Commitment schemes

Commit stageReveal stage

m

mS R

m

Security properties:Hiding: R learns nothing about m during commit stageBinding: S cannot decommit to two different values

Parallel repetition might not reduce soundness error

b Ã{0,1}

P V

V accepts if b’ = b, and the safes are different

• Safes are realized as commitment schemes• Soundness error ½

b’

b

b’

b

b’

Two repetitions do not improve soundness

b1 Ã{0,1}

V1b1

P*

b2 Ã{0,1}b2

1

2

V2

Both verifiers accept if b1 = b2 ) soundness error ½

Can be extended to any (# of repetitions) kThere exists a single protocol whose soundness error remains ½ for any (poly) k

b1_

b2_