Concurrent Non-malleable Commitments from Any One-Way Function

Abstract

We show the existence of concurrent non-malleable commitments based on the existence of one-way functions. Our proof of security only requires the use of black-box techniques, and additionally provides an arguably simplified proof of the existence of even stand-alone secure non-malleable commitments.

Constant-Round Non-malleable Commitments from Sub-exponential One-Way Functions

“…Comparing the two, our result may be viewed as offering a new trade-off between round complexity and quantitative hardness assumptions. As with [15,25,16,21], our commitment scheme achieves a very strong notion of non-malleability-that of concurrent non-malleability-which guarantees independence of the committed values even when multiple executions of the commitment schemes are executed at the same time. Before providing further details about our construction, we provide some additional context and applications.…”

“…We recall the definition of concurrent non-malleability from [16], which builds upon those in [6,25]. Let (C, R) be a commitment scheme with identities, and 1 n be the security parameter.…”

“…In the former, the adversary participates in one interaction on the left and m interactions on the right, and in the latter, the adversary participates in one interaction on the left and one interaction on the right. As shown in [16], any commitment scheme that is one-many non-malleable is also concurrent non-malleable.…”

“…We assume WLOG that A is deterministic. Following [25,16], the stand-alone adversary S uses A as a black box and emulates the left interaction by honestly committing to the string 0 n . Messages from the right interaction are forwarded externally.…”

“…The result was subsequently improved by Pass and Rosen [24], who obtained constant-round protocols assuming only collision-resistant hash functions with standard hardness. There has been a series of follow-up work on non-malleable commitments [25,16,21,20,15], but none of which reduces the assumptions in [24] for constant-round nonmalleable commitments. This raises the following natural question:…”