IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

Improving Practical UC-Secure Commitments based on the DDH Assumption

Eiichiro Fujisaki

Published Oct 4, 2021• 0 citations

Abstract

At Eurocrypt 2011, Lindell presented practical static and adaptively UC-secure commitment schemes based on the DDH assumption. Later, Blazy et al. (at ACNS 2013) improved the efficiency of the Lindell's commitment schemes. In this paper, we present static and adaptively UC-secure commitment schemes based on the same assumption and further improve the communication and computational complexity, as well as the size of the common reference string.

DOI: 10.1587/transfun.2021cip0014

Related papers

Highly-Efficient Universally-Composable Commitments based on the DDH Assumption.

Yehuda Lindell

Universal composability (or UC security) provides very strong security guarantees for protocols that run in complex real-world environments. In particular, security is guaranteed to hold when the protocol is run concurrently many times with other secure and possibly insecure protocols. Commitment schemes are a basic building block in many cryptographic constructions, and as such universally composable commitments are of great importance in constructing UC-secure protocols. In this paper, we construct highly efficient UC-secure commitments from the standard DDH assumption, in the common reference string model. Our commitment stage is non-interactive, has a common reference string with O(1) group elements, and has complexity of O(1) exponentiations for committing to a group element (to be more exact, the effective cost is that of 23 1 exponentiations overall, for both the commit and decommit stages). We present 3 a construction that is secure in the presence of static adversaries, and a construction that is secure in the presence of adaptive adversaries with erasures, where the latter construction has an effective additional cost of just 5 1 3 exponentiations. 1

Jan 1, 20110 citations

Analysis and Improvement of Lindell's UC-Secure Commitment Schemes.

Olivier Blazy, Céline Chevalier, David Pointcheval +1 more

Abstract. In 2011, Lindell proposed an efficient commitment scheme, with a non-interactive opening algorithm, in the Universal Composability (UC) framework. He recently acknowledged a bug in its security analysis for the adaptive case. We analyze the proof of the original paper and propose a simple patch of the scheme. More interestingly, we then modify it and present a more efficient commitment scheme secure in the UC framework, with the same level of security as Lindell’s protocol: adaptive corruptions, with erasures. The security is proven in the standard model (with a Common Reference String) under the classical Decisional Diffie-Hellman assumption. Our proposal is the most efficient UC-secure commitment proposed to date (in terms of computational workload and communication complexity).

Jan 1, 20130 citations

Improving Practical UC-Secure Commitments Based on the DDH Assumption

Eiichiro Fujisaki

Lecture notes in computer scienceJan 1, 201615 citations

Analysis and Improvement of Lindell’s UC-Secure Commitment Schemes

Olivier Blazy, Céline Chevalier, David Pointcheval +1 more

Lecture notes in computer scienceJan 1, 201331 citations

An Efficient Non-interactive Universally Composable String-Commitment Scheme

Ryo Nishimaki, Eiichiro Fujisaki, Keisuke Tanaka

This paper presents a new non-interactive string-commitment scheme that achieves universally composable security. Security is proven under the decisional composite residuosity (DCR) assumption (or the decisional Diffie-Hellman (DDH) assumption) in the common reference string (CRS) model. The universal composability (UC) is a very strong security notion. If cryptographic protocols are proven secure in the UC framework, then they remain secure even if they are composed with arbitrary protocols and polynomially many copies of the protocols are run concurrently. Many UC commitment schemes in the CRS model have been proposed, but they are either interactive commitment or bit-commitment (not string-commitment) schemes. We note, however, that although our scheme is the first non-interactive UC string-commitment scheme, a CRS is not reusable. We use an extension of all-but-one trapdoor functions (ABO-TDFs) proposed by Peikert and Waters at STOC 2008 as an essential building block. Our main idea is to extend (original deterministic) ABO-TDFs to probabilistic ones by using the homomorphic properties of their function indices. The function indices of ABO-TDFs consist of ciphertexts of homomorphic encryption schemes (such as ElGamal, and Damgård-Jurik encryption). Therefore we can re-randomize the output of ABO-TDFs by re-randomization of ciphertexts. This is a new application of ABO-TDFs.

IEICE Transactions on Fundamentals of Electronics Communications and Computer SciencesJan 1, 20125 citations

A Framework for Efficient Fully-Equipped UC Commitments.

Eiichiro Fujisaki

We present a general framework for constructing non-interactive universally composable (UC) commitment schemes that are secure against adaptive adversaries in the non-erasure setting under a single re-usable common reference string. Previously, such “fully-equipped ” UC commitment schemes are only known in [8, 9], with an unavoidable overhead of O(κ) in the sense of communication and computational complexities; meaning that to commit λ bits, the communication and computational costs require O(λκ), where κ denotes the security parameter. Efficient construction of a fully-equipped UC commitment scheme was a long-standing open problem. We introduce a cryptographic primitive, called all-but-many encryptions (ABMEs), and prove that it is a translation of fully-equipped UC commitment in the primitive level. We then construct ABMEs from cryptographic primitives that we call a probabilistic pseudo random function family and extractable sigma protocols – the former is a probabilistic version of a pseudo random function family and the latter is a special kind of sigma (i.e., canonical 3-round public-coin HVSZK) protocols with some extractability. We provide fully-equipped UC commitment schemes from ABMEs under DDH and DCR-based assumptions, respectively. In particular, the DCR-based scheme is the first fully-equipped UC commitment scheme with optimal expansion factor Ω(1); to commit κ bits, the communication and computational costs are Ω(κ). We further construct a fully-equipped UC commitment scheme from a general assumption (in which trap-door permutations exist), which is far more efficient than the previous construction [9], because, unlike [9], our construction does not require non-interactive zero-knowledge proof systems. 1

Jan 1, 20121 citation