|
In cryptography, a commitment scheme allows one to commit to a chosen value (or chosen statement) while keeping it hidden to others, with the ability to reveal the committed value later.〔Oded Goldreich (2001). Foundations of Cryptography: Volume 1, Basic Tools, ((draft available ) from author's site). Cambridge University Press. ISBN 0-521-79172-3. (see also http://www.wisdom.weizmann.ac.il/~oded/foc-book.html) 〕 Commitment schemes are designed so that a party cannot change the value or statement after they have committed to it: that is, commitment schemes are ''binding''. Commitment schemes have important applications in a number of cryptographic protocols including secure coin flipping, zero-knowledge proofs, and secure computation. A way to visualize a commitment scheme is to think of a sender as putting a message in a locked box, and giving the box to a receiver. The message in the box is hidden from the receiver, who cannot open the lock themselves. Since the receiver has the box, the message inside cannot be changed—merely revealed if the sender chooses to give them the key at some later time. Interactions in a commitment scheme take place in two phases: # the ''commit phase'' during which a value is chosen and specified # the ''reveal phase'' during which the value is revealed and checked In simple protocols, the commit phase consists of a single message from the sender to the receiver. This message is called ''the commitment''. It is essential that the specific value chosen cannot be known by the receiver at that time (this is called the ''hiding'' property). A simple reveal phase would consist of a single message, ''the opening'', from the sender to the receiver, followed by a check performed by the receiver. The value chosen during the commit phase must be the only one that the sender can compute and that validates during the reveal phase (this is called the ''binding'' property). The concept of commitment schemes was first formalized by Gilles Brassard, David Chaum, and Claude Crepeau in 1988,〔Gilles Brassard, David Chaum, and Claude Crepeau, ''(Minimum Disclosure Proofs of Knowledge )'', Journal of Computer and System Sciences, vol. 37, pp. 156–189, 1988.〕 but the concept was used without being treated formally prior to that.〔〔Claude Crépeau, ''Commitment'', (MCgill.ca ), accessed April 11, 2008〕 The notion of commitments appeared earliest in works by Manuel Blum,〔 Shimon Even,〔Shimon Even. ''Protocol for signing contracts.'' In Allen Gersho, ed., ''Advances in Cryptography'' (proceedings of CRYPTO '82), pp. 148–153, Santa Barbara, CA, USA, 1982.〕 and Shamir et al.〔A. Shamir, R. L. Rivest, and L. Adleman, ''Mental Poker.'' In D. Klarner, ed., ''The Mathematical Gardner'', pp. 37–43. Wadsworth, Belmont, California, 1981.〕 The terminology seems to have been originated by Blum,〔 although commitment schemes can be interchangeably called bit commitment schemes—sometimes reserved for the special case where the committed value is a binary bit. ==Applications== 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「Commitment scheme」の詳細全文を読む スポンサード リンク
|