Recall the collision resistant hash function based on the discrete logarithm assumption. We considered a function...

  

Transcribed Image Text:

Recall the collision resistant hash function based on the discrete logarithm assumption. We considered a function H: ZxZqG that takes (a, 3) to gah where g, h are public parameters that define H. (a) (3 points) Consider extending the input domain of the hash function as follows: H'(x1,..., k) = 1999 where the gas are randomly chosen elements of G. Show that H' is collision resistant under the discrete logarithm assumption for G. Solution: (b) (3 points) Commitment scheme: Recall a commitment scheme is a primitive that allows committing to a message so that it reveals nothing about the message; the commitment can later be opened unequivocally. Show how to modify H' from above to construct a commitment scheme that can commit to messages in Z. Argue that the commitment scheme you constructed satisfies hiding and binding properties. Solution: Recall the collision resistant hash function based on the discrete logarithm assumption. We considered a function H: ZxZqG that takes (a, 3) to gah where g, h are public parameters that define H. (a) (3 points) Consider extending the input domain of the hash function as follows: H'(x1,..., k) = 1999 where the gas are randomly chosen elements of G. Show that H' is collision resistant under the discrete logarithm assumption for G. Solution: (b) (3 points) Commitment scheme: Recall a commitment scheme is a primitive that allows committing to a message so that it reveals nothing about the message; the commitment can later be opened unequivocally. Show how to modify H' from above to construct a commitment scheme that can commit to messages in Z. Argue that the commitment scheme you constructed satisfies hiding and binding properties. Solution: