Commitment Schemes

A commitment scheme allows one to commit to a chosen value (or a chosen statement) while keeping it hidden from others, with the ability to reveal the committed value later. There exist some commitment schemes that can be proven by ZK protocols.

The Committer Interface

public interface CmtCommitter

This the general interface of the Committer side of a Commitment Scheme. A commitment scheme has a commitment phase in which the committer send the commitment to the Receiver, and a decommitment phase in which the the Committer sends the decommitment to the Receiver.

Commit and Decommit

public void commit(CmtCommitValue input, long id)

This function is the heart of the commitment phase from the Committer’s point of view.

Parameters:
  • input – The value that the committer commits about.
  • id – Unique value attached to the input to keep track of the commitments in the case that many commitments are performed one after the other without decommiting them yet.
Throws:
  • IOException – if there is any problem at the communication level
public void decommit(long id)

This function is the heart of the decommitment phase from the Committer’s point of view.

Parameters:
  • id – Unique value used to identify which previously committed value needs to be decommitted now.
Throws:
  • CheatAttemptException – if the committer suspects that the receiver attempted cheating
  • IOException – if there is any problem at the communication level
  • ClassNotFoundException – if the commitment cannot be serialized
  • CommitValueException – if the commit value does not match the implementing commitment.

Conversion to and from CmtCommitValue

public byte[] generateBytesFromCommitValue(CmtCommitValue value)

This function converts the given commit value to a byte array.

Parameters:
  • value – to get its bytes.
Returns:

the generated bytes.
public CmtCommitValue generateCommitValue(byte[] x)

This function wraps the raw data x with a suitable CommitValue instance according to the actual implementaion.

Parameters:
  • x – array to convert into a commitValue.
Throws:
  • CommitValueException – if the commit value does not match the implementing commitment
Returns:

the created CommitValue.

Inner state functions

public CmtCommitmentPhaseValues getCommitmentPhaseValues(long id)

This function returns the values calculated during the commit phase for a specific commitment. This function is used for protocols that need values of the commitment, like ZK protocols during proofs on the commitment. We recommended not to call this function from somewhere else.

Parameters:
  • id – of the specific commitment
Returns:

values calculated during the commit phase
public Object[] getPreProcessValues()

This function returns the values calculated during the preprocess phase. This function is used for protocols that need values of the commitment, like ZK protocols during proofs on the commitment. We recommended not to call this function from somewhere else.

Returns:values calculated during the preprocess phase
public CmtCommitValue sampleRandomCommitValue()

This function samples random commit value to commit on.

Returns:the sampled commit value.

The Receiver Interface

public interface CmtReceiver

This the general interface of the Receiver side of a Commitment Scheme. A commitment scheme has a commitment phase in which the Receiver waits for the commitment sent by the Committer; and a decommitment phase in which the Receiver waits for the decommitment sent by the Committer and checks whether to accept or reject the decommitment.

Receive Commitment and Decommitment

public CmtRCommitPhaseOutput receiveCommitment()

This function is the heart of the commitment phase from the Receiver’s point of view.

Throws:
  • ClassNotFoundException – if the commitment received cannot be deserialized
  • IOException – if there is any problem at the communication level
Returns:

the id of the commitment and some other information if necessary according to the implementing class.
public CmtCommitValue receiveDecommitment(long id)

This function is the heart of the decommitment phase from the Receiver’s point of view.

Parameters:
  • id – wait for a specific message according to this id
Throws:
  • CheatAttemptException – if there is an error that could have been caused by a cheating attempt
  • ClassNotFoundException – if the decommitment received cannot be deserialized
  • IOException – if there is any problem at the communication level.
  • CommitValueException – if the commit value does not match the implementing commitment.
Returns:

the commitment

Conversion to and from CmtCommitValue

public byte[] generateBytesFromCommitValue(CmtCommitValue value)

This function converts the given commit value to a byte array.

Parameters:
  • value – to get its bytes.
Returns:

the generated bytes.

Inner state functions

public Object getCommitmentPhaseValues(long id)

Return the intermediate values used during the commitment phase.

Parameters:
  • id – get the commitment values according to this id.
Returns:

a general array of Objects.
public Object[] getPreProcessedValues()

Return the values used during the pre-process phase (usually upon construction). Since these values vary between the different implementations this function returns a general array of Objects.

Returns:a general array of Objects

Implementations in Scapi

Each concrete commitment protocol should have committer and receiver classes that implement the CmtCommitter and CmtReceiver interfaces mentioned above or the CmtCommitterWithProofs and CmtReceiverWithProofs, in case the scheme can be proven.

Concrete Commitments protocols implemented so far are: * Pedersen commitment * Pedersen Hash commitment * Pedersen Trapdoor commitment * El Gamal commitment * El Gamal Hash commitment * Simple Hash commitment * Equivoqal commitments

Example of Usage

Commitment protocol has two sides: committer and receiver. In order to execute the commitment protocol, both committer and receiver should be created as separate programs (Usually not on the same machine).

Steps in committer creation:

  • Given a Channel object ch do:
    • Create a CmtCommitter (for example, CmtPedersenCommitter).
    • Create an instance of the concrete CommitValue that suits the commitment scheme (This can be done by calling the function generateCommitValue(byte[]).
    • Call the commit() function of the committer with the committed value and id.
    • Call the decommit() function of the committer with the same id sent to the commit() function.

Code example:

try {
    //create the committer
    DlogGroup dlog = new MiraclDlogECF2m("K-233");
    CmtCommitter committer = new CmtPedersenCommitter(ch, dlog, new SecureRandom());

    //generate CommitValue from string
    CmtCommitValue val = committer.generateCommitValue(new String("commit this string!").getBytes());

    //Commit on the commit value with id 2
    committer.commit(val, 2);

    //decommit id 2
    committer.decommit(2);

} catch (SecurityLevelException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (InvalidDlogGroupException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (ClassNotFoundException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (IOException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (CheatAttemptException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (CommitValueException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
}

Steps in receiver creation:

  • Given a Channel object ch do:
    • Create a CmtReceiver (for example, :java:ref:`CmtPedersenReceiver).
    • Call the receiverCommitment() function of the receiver.
    • Call the receiveDecommitment() function of the receiver with the id given in the output of the receiverCommitment() function.
    • The CommitValue returned from the receiveDecommitment() can be converted to bytes using the generateBytesFromCommitValue() function of the receiver.

Code example:

try {
    //create the receiver
    dlog = new MiraclDlogECF2m("K-233");
    CmtReceiver receiver = new CmtPedersenReceiver(ch, dlog, new SecureRandom());

    //Receive the commitment on the commit value
    CmtRCommitPhaseOutput output = receiver.receiveCommitment();

    //Receive the decommit
    CmtCommitValue val = receiver.receiveDecommitment(output.getCommitmentId());

    //Convert the commitValue to bytes.
    String committedString = new String(receiver.generateBytesFromCommitValue(val));

    System.out.println(committedString);

} catch (IllegalArgumentException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (IOException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (SecurityLevelException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (InvalidDlogGroupException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (ClassNotFoundException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (CommitValueException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
} catch (CheatAttemptException e) {
    // TODO Auto-generated catch block
    e.printStackTrace();
}