Bit commitment is an important tool for constructing zero-knowledge proofs and multi-party computation. Unconditionally secure bit commitment can be based, in particular, on noisy channel or correlation where noise considered a valuable resource. Recently, Winter, Nascimento and Imai introduced the concept of commitment capacity, the maximal ratio between the length of a string which the sender commits to and the number of times the noisy channel/correlation is used. They also proved that for any discrete memoryless channel there exists a secure protocol achieving its commitment capacity however, no particular construction was given. Solving their open question, we provide an efficient protocol for achieving the commitment capacity of discrete memoryless systems (noisy channels and correlations).
Bit commitment is an important tool for constructing zero-knowledge proofs and multi-party computation. Unconditionally secure bit commitment can be based, in particular, on noisy channel or correlation where noise considered a valuable resource. Recently, Winter, Nascimento and Imai introduced the concept of commitment capacity, the maximal ratio between the length of a string which the sender commits to and the number of times the noisy channel/correlation is used. They also proved that for any discrete memoryless channel there exists a secure protocol achieving its commitment capacity however, no particular construction was given. Solving their open question, we provide an efficient protocol for achieving the commitment capacity of discrete memoryless systems (noisy channels and correlations).
We study the problem of commitment over channels under cost constraints. Commitment is a widely studied cryptographic primitive, where two mutually distrustful parties, say Alice and Bob, interact over two phases of a protocol, viz., commit phase followed by reveal phase, to achieve commitment on a bit string available to Alice. Commitment (over the string) is said to occur if (i) Alice commits to the string which remains securely hidden from Bob at the end of the commit phase involving Alice's transmission to Bob, and (ii) Alice reveals a string to Bob and Bob is able to successfully detect whether the string is the committed one or not. When Alice and Bob are computationally unbounded, i.e., under the information-theoretic setting, it is well known that even a single bit commitment is impossible when the channel available to Alice and Bob is noiseless. Noisy channels, however, offer the potential of non-zero commitment rate, and thus, are a valuable resource. We study information-theoretically secure commitment over noisy discrete memoryless channels (DMCs). The largest commitment throughput over noisy channels is called the commitment capacity or simply capacity. In this work, we completely characterize via a single-letter expression, the commitment capacity of DMCs under general cost constraints; this generalizes the previously known result in the absence of such cost constraints. We show that cost constrained commitment capacity of any given DMC can significantly differ from its unconstrained value. We also present a dual capacity characterization in terms of output distributions. Interestingly, we show that every input distribution achieving the capacity results in the same output distribution; the latter is the unique optimizer of our dual capacity expression.
Noisy channels are a valuable resource from a cryptographic point of view. They can be used for exchanging secret-keys as well as realizing other cryptographic primitives such as commitment and oblivious transfer. To be really useful, noisy channels have to be considered in the scenario where a cheating party has some degree of control over the channel characteristics. Damgård et al. (EUROCRYPT 1999) proposed a more realistic model where such level of control is permitted to an adversary, the so called unfair noisy channels, and proved that they can be used to obtain commitment and oblivious transfer protocols. Given that noisy channels are a precious resource for cryptographic purposes, one important question is determining the optimal rate in which they can be used. The commitment capacity has already been determined for the cases of discrete memoryless channels and Gaussian channels. In this work we address the problem of determining the commitment capacity of unfair noisy channels. We compute a single-letter characterization of the commitment capacity of unfair noisy channels. In the case where an adversary has no control over the channel (the fair case) our capacity reduces to the well-known capacity of a discrete memoryless binary symmetric channel.
As computation and communication become increasingly ubiquitous, data security remains a key consideration. Hence, cryptographic primitives lie at the heart of several modern digital technologies. In this work, we study one such important cryptographic primitive called commitment. Here two parties, say Alice and Bob, aim to realize a protocol with the following functionality: Alice seeks to share or commit to a bit string securely with Bob with the requirement that the string is hidden from Bob until she chooses to reveal it to him. Bob wants to ensure that the protocol binds Alice to her original choice of bit string by allowing him to successfully detect when she cheats at the time of revealing her string. This seemingly elementary cryptographic functionality is extremely powerful and finds wide use in technologies like blockchains, digital contracts, cryptocurrencies, etc.. More generally, commitment has also been widely studied for applications like sealed-bid auctions, distributed coin tossing, etc.. Building on Wyner's classic work on wiretap channels, unconditionally-secure or information-theoretically secure protocols have been realized for a wide variety of problems, including commitment, using noisy channels as a resource. Crucially, however, the security guarantees are intimately tied to the knowledge of the noise statistics; these could be compromised when noise statistics are imprecisely known. In this work, we seek to study information-theoretically secure commitment over a class of unreliable noisy channels called compound channels. In particular, we study commitment over compound discrete memoryless channels (compound-DMCs) where the instantiated channel is known to be a DMC but its realization or channel state is not known exactly and can only be localized to a potential set of possible states. We precisely characterize the optimal throughput or commitment capacity over general compound DMCs. We also study the effect of state-awareness at the two parties, when the parties are honest and when they are malicious, on the commitment capacity of such compound DMCs. Interestingly, we show that committer-side state-awareness can non-trivially increase the commitment throughput over the compound DMC which is not the case when one has only receiver-side state awareness. In particular, we completely characterize the commitment capacity for all state-aware configurations for compound DMCs.
Noisy channels are a foundational resource for constructing cryptographic primitives such as string commitment and oblivious transfer. The noisy channel model has been extended to unfair noisy channels, where adversaries can influence the parameters of a memoryless channel. In this work, we introduce the unstructured noisy channel model as a generalization of the unfair noisy channel model to allow the adversary to manipulate the channel arbitrarily subject to certain entropic constraints. We present a string commitment protocol with established security and derive its achievable commitment rate, demonstrating the feasibility of commitment against this stronger class of adversaries. Furthermore, we show that the entropic constraints in the unstructured noisy channel model can be derived from physical assumptions such as noisy quantum storage. Our work thus connects two distinct approaches to commitment, i.e., the noisy channel and physical limitations.
We study commitment scheme for classical-quantum channels. To accomplish this we define various notions of commitment capacity for these channels and prove matching upper and lower bound on it in terms of the conditional entropy. Our achievability (lower bound) proof is quantum generalisation of the work of one of the authors (arXiv:2103.11548) which studied the problem of secure list decoding and its application to bit-string commitment. The techniques we use in the proof of converse (upper bound) is similar in spirit to the techniques introduced by Winter, Nascimento and Imai (Cryptography and Coding 2003) to prove upper bound on the commitment capacity of classical channels. However, generalisation of this technique to the quantum case is not so straightforward and requires some new constructions, which can be of independent interest.
The bit commitment can be realized by using a noisy channel. Winter-Nascimento-Imai showed that the bit commitment capacity of a noisy channel is given by Cb= maxpNH(X\Y) where X and Y are the input and output of the channel. In this paper, the idea of a multiplex coding, which was first introduced into the coding problem of a wiretap channel by Kobayashi-Yamamoto-Ogawa, is applied to the bit commitment coding. The coding theorem is proved for the multiplex coding of bit commitment based on a noisy channel, and it is shown that several mutually independent secrets can be committed at the same time via a nosiy channel attaining the perfect secrecy of each secret with the total coding rate log \X\, where \X\ is the cardinality of channel input alphabet.