Unconditionally Secure Commitment and Oblivious Transfer Schemes Using Private Channels and a Trusted Initializer Ronald L Rivest Lab oratory for Computer Science Massachusetts Institute of Technology Cambridge MA rivestmitedu November Abstract We present a new and very simple commitmentscheme that do es not dep end on any assumptions ab out computational complexity the Sender and Receiver may both be computationally unb ounded In stead the scheme utilizes a trusted initializer who participates only in an initial setup phase The scheme also utilizes private channels between each pair of parties The Sender is able to easily commit to a large value the scheme is not just a bitcommitment scheme We also observe that outofn oblivious transfer is easily handled in the same mo del using a simple OT proto col due to Bennett et al Keywords bitcommitment commitmentscheme unconditional secu rity trusted third party trusted initializer oblivious transfer Intro duction A commitment scheme must sp ecify a Commit proto col and a Reveal proto col involving a Sender Alice and a Receiver Bob Alice has a secret value x that she commits to in the Commit proto col although Bob learns nothing ab out x then Later Alice discloses x in the Reveal proto col Bob may reject the value Alice reveals if it is inconsistent with the information he received during Commit Alice may not change her mind ab out the value to be revealed once Commit is nished Thus a commitmentscheme must satisfy the following requirements Correctness If b oth parties are honest and follow the proto cols then dur ing the Reveal proto col Bob will learn the value x that Alice wished to commit to Privacy Bob learns nothing ab out x during the Commit proto col Binding After the Commit proto col has nished there is only one value of x that Bob will accept during the Reveal proto col If x is required to b e a single bit wesay that the commitmentscheme is a bit commitment scheme otherwise we use the more general term commitmentscheme There are many applications for commitment schemes Sealedbid auc tions are one obvious example x represents Alices bid Commitment schemes are useful for identication schemes multiparty proto cols and are an an essential comp onent of many zeroknowledge pro of schemes Previous Work on Commitment Schemes Since commitmentschemes were rst intro duced by Blum in for the problem of coin ipping by telephone commitmentschemes have b een an active area of research However one must face the facts of life It is wel l known and easy to see that in a twoplayer scenario with only noiseless communication OT Oblivous Transfer and BC Bit Commitment with informationtheoretic security is not possible even if only passive cheating is assuming and players are al lowed innite computing power page Therefore researchers have fo cussed primarily on commitmentschemes based on computational assumptions where bind ing or privacy dep ends on the Sender or Receiver resp ectively b eing computationally b ounded or commitmentschemes based on other mo dels of communication involv ing noisy channels or quantum mechanics If the scheme requires that the Sender be computationally b ounded in order to achieve binding we say that it is computational ly binding other wise it is unconditional ly binding some authors would call this information theoretical ly binding Similarly if the scheme requires that the Receiver be computational bounded in order to achieve privacy we say that it is computational ly pri vate otherwise it is unconditional ly private some authors would call this informationtheoretical ly privateorunconditional ly hidingoruncondition al ly concealing It is typically enough to assume that only one of the Sender or Receiver be computationally b ounded so that one achieves an asymmetric result either computational binding and unconditional privacy or unconditional binding and computational privacy Commitment schemes that are computationally binding and uncondi tionally private have b een prop osed bymany researchers including Blum Goldwasser Micali and Rivest implicit in their signature scheme Brassard Chaum and Crep eau Brassard Crep eau and Yung Halevi and Micali and Halevi Brassard and Yung develop a very gen eral framework and theory for all bit commitment schemes having uncon ditional privacy based on oneway group actions Damgard Pedersen and Ptzmann show that the existence of statistically hiding bit com mitment schemes which provide nearly p erfect unconditional privacy is equivalent to the existence of failstop signature schemes Naor presents a commitment scheme that is unconditionally bind ing and computationally private based on any pseudorandom generator or equivalently based on any oneway function Ohta Okamoto and Fujioka show that Naors scheme is secure against divertibility and note that the nonmalleable bitcommitment scheme of Dolev Dwork and Naor can also b e used to provide such protection OstrovskyVenkatesan and Yung examine in some detail bit commitmentschemes when at least one of the SenderReceiver is computationally unb ounded and in particular show that when the Sender is computationally unb ounded a commitment scheme may b e based on any hardonaverage problem in PSPACE Some researchers have explored informationtheoretic mo dels based on the assumption of noisy communication channels For example Crep eau improves on his earlier work with Kilianby giving ecient algorithms for bit commitment and oblivious transfer over a binary symmetric channel Later Damgard Kilian and Salvail explore such questions further based on unfair noisy channels and related assumptions Other researchers have explored bit commitment in mo dels of quan tum computation Brassard et al prop osed a quantum bit commitment scheme but a subtle aw was discovered Mayers proved general quan tum bit commitment to be imp ossible as did Lo and Chau More re cently Salvail shows that under certain restricted assumptions ab out the Senders ability to make measurements quantum bit commitment is still p ossible Bit commitmentschemes o ccur within a wide variety of mo dels and ap plications not all of whichare mentioned ab ove or whicht in the ab ove taxonomy Just to pick one interesting example BenOr Goldwasser Kil ian and Wigderson utilize a bit commitment scheme in a multiprover mo del of twoprovers who cant communicate with each other one com mits a bit to a verier and the other reveals it Our Mo del We b elieve it is of interest to lo ok for practical commitment schemes that work when b oth the Sender and the Receiver are computationally unb ounded What would one use for a commitmentscheme for example if it turns out that P NP The normal mo del twoparty proto col with noiseless channel do es not admit a solution How can one most simply extend the mo del to permit a solution In this pap er we make the following assumptions which suce There is a trusted third party Ted Ted is honest and b oth Alice and Bob trust that Ted will execute his role correctly There are private channels between each pair of parties Alice and Bob can each communicate privately with Ted and with each other We desire that if p ossible Ted should never nd out the value of x Alice and Bob trust Ted to be honest but the value of x is none of Teds business and Alice and Bob prefer that he never learns x This requirement rules out the obvious solution wherein Alice gives x to Ted during Commit and Ted gives x to Bob during Reveal We further desire that if p ossible Ted should not participate in the Commit and Reveal proto cols We prefer a solution wherein Ted only participates in an initial Setup proto col In such a scheme Ted is done b efore Alice may even have decided which x to commit to This rules out the obvious solution wherein Ted gives Alice a random string r during Setup Alice gives Bob r x during CommitandTed gives Bob r during Reveal We call a trusted third party who participates only in a setup phase b efore the other parties may even have their inputs a trusted initializer Proto cols using trusted initializers are much easier to implement than more typical proto cols using trusted third parties since the initialization can be p erformed wellinadvance of the actual proto col and the trusted partydoes not need to b e available to participate in the actual heart of the proto col Our commitment scheme Our commitmentscheme is illustrated in Figure All computations are p erformed mo dulo p for some xed suitably large globally known prime number p We assume that Alices secret value x satises x p The communications patterns are very simple during Setup Ted sends some dierent information to Alice and Bob During Commit Alice sends one number to Bob During Reveal Alice sends three numbers to Bob Each proto col is thus minimal just one pass and For the Setup phase Ted randomly cho oses twonumb ers a Z R p b Z These numb ers dene a line R p y ax b mo d p Ted sends the values a and b privately to Alice Ted also picks another value x uniformly at random from Z and computes the value p y ax b mo d p Ted privately sends Bob the pair x y this is a p oint on the line For the Commit phase Alice computes the value y ax b mo d p and privately sends the value y to Bob For the Reveal phase Alice privately sends Bob her secret value x and also the pair a b Bob checks that x y andx y satisfy equations and If so he accepts x otherwise he rejects T Setup S a Z R p S S b Z R p x y a b S S x Z R p S y ax b mo d p S Sw A B Commit x