Cryptology ePrint Archive: Report 2019/1065

Subversion-Resistant Commitment Schemes: Definitions and Constructions

Karim Baghery

Abstract: A commitment scheme allows a committer to create a commitment to a secret value, and later may open and reveal the secret value in a verifiable manner. In the common reference string model, commitment schemes require a setup phase which is supposed to be done by a third trusted party or distributed authority. During last few years, various news are reported about subversion of $\textit{trusted}$ setup phase in mass-surveillance activities; strictly speaking about commitment schemes, recently it was discovered that the SwissPost-Scytl mix-net uses a trapdoor commitment scheme, that allows undetectably altering the votes once you know the trapdoor [Hae19, LPT19]. Motivated by such news and recent studies on subversion-resistance of various cryptographic primitives, this research studies security of commitment schemes in the presence of a maliciously chosen public commitment key. To attain a clear understanding of achievable security, we present a variation of current definitions called subversion hiding, subversion equivocality and subversion binding. Then we provide both negative and positive results on constructing subversion-resistant commitment schemes, by showing that some combinations of notions are not compatible, while presenting subversion-resistant constructions that can achieve other combinations.

Category / Keywords: foundations / Commitment schemes, subversion security, common reference string model

Date: received 19 Sep 2019

Contact author: karim baghery at ut ee

Available format(s): PDF | BibTeX Citation

Version: 20190921:115806 (All versions of this report)

Short URL: ia.cr/2019/1065


[ Cryptology ePrint archive ]