Standard security does not imply security against selective-opening
EUROCRYPT'12 Proceedings of the 31st Annual international conference on Theory and Applications of Cryptographic Techniques
Black-box reductions and separations in cryptography
AFRICACRYPT'12 Proceedings of the 5th international conference on Cryptology in Africa
Selective opening chosen ciphertext security directly from the DDH assumption
NSS'12 Proceedings of the 6th international conference on Network and System Security
Revisiting lower and upper bounds for selective decommitments
TCC'13 Proceedings of the 10th theory of cryptography conference on Theory of Cryptography
Fast two-party secure computation with minimal assumptions
Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
| Hi-index | 0.00 |
The selective decommitment problem can be described as follows: assume that an adversary receives a number of commitments and then may request openings of, say, half of them. Do the unopened commitments remain secure? Although this question arose more than twenty years ago, no satisfactory answer could be presented so far. We answer the question in several ways: If simulation-based security is desired (i.e., if we demand that the adversary’s output can be simulated by a machine that does not see the unopened commitments), then security is not provable for noninteractive or perfectly binding commitment schemes via black-box reductions to standard cryptographic assumptions. However, we show how to achieve security in this sense with interaction and a non-black-box reduction to one-way permutations. If only indistinguishability of the unopened commitments from random commitments is desired, then security is not provable for (interactive or noninteractive) perfectly binding commitment schemes, via black-box reductions to standard cryptographic assumptions. However, any statistically hiding scheme does achieve security in this sense. Our results give an almost complete picture when and how security under selective openings can be achieved. Applications of our results include: Essentially, an encryption scheme must be non-committing in order to achieve provable security against an adaptive adversary. When implemented with our secure commitment scheme, the interactive proof for graph 3-coloring due to becomes zero-knowledge under parallel composition. On the technical side, we develop a technique to show very general impossibility results for black-box proofs.