A Framework for Efficient Fully-Equipped UC Commitments.

Abstract

We present a general framework for constructing non-interactive universally composable (UC) commitment schemes that are secure against adaptive adversaries in the non-erasure setting under a single re-usable common reference string. Previously, such “fully-equipped ” UC commitment schemes are only known in [8, 9], with an unavoidable overhead of O(κ) in the sense of communication and computational complexities; meaning that to commit λ bits, the communication and computational costs require O(λκ), where κ denotes the security parameter. Efficient construction of a fully-equipped UC commitment scheme was a long-standing open problem. We introduce a cryptographic primitive, called all-but-many encryptions (ABMEs), and prove that it is a translation of fully-equipped UC commitment in the primitive level. We then construct ABMEs from cryptographic primitives that we call a probabilistic pseudo random function family and extractable sigma protocols – the former is a probabilistic version of a pseudo random function family and the latter is a special kind of sigma (i.e., canonical 3-round public-coin HVSZK) protocols with some extractability. We provide fully-equipped UC commitment schemes from ABMEs under DDH and DCR-based assumptions, respectively. In particular, the DCR-based scheme is the first fully-equipped UC commitment scheme with optimal expansion factor Ω(1); to commit κ bits, the communication and computational costs are Ω(κ). We further construct a fully-equipped UC commitment scheme from a general assumption (in which trap-door permutations exist), which is far more efficient than the previous construction [9], because, unlike [9], our construction does not require non-interactive zero-knowledge proof systems. 1