Trapdoor Commitments Research Articles

Signatures from Trapdoor Commitments with Strong Openings

In this paper, we propose a new generic construction of signatures from trapdoor commitments with strong openings in the random oracle model. Our construction is very efficient; signatures consist of just a single decommitment of the underlying commitment scheme. Furthermore, assuming the commitment scheme provides sufficiently strong statistical hiding and trapdoor opening properties, the reduction of the security of the signature scheme to the binding property of the commitment scheme is tight. To instantiate our construction, we propose two new commitment schemes with strong openings. Both of these are statistically hiding, and have binding properties based on a Diffie-Hellman inversion problem and factoring, respectively. The signature schemes obtained from these are very efficient; the first matches the performance of BLS signatures, which currently pro­vides the shortest signatures, and the second provides signatures which is one bit shorter than the shortest version of Rabin-Williams signatures while still being tightly related to factoring.

Efficient ID-based Non-Malleable Trapdoor Commitments Based on RSA and Factoring

Efficient ID-based Non-Malleable Trapdoor Commitments Based on RSA and Factoring

Efficient ID-based non-malleable trapdoor commitment

Non-malleability is an important property in commitment schemes, which can resist to the person-in-the-middle (PIM) attacks within the interaction. In this paper, we focus on the non-malleability of ID-based trapdoor commitment. We first point out some weakness of the definition for Fischlin’s ID-based trapdoor commitments, which we call the partial ID-based trapdoor commitments. Moreover, we present the formal definition for the full ID-based trapdoor commitment and give a concrete construction based on the computational Diffie–Hellman (CDH) assumption. Finally, we use the idea of multi-trapdoor commitments and the technique of non-malleability to propose two efficient interactive full ID-based non-malleable trapdoor commitments in discrete logarithm (DL) system, with/without random oracle respectively.

Hybrid commitments and their applications to zero-knowledge proof systems

We introduce the notion of hybrid trapdoor commitment schemes. Intuitively a hybrid trapdoor commitment scheme is a primitive which can be either an unconditionally binding commitment scheme or a trapdoor commitment scheme depending on the distribution of commitment parameters. Moreover, such two possible distributions are computationally indistinguishable. Hybrid trapdoor commitments are related but different with respect to mixed commitments (introduced by Damgård and Nielsen at Crypto 2002). In particular hybrid trapdoor commitments can either be polynomially trapdoor commitments or unconditionally binding commitments, while mixed commitments can be either trapdoor commitments or extractable commitments. In this paper we show that strong notions (e.g., simulation sound, multi-trapdoor) of hybrid trapdoor commitments admit constructions based on the sole assumption that one-way functions exist as well as efficient constructions based on standard number-theoretic assumptions. To further stress the difference between hybrid and mixed commitments, we remark here that mixed commitments seem to require stronger theoretical assumptions (and the known number-theoretic constructions are less efficient). Our main result, is to show how to construct concurrent and simulation-sound zero-knowledge proof systems (in contrast to the arguments recently presented in [I. Damgård, Efficient concurrent zero-knowledge in the auxiliary string model, in: Advances in Cryptology — Eurocrypt’00, in: Lecture Notes in Computer Science, vol. 1807, Springer-Verlag, 2000, pp. 418–430; P. MacKenzie, K. Yang, On simulation-sound trapdoor commitments, in: Advances in Cryptology — Eurocrypt’04, in: Lecture Notes in Computer Science, vol. 3027, Springer-Verlag, 2004, pp. 382–400; R. Gennaro, Multi-trapdoor commitments and their applications to proofs of knowledge secure under concurrent man-in-the-middle attacks, in: Advances in Cryptology — Crypto’04, in: Lecture Notes in Computer Science, vol. 3152, Springer-Verlag, 2004, pp. 220–236]) in the common reference string model. We crucially use hybrid trapdoor commitments since we present general constructions based on the sole assumption that one-way functions exist and very efficient constructions based on number-theoretic assumptions.

Perfect Hiding and Perfect Binding Universally Composable Commitment Schemes with Constant Expansion Factor

Canetti and Fischlin have recently proposed the security notion <em>universal composability</em> for commitment schemes and provided two examples. This new notion is very strong. It guarantees that security is maintained even when an unbounded number of copies of the scheme are running concurrently, also it guarantees non-malleability, resilience to selective decommitment, and security against adaptive adversaries. Both of their schemes uses Theta(k) bits to commit to one bit and can be based on the existence of trapdoor commitments and non-malleable encryption.<br /> <br />We present new universally composable commitment schemes based on the Paillier cryptosystem and the Okamoto-Uchiyama cryptosystem. The schemes are efficient: to commit to k bits, they use a constant number of modular exponentiations and communicates O(k) bits. Furthermore the scheme can be instantiated in either perfectly hiding or perfectly binding versions. These are the first schemes to show that constant expansion factor, perfect hiding, and perfect binding can be obtained for universally composable commitments.<br /> <br />We also show how the schemes can be applied to do efficient zero-knowledge proofs of knowledge that are universally composable.