A Perfectly Binding Commitment Scheme Against Quantum Attacks.

Kirill Morozov, Partha Sarathi Roy, Kouichi Sakurai

In this work, we construct a dual version of statistically binding commitment scheme by Jain et al. (Asiacrypt 2012) with shorter commitment size under hardness of syndrome decoding. Then, we point out that perfectly binding variants of the above schemes follow directly from the Randomized McEliece and Niederreiter public key encryption schemes, assuming indistinguishability of permuted Goppa codes, as well as hardness of the exact learning parity with noise (xLPN) problem (for the McEliece scheme) and hardness of syndrome decoding (for the Niederreiter scheme). Our key observation here is that perfect binding (as opposed to statistical binding) requires exact knowledge of minimal distance of the underlying code. Finally, we provide security evaluation of our proposals, and compare their performance with that of existing schemes.

Nir Bitansky, Huijia Lin, Omri Shmueli

Jeffrey Bub

Serge Fehr, Max Fillinger

We consider the related notions of two-prover and of relativistic commitment schemes. In recent work, Lunghi et al. proposed a new relativistic commitment scheme with a multi-round sustain phase that enables to keep the binding property alive as long as the sustain phase is running. They prove security of their scheme against classical attacks; however, the proven bound on the error parameter is very weak: it blows up doubly exponentially in the number of rounds. In this work, we give a new analysis of the multi-round scheme of Lunghi et al., and we show a linear growth of the error parameter instead (also considering classical attacks only). Our analysis is based on a new and rather general composition theorem for two-prover commitment schemes. The proof of our composition theorem is based on a better understanding of the binding property of two-prover commitments that we provide in the form of new definitions and relations among them. These new insights are certainly of independent interest and are likely to be useful in other contexts as well. Finally, our work gives rise to several interesting open problems, for instance extending our results to the quantum setting, where the dishonest provers are allowed to perform measurements on an entangled quantum state in order to try to break the binding property.

Serge Fehr, Max Fillinger

We reconsider the concept of multi-prover commitments, as introduced in the late eighties in the seminal work by Ben-Or et al. As was recently shown by Crépeau et al., the security of known two-prover commitment schemes not only relies on the explicit assumption that the provers cannot communicate, but also depends on their information processing capabilities. For instance, there exist schemes that are secure against classical provers but insecure if the provers have quantum information processing capabilities, and there are schemes that resist such quantum attacks but become insecure when considering general so-called non-signaling provers, which are restricted solely by the requirement that no communication takes place. This poses the natural question whether there exists a two-prover commitment scheme that is secure under the sole assumption that no communication takes place; no such scheme is known. In this work, we give strong evidence for a negative answer: we show that any single-round two-prover commitment scheme can be broken by a non-signaling attack. Our negative result is as bad as it can get: for any candidate scheme that is (almost) perfectly hiding, there exists a strategy that allows the dishonest provers to open a commitment to an arbitrary bit (almost) as successfully as the honest provers can open an honestly prepared commitment, i.e., with probability (almost) 1 in case of a perfectly sound scheme. In the case of multi-round schemes, our impossibility result is restricted to perfectly hiding schemes. On the positive side, we show that the impossibility result can be circumvented by considering three provers instead: there exists a three-prover commitment scheme that is secure against arbitrary non-signaling attacks.

Mingqiang Wang, Xue Wang, Tao Zhan