Upload
moris-mccarthy
View
214
Download
0
Embed Size (px)
Citation preview
Commitment schemes
Commit stageReveal stage
m
mS R
m
Security properties:Hiding: R learns nothing about m during commit stageBinding: S cannot decommit to two different values
Parallel repetition might not reduce soundness error
b Ã{0,1}
P V
V accepts if b’ = b, and the safes are different
• Safes are realized as commitment schemes• Soundness error ½
b’
b
b’
b
b’
Two repetitions do not improve soundness
b1 Ã{0,1}
V1b1
P*
b2 Ã{0,1}b2
1
2
V2
Both verifiers accept if b1 = b2 ) soundness error ½
Can be extended to any (# of repetitions) kThere exists a single protocol whose soundness error remains ½ for any (poly) k
b1_
b2_