bits encoded in the state. This fundamental quantum primitive is called quantum measure commitment (QMC) and allows for secure two-party computation of classical functions. An adversary to QMC is one that can both provide valid proof of having measured the received states while still able to evaluate a predicate applied to the classical content of the encoding. We give the first quantum black-box reduction for the security of QMC to the binding property of the string commitment. We characterize a class of quantum adversaries against QMC that can be transformed into adversaries against a weak form for the binding property of the string commitment. Our result provides a construction for 1--2-oblivious transfer that is computationally secure against the receiver and unconditionally secure against the sender from any string commitment scheme satisfying a weak binding property.

Nonmalleable Cryptography

The notion of nonmalleable cryptography, an extension of semantically secure cryptography, is defined. Informally, in the context of encryption the additional requirement is that given the ciphertext it is impossible to generate a different ciphertext so that the respective plaintexts are related. The same concept makes sense in the contexts of string commitment and zero-knowledge proofs of possession of knowledge. Nonmalleable schemes for each of these three problems are presented. The schemes do not assume a trusted center; a user need not know anything about the number or identity of other system users. Our cryptosystem is the first proven to be secure against a strong type of chosen ciphertext attack proposed by Rackoff and Simon, in which the attacker knows the ciphertext she wishes to break and can query the decryption oracle on any ciphertext other than the target.

Nonmalleable Cryptography

The notion of nonmalleable cryptography, an extension of semantically secure cryptography, is defined. Informally, in the context of encryption the additional requirement is that given the ciphertext it is impossible to generate a different ciphertext so that the respective plaintexts are related. The same concept makes sense in the contexts of string commitment and zero-knowledge proofs of possession of knowledge. Nonmalleable schemes for each of these three problems are presented. The schemes do not assume a trusted center; a user need not know anything about the number or identity of other system users. Our cryptosystem is the first proven to be secure against a strong type of chosen ciphertext attack proposed by Rackoff and Simon, in which the attacker knows the ciphertext she wishes to break and can query the decryption oracle on any ciphertext other than the target.