![](bg2.png)
1.1 The State-of-the-art
The state-of-the-art non-interactive commitment
schemes in the universally composable framework
are mainly constructed from the following two
categories: non-interactive, universally compsosably
secure bit-commitment schemes and interactive
universally composable string-commitment schemes.
1.1.1 Universally Composably Non-interactive
Bit-commitment Schemes
Canetti and Fischlin (Canetti and Fischlin, 2001)
have proposed two basic approaches for construc-
tions of non-interactive and universally composable
bit-commitment schemes in the common reference
string model. The first construction of commitment
protocol is based on any trapdoor permutation in the
one-time common reference string model. The sec-
ond construction is based on the existence of claw-
free pairs of trapdoor permutations in the reusable
common reference string model, where the honest
players are assumed that they faithfully erase some
parts of their internal randomness (i.e., their com-
mitment scheme works in the internal randomness
erasure model). Canetti and Fischlin then proposed
an improved bit-commitment scheme based on the
Diffie-Hellman assumption in the (randomness) non-
erasure model.
Canetti, Lindell, Ostrovsky and Sahai (Canetti
et al., 2002) have presented a new universally com-
posable non-interactive bit-commitment protocol that
is secure against adaptive adversary based on the exis-
tence of enhanced trapdoor permutations in the com-
mon reference string model. Their scheme realizes
the UC-security in the the multi-session ideal commit-
ment functionality, an extension of the single-session
ideal commitment functionality presented in (Canetti
and Fischlin, 2001). The Canetti and Fischlin com-
mitment schemes (Canetti and Fischlin, 2001) and the
Canetti, Lindell, Ostrovsky and Sahai commitment
schemes (Canetti et al., 2002) use Ω(λ) bits to commit
a bit, where λ is a security parameter. These pioneer
works are important from point view of the theoretical
research.
1.1.2 Universally Composably Interactive
String-commitment Schemes
Damg˚ard and Nielsen (Damg˚ard and Nielsen,
2002) have presented practical interactive string-
commitment protocols in the common reference
string model. The Damg˚ard and Nielsen interac-
tive string-commitment protocol realizes the UC-
security in the presence of adaptive adversaries but
the size of the common reference string grows lin-
early with the number of participants. Damg˚ard and
Groth (Damg˚ard and Groth, 2003) then proposed an
improved commitment scheme with constant com-
mon reference string size which is independent with
the number of the parties in the commitment protocol.
Camenisch and Shoup (Camenisch and Shoup,
2003) have constructed alternative interactive uni-
versally composably secure string-commitment pro-
tocols in the context of verifiably committed en-
cryptions. Their construction is based on the zero-
knowledge proof of an encryption indeed decrypts
to a valid opening of a commitment. This construc-
tion realizes universally composable security assum-
ing the Diffie-Hellman assumption is hard in the com-
mon reference model.
1.1.3 Universally Composably Non-interactive
String-commitment Schemes
Very recently, Nishimaki, Fujisaki and Tanaka (Nishi-
maki et al., 2009) have proposedan interesting univer-
sally composable non-interactive string-commitment
scheme based on all-but-one trapdoor functions intro-
duced by Peikert and Waters in STOC 2008 (Peikert
and Waters, 2008). The Nishimaki-Fujisaki-Tanaka’s
non-interactive string commitment is one time (a
common reference string is refreshed whenever a new
session starts). The idea of their implementation is
sketched below.
Let Σ =(SKGen, Sign, Veri) be a signature scheme
that is secure against adaptive chosen-message attack
in the sense of Goldwasser, Micali and Rivest (Gold-
wasser et al., 1988). Let ∆ = (EGen, Enc, Dec) be
Damg˚ard-Jurik’s length-flexible public-key encryp-
tion scheme (Damg˚ard and Jurik, 2001). To commit
a message m ∈ M , a common-reference-string gen-
eration algorithm (CRS) invokes the key generation
algorithm SKGen of the underlying signature scheme
to produce a pair of verification key and signing key
(vk
∗
, sk
∗
). CRS then invokes the encryption algorithm
Enc to produce a ciphertxt Enc(vk
∗
) of the public
verification key. The common reference string σ is
Enc(vk
∗
) together with a description of a pair-wise
independent hash function H . Given σ and m, a com-
mitter S invokes SKGen to generate a new pair of ver-
ification and signing key (vk, sk), and then generates a
randomized ciphertext C of the message (vk
∗
− vk)m.
That is, the committer S invokes the encryption algo-
rithm Enc which takes (vk
∗
− vk)m as input to pro-
duce a ciphertextC (=Enc((vk
∗
− vk)m, r
m
)) with ran-
domness r
m
. To simulate the view of the honest com-
mitter S, the lossy branch vk
∗
will be set to vk. As
such, the common-reference-string in the Nishimaki-
Fujisaki-Tanaka’s commitment scheme is one-time.
ADAPTIVE AND COMPOSABLE NON-INTERACTIVE STRING-COMMITMENT PROTOCOLS
355