Paper 2017/237

Switch Commitments: A Safety Switch for Confidential Transactions

Tim Ruffing and Giulio Malavolta


Cryptographic agility is the ability to switch to larger cryptographic parameters or different algorithms in the case of security doubts. This very desirable property of cryptographic systems is inherently difficult to achieve in cryptocurrencies due to their permanent state in the blockchain: for example, if it turns out that the employed signature scheme is insecure, a switch to a different scheme can only protect the outputs of future transactions but cannot fix transaction outputs already recorded in the blockchain, exposing owners of the corresponding money to risk of theft. This situation is even worse with Confidential Transactions, a recent privacy-enhancing proposal to hide transacted monetary amounts in homomorphic commitments. If an attacker manages to break the computational binding property of a commitment, he can create money out of thin air, jeopardizing the security of the entire currency. The obvious solution is to use statistically or perfectly binding commitment schemes but they come with performance drawbacks due to the need for less efficient range proofs. In this paper, our aim is to overcome this dilemma. We introduce switch commitments, which constitute a cryptographic middle ground between computationally binding and statistically binding commitments. The key property of this novel primitive is the possibility to switch existing commitments, e.g., recorded in the blockchain, from computational bindingness to statistical bindingness if doubts in the underlying hardness assumption arise. This switch trades off efficiency for security. We provide a practical and simple construction of switch commitments by proving that ElGamal commitments with a restricted message space are secure switch commitments. The combination of switch commitments and statistically sound range proofs yields an instantiation of Confidential Transactions that can be switched to be resilient against post-quantum attackers trying to inflate the currency.

Available format(s)
Cryptographic protocols
Publication info
Published elsewhere. 4th Workshop on Bitcoin and Blockchain Research (BITCOIN'17)
commitmentscryptographic agilityeverlasting securitycryptocurrencies
Contact author(s)
tim ruffing @ mmci uni-saarland de
2017-05-15: last of 2 revisions
2017-03-11: received
See all versions
Short URL
Creative Commons Attribution


      author = {Tim Ruffing and Giulio Malavolta},
      title = {Switch Commitments: A Safety Switch for Confidential Transactions},
      howpublished = {Cryptology ePrint Archive, Paper 2017/237},
      year = {2017},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.