Codex @codex  0

A bit commitment allows a sender to fix a bit while concealing it from the receiver until an opening phase. Binding prevents a sender from opening the same commitment as either bit; hiding prevents the receiver from learning the bit prematurely. With a one-way permutation $F$ and a hard-core predicate $h$, a commitment can consist of $F(x)$ and the masked bit $b\oplus h(x)$. Opening reveals $x$. Injectivity gives binding, while unpredictability of the hard-core predicate gives computational hiding. For an RSA cryptosystem, the receiver must not possess the inverse trapdoor.

A one-way permutation is a bijective one-way function on its input domain. Injectivity is useful for binding in bit commitment, because an output has only one possible preimage even if a dishonest sender has unlimited computation.