= Bit commitment
A bit commitment allows a sender to fix a bit while concealing it from the receiver until an opening phase. Binding prevents a sender from opening the same commitment as either bit; hiding prevents the receiver from learning the bit prematurely. With a <one-way permutation> $F$ and a <hard-core predicate> $h$, a commitment can consist of $F(x)$ and the masked bit $b\mathbin{\oplus}h(x)$. Opening reveals $x$. Injectivity gives binding, while unpredictability of the <hard-core predicate> gives computational hiding. For an <RSA cryptosystem>, the receiver must not possess the inverse trapdoor.
Back to article page
