Compact and Efficient UC Commitments Under Atomic-Exchanges

Abstract

We devise a multiple (concurrent) commitment scheme operating on large messages. It uses an ideal global setup functionality in a minimalistic way. The commitment phase is non-interactive. It is presented in a modular way so that the internal building blocks could easily be replaced by others and/or isolated during the process of design and implementation. Our optimal instantiation is based on the decisional Diffie-Hellman (DDH) assumption and the (adversarially selected group) Diffie-Hellman knowledge (DHK) assumption which was proposed at CRYPTO 1991. It achieves UC security against static attacks in an efficient way. Indeed, it is computationally cheaper than Lindell’s highly efficient UC commitment based on common reference strings and on DDH from EUROCRYPT 2011.

A Extensions

1.1 A.1 A Variant Based on $\mathsf {ag}\text{- }\mathsf {DDH}_{\mathsf {Gen}}$

We can drop the $\mathsf {ag}\text{- }\mathsf {DHK0}_{\mathsf {Gen}}$ assumption and solely rely on the $\mathsf {ag}\text{- }\mathsf {DDH}_{\mathsf {Gen}}$ one. For that, we construct a new $\mathsf {Register}$ protocol based on a zero-knowledge proof with the Schnorr $\Sigma$-protocol. See Fig. 3 on page xx. This would get us closer to [16], where a WI-PoK is used in the key-setup block.

Namely, we enrich the $\Sigma$-protocol with a trapdoor commitment $\mathsf {Hgen}$ on the challenge $c$, with the trapdoor $\sigma$ released at the end. It is a trapdoor in the sense that for all $\gamma$ and all $c'$, $\mathsf {Equiv}_\sigma (\gamma ,c')$ has the same distribution as $u$ and $H_\kappa (c',\mathsf {Equiv}_\sigma (\gamma ,c'))=\gamma$. This is quite a standard technique [26]. By making the challenge atomic, we obtain a ZK protocol in a regular sense. It is further straightforward to see that $\mathsf {Register}$ satisfies all requirements, based on the $\mathsf {ag}\text{- }\mathsf {DDH}_{\mathsf {Gen}}$ assumption. To make it authenticating, we can take advantage of the $\mathcal {F}_\mathsf {atomic}$ exchange to authenticate $X$ at the same time as the response is sent.

Fig. 4.

$\mathsf {C\text{- }at}$: A UC-Secure Commitment Protocol with Atomic Exchanges

In general we prefer to use the $\mathsf {ag}\text{- }\mathsf {DHK0}_{\mathsf {Gen}}$ to ascertain the private knowledge of $\mathsf {sk}$. This may be more efficient in practice than a full implementation of, e.g., a WI-PoK. It essentially requires the selection of appropriate (and efficient) groups to work in, as done in Example 5.

1.2 A.2 Towards $\mathcal {F}_{\mathsf {MCOM}}$

The $\mathcal {F}_{\mathsf {MCOM}}$ functionality is defined as follows:

• $\mathsf {Commit}(\mathsf {sid},R,m)$ message from $S$ . If $\mathsf {sid}$ is not fresh, abort. Otherwise, store $(\mathsf {sid},S,R,m,\mathsf {sealed})$ and send a $[\mathsf {committed},\mathsf {sid},S]$ message to $R$ and to the ideal adversary.

• $\mathsf {Open}(\mathsf {sid})$ message from $S$ . If $\mathsf {sid}$ is new or the record $(\mathsf {sid},S,.,.,.)$ has no matching $S$, abort. Otherwise, retrieve $(\mathsf {sid},S,R,m,\mathsf {state})$. If $\mathsf {state}\ne \mathsf {sealed}$, abort. Otherwise, send an $[\mathsf {open},\mathsf {sid},m]$ message to $R$ and to the ideal adversary, and replace $\mathsf {state}$ by $\mathsf {opened}$ in the $(\mathsf {sid},S,R,m,\mathsf {state})$ entry.

To realize this functionality, we use a similar assumption as in [16]: we assume that a participant plays the role of a trusted certificate authority (who is honest but curious), to whom participants register their keys $\mathsf {sk}_X$ and $\mathsf {sk}_E$. The first time a participant is involved in a commitment, he must register his keys to the certificate authority (CA) and get the CA’s public key at the same time. The CA would produce a certificate which could be verified with the CA’s public key. Then, the $\mathsf {Init}$ phase between $S$ and $R$ would reduce to sending and verifying this certificate, without any ideal functionality. Due to the extraction nature of our $\mathsf {Register}$ block, all secret keys would become extractable by the ideal adversary and the UC security would still hold.