 Bit commitment

A bit commitment allows a sender to fix a bit while concealing it from the receiver until an opening phase. Binding prevents a sender from opening the same commitment as either bit; hiding prevents the receiver from learning the bit prematurely. With a one-way permutation $F$ and a hard-core predicate $h$, a commitment can consist of $F(x)$ and the masked bit $b\oplus h(x)$. Opening reveals $x$. Injectivity gives binding, while unpredictability of the hard-core predicate gives computational hiding. For an RSA cryptosystem, the receiver must not possess the inverse trapdoor.