On the Commitment Capacity of Unfair Noisy Channels

TL;DR

This paper investigates the maximum rate at which unfair noisy channels can be used for cryptographic commitments, providing a single-letter formula and extending prior results to more realistic adversarial scenarios.

Contribution

It derives a single-letter characterization of the commitment capacity for unfair noisy channels, generalizing previous work on fair channels.

Findings

Commitment capacity reduces to binary symmetric channel capacity in the fair case.

Provides a single-letter formula for the commitment capacity of unfair noisy channels.

Extends cryptographic resource analysis to channels with adversarial control.

Abstract

Noisy channels are a valuable resource from a cryptographic point of view. They can be used for exchanging secret-keys as well as realizing other cryptographic primitives such as commitment and oblivious transfer. To be really useful, noisy channels have to be consider in the scenario where a cheating party has some degree of control over the channel characteristics. Damg\r{a}rd et al. (EUROCRYPT 1999) proposed a more realistic model where such level of control is permitted to an adversary, the so called unfair noisy channels, and proved that they can be used to obtain commitment and oblivious transfer protocols. Given that noisy channels are a precious resource for cryptographic purposes, one important question is determining the optimal rate in which they can be used. The commitment capacity has already been determined for the cases of discrete memoryless channels and Gaussian channels. In this work we address the problem of determining the commitment capacity of unfair noisy channels. We compute a single-letter characterization of the commitment capacity of unfair noisy channels. In the case where an adversary has no control over the channel (the fair case) our capacity reduces to the well-known capacity of a discrete memoryless binary symmetric channel.

Equations

$$H_{\infty }(X)=\underset{x}{\min }\log (1/P_X(x)).$$

$$H_{\infty }(X|Y)=\underset{y}{\min }{H}_{\infty }(X|Y=y).$$

$$H_0(X)=\log |\{x\in X|P_X(x)>0\}|$$

$$H_0(X|Y)=\underset{y}{\max }{H}_0(X|Y=y).$$

$$\mathsf{SD}\left(P_X,P_Y\right):=\frac{1}{2}\sum _{v\in \mathcal{V}}|P_X(v)-P_Y(v)|.$$

$$H_{\infty }^{\epsilon }(X)=\underset{X^{\prime }:\mathsf{SD}\left(P_{X^{\prime }},P_X\right)\le \epsilon }{\max }{H}_{\infty }(X^{\prime }),$$

$$H_{\infty }^{\epsilon }(X|Y)=\underset{X^{\prime }{Y}^{\prime }:\mathsf{SD}\left(P_{X^{\prime }{Y}^{\prime }},P_{XY}\right)\le \epsilon }{\max }{H}_{\infty }(X^{\prime }|Y^{\prime }),$$

$$H_0^{\epsilon }(X)=\underset{X^{\prime }:\mathsf{SD}\left(P_{X^{\prime }},P_X\right)\le \epsilon }{\min }{H}_0(X^{\prime }),$$

$$H_0^{\epsilon }(X|Y)=\underset{X^{\prime }{Y}^{\prime }:\mathsf{SD}\left(P_{X^{\prime }{Y}^{\prime }},P_{XY}\right)\le \epsilon }{\min }{H}_0(X^{\prime }|Y^{\prime }).$$

$$H_{\infty }^{\epsilon +{\epsilon }^{\prime }}(XY|Z)-H_{\infty }^{{\epsilon }^{\prime }}(Y|Z)\ge H_{\infty }^{\epsilon }(X|YZ)$$

$$\ge H_{\infty }^{{\epsilon }_1}(XY|Z)-H_0^{{\epsilon }_2}(Y|Z)-\log (1/(\epsilon -{\epsilon }_1-{\epsilon }_2))$$

$$H_0^{\epsilon +{\epsilon }^{\prime }}(XY|Z)-H_0^{{\epsilon }^{\prime }}(Y|Z)\le H_0^{\epsilon }(X|YZ)$$

$$\le H_0^{{\epsilon }_1}(XY|Z)-H_{\infty }^{{\epsilon }_2}(Y|Z)+\log (1/(\epsilon -{\epsilon }_1-{\epsilon }_2)).$$

$$\mathsf{SD}\left(P_{G(W),G},P_{U_{\ell },G}\right)\le \frac{1}{2}\sqrt{2^{-H_{\infty }(W)}{2}^{\ell }}.$$

$$\mathrm{Pr}\left[|X-\mu |>A\right]<O\left({\left(\frac{t\mu +t^2}{A^2}\right)}^{t/2}\right).$$

$$\mathrm{Pr}\left[\beta (X^n,Y^n,M,c)=accept\right]\ge 1-ϵ.$$

$$I(C;Vie{w}_B)\le ϵ.$$

$${\Pr\left[\,{\begin{array}[]{l}\beta(\widetilde{X}^{n},Y^{n},M,\widetilde{c})=accept~{}\&\\ \beta(\overline{X}^{n},Y^{n},M,\overline{c})=accept\end{array}}\,\right]}\leq\epsilon.$$

$$R_C=\frac{\log |\mathcal{C}|}{n}.$$

$$h(\gamma )-h(\theta ),\mathrm{for}\theta =\frac{\delta -\gamma }{1-2\gamma }.$$

$$H_{\infty }^{\epsilon }(X^n|G_1(X^n),G_2(X^n),Y^n,G_1,G_2)\ge$$

$$\ge H_{\infty }(X^n,G_1(X^n),G_2(X^n)|Y^n,G_1,G_2)$$

$$-H_0(G_1(X^n),G_2(X^n)|Y^n,G_1,G_2)-\log ({\epsilon }^{-1})$$

$$=H_{\infty }(X^n|Y^n,G_1,G_2)$$

$$-H_0(G_1(X^n),G_2(X^n)|Y^n,G_1,G_2)-\log ({\epsilon }^{-1})$$

$$=H_{\infty }(X^n|Y^n)$$

$$-H_0(G_1(X^n),G_2(X^n)|Y^n,G_1,G_2)-\log ({\epsilon }^{-1})$$

$$\ge n(h(\gamma )-\eta )-n(h(\theta )+{\alpha }_1+{\alpha }_2)-\log ({\epsilon }^{-1})$$

$$=n(h(\gamma )-h(\theta )-\eta -{\alpha }_1-{\alpha }_2)-\log ({\epsilon }^{-1})$$

$$\mathrm{Pr}\left[I>8n+1\right]$$

$$O\left(2^{n(h(\theta )+{\alpha }_1)}{2}^{-t/2}\right)<O\left(2^{-n}\right).$$

$${\left(8n+1\right)}^2{2}^{-{\alpha }_{2}n},$$

$${\Pr\left[\,{\begin{array}[]{l}\beta(\widetilde{X}^{n},Y^{n},M,\widetilde{c})=accept~{}\&\\ \beta(\overline{X}^{n},Y^{n},M,\overline{c})=accept\end{array}}\,\right]}\leq\epsilon$$

$$\mathrm{Pr}\left[\beta (Z^n,Y^n,M,c)=accept\right]\ge 1-ϵ.$$

$$H(C|Z^n{Y}^{n}M)$$

Full text

I Introduction

Commitment protocols. Consider the case of first-price sealed-bid auctions: the participants place their bids in sealed envelopes that are later on opened to determine the winner and how much he will pay. The sealed envelopes play a crucial role in this protocol since they protect the secrecy of each bid during the bidding process but at the same time they preclude the winner from changing his bid after the first phase. In the digital world, commitment protocols have a role similar to that of the sealed envelopes. They are cryptographic protocols involving two mutually distrustful parties, Alice and Bob. The idea of the protocol is very simple: in a first phase Alice commits to a value $c$ by sending some information to Bob which commits her to $c$ without revealing it. Later on, Alice can execute with Bob a second phase of the protocol in order to reveal the value $c$. From Alice’s point of view the protocol should guarantee that after the first phase no information about $c$ is leaked to Bob. From Bob’s point of view the protocol should guarantee that Alice cannot change her mind after the first phase, i.e., there is at most one value that Alice can successfully open in an eventual execution of the second phase.

Commitment was introduced by Blum [1] and is one of the most fundamental cryptographic protocols, widely used as sub-protocol in applications such as secure multi-party computation [2, 3, 4], contract signing [5] and zero-knowledge proofs [6, 7, 8]. In this work we are interested in commitment protocols that are information-theoretically secure, i.e., both security guarantees should hold even against (computationally) unbounded adversaries.

Noise-based cryptography. The potential of noisy channels for cryptographic purposes was first noticed by Wyner [9] who proposed a scheme for exchanging a secret-key in the presence of an eavesdropper (henceforth denote Eve). Wyner considered a model in which Eve receives the transmitted symbols over a degraded channel with respect to the legitimate receiver ’s channel. This possibility result was later extended to the class of general (non-degraded) broadcast channels by Csiszár and Körner [10]. Both models did not consider public communication. Maurer [11] proved that public communication can improve the parties’ ability of generating a secret. Ahlswede and Csiszár [12] also improved the previous results.

In the case of commitment protocols, the first solution based on noisy channels was developed by Crépeau and Kilian [13]. The efficiency of the commitment protocols based on noisy channels was later improved by Crépeau [14].

In all these pioneering works, the case where an adversary can control the characteristics of the channel was not considered.

Unfair noisy channels. Damgård et al. [15] proposed a more realistic model, called unfair noisy channels (UNC), in which the error probability of the channel is not exactly known by the protocol participants and can be influenced by malicious parties. The honest parties only know that the crossover probability is between $\gamma$ and $\delta$ (for $0<\gamma<\delta<1/2$), and an adversary can set the crossover probability to any value in this range. Damgård et al. [15] proved that using UNC with certain parameters it is possible to implement an information-theoretically secure commitment protocol.

Recently a variant of UNC known as elastic channel has been studied. On one hand, it has two restrictions with relation to UNC: (1) only a corrupt receiver can manipulate the crossover probability to any value in the range $[\gamma;\delta]$; (2) when both parties are honest the crossover probability is always $\delta$. On the other hand, commitment (and even oblivious transfer) can be obtained for all parameters $0<\gamma<\delta<1/2$ [16, 17].

Commitment capacity. Since noisy channels are valuable resources for cryptography, an important question is determining the optimal rate in which they can be used to implement the diverse cryptographic primitives. In the case of commitment this amounts to determining the optimal ratio between the length of the committed values and the number of uses of the noisy channel (i.e., the commitment capacity of the channel). This problem was first raised by Winter et al. [18], who also answered the question for the case of discrete memoryless channels. After that, the commitment capacity of Gaussian channels was obtained by Nascimento et al. [19]. The question of determining the optimal way of using noisy channels was also studied for other cryptographic tasks, for instance in the vast literature on secrecy capacity [9, 10, 20, 21, 11, 12, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33] and also in the works that deal with the oblivious transfer capacity [34, 35, 36, 37, 38].

Our contribution in this work is determining the commitment capacity of unfair noisy channels. The work is organized as follows. In section II we establish our notation and present some existing results that will be used thereafter. In section III, we introduce the model and the security definitions, and also state our main theorem. In section IV we prove the direct part of the theorem and in section V the converse. We finish with some concluding remarks in section VI.

II Preliminaries

II-A Notation

We will denote by calligraphic letters the domains of random variables, by upper case letters the random variables and by lower case letters the realizations of the random variables. Other sets are also denoted by calligraphic letters and the cardinality of a set ${\cal X}$ is denoted by $|{\cal X}|$. For a random variable $X$ over ${\cal X}$, we denote its probability distribution by $P_{X}:{\cal X}\rightarrow[0,1]$ with $\sum_{x\in{\cal X}}P_{X}(x)=1$. For a joint probability distribution $P_{XY}:{\cal X}\times{\cal Y}\rightarrow[0,1]$, let $P_{X}(x):=\sum_{y\in{\cal Y}}P_{XY}(x,y)$ denote the marginal probability distribution and let $P_{X|Y}(x|y):=\frac{P_{XY}(x,y)}{P_{Y}(y)}$ denote the conditional probability distribution if $P_{Y}(y)\neq 0$. We write $U_{n}$ for a random variable uniformly distributed over $\{0,1\}^{n}$.

If an algorithm (or a function) $f$ is randomized, we denote by $f(x;r)$ the result of computing $f$ on input $x$ with randomness $r$. If $a$ and $b$ are two strings of bits of the same length, we denote by $a\oplus b$ their bitwise XOR and by $\mathsf{HD}(a,b)$ their Hamming distance. The logarithm used in this paper are in base 2.

II-B Entropies

The binary entropy function of $x$ is denoted by $h(x):=-x\log x-(1-x)\log(1-x)$. For finite alphabets ${\cal X},{\cal Y},{\cal Z}$ and random variables $X\in{\cal X},Y\in{\cal Y},Z\in{\cal Z}$, the entropy of $X$ is denoted by $H(X)$ and the mutual information between $X$ and $Y$ by $I(X;Y)$. The min-entropy is given by

[TABLE]

Its conditional version is defined as

[TABLE]

The max-entropy is defined as

[TABLE]

and its conditional version is given by

[TABLE]

The statistical distance between two probability distributions $P_{X}$ and $P_{Y}$ over the same domain ${\cal V}$ is

[TABLE]

For $0\leq\varepsilon<1$ the $\varepsilon$-smooth versions of the above entropies are defined as

[TABLE]

[TABLE]

[TABLE]

[TABLE]

We will need the chain rules for smooth entropies conditioned on an additional random variable $Z$ [39]:

[TABLE]

and

[TABLE]

II-C Strong Extractors and the Leftover-Hash Lemma

In the direct part of our proof we will use strong randomness extractors, therefore we present here the relevant definitions and properties.

Definition II.1** (Strong Randomness Extractors [40, 41])**

Let $\mathsf{Ext}:\{0,1\}^{n}\rightarrow\{0,1\}^{\ell}$ be a probabilistic polynomial time function which uses $r$ bits of randomness. We say that $\mathsf{Ext}$ is an efficient $(n,m,\ell,\varepsilon)\mathrm{-strong}$ $\mathrm{extractor}$ if for all probability distributions $P_{W}$ with $\mathcal{W}=\{0,1\}^{n}$ and such that $H_{\infty}(W)\geq m$, for random variables $R$ uniformly distributed in the bit-strings of length $r$ and $L$ uniformly distributed in the bit-strings of length $\ell$, we have that $\mathsf{SD}\left({P_{\mathsf{Ext}(W;R),R},P_{L,R}}\right)\leq\varepsilon$.

Strong extractors can extract at most $\ell=m-2\log(\varepsilon^{-1})+O(1)$ bits of nearly random bits [42] and this optimal bound is achieved by universal hash functions [43].

Definition II.2** ($t$-Universal Hash Functions)**

A class ${\cal G}$ of functions ${\cal A}\rightarrow{\cal B}$ is $t$-universal if, for any distinct $x_{1},\ldots,x_{t}\in{\cal A}$, when $g$ is chosen uniformly at random from ${\cal G}$, the induced distribution on $(g(x_{1}),\ldots,g(x_{t}))$ is uniform over ${\cal B}^{t}$.

The leftover-hash lemma (similarly the privacy-amplification lemma) [44, 45, 46, 47, 41] guarantees that universal hash functions can be used to extract $\ell=m-2\log(\varepsilon^{-1})+2$ nearly random bits.

Lemma II.3** (Leftover-hash lemma)**

Assume that a class ${\cal G}$ of functions $G:\{0,1\}^{n}\rightarrow\{0,1\}^{\ell}$ is 2-universal. Then for $G$ selected uniformly at random from ${\cal G}$ we have that

[TABLE]

In particular, universal hash functions are $(n,m,\ell,\varepsilon)\mathrm{-strong}$ $\mathrm{extractors}$ whenever $\ell\leq m-2\log(\varepsilon^{-1})+2$.

The following lemma by Rompel will be also useful.

Lemma II.4** ([48])**

Suppose $t$ is a positive even integer, $X_{1},\cdots,X_{u}$ are $t$-wise independent random variables taking values in the range $[0,1]$, $X=\sum_{i=1}^{u}X_{i}$, $\mu=E[X]$, and $A>0$. Then

[TABLE]

III Problem Statement

III-A Unfair Noisy Channels

Since commitment protocols that are information-theoretically secure cannot be implemented from scratch, the efforts were focused on obtaining such protocols based on physical assumptions. One of these assumptions is the existence of noisy channels that can be used by the parties. Binary symmetric channels are known to allow the implementation of commitment schemes [13, 14]. But these protocols have the disadvantage that they rely on the assumption that a malicious party do not interfere with the channel to try to modify its error probability.

Damgård et al. [15] introduced a more realistic assumption, namely unfair noisy channels, that is a modification of the binary symmetric channel. In this model, a channel is specified by two parameters: $\gamma$ and $\delta$ (with $0<\gamma<\delta<\frac{1}{2}$); and the channel is denoted as $(\gamma,\delta)$-UNC. The error probability of the channel is guaranteed to fall into the interval $[\gamma,\delta]$, but is not known by the honest parties. Therefore any protocol based on a $(\gamma,\delta)$-UNC should work for any error probability in the range $[\gamma,\delta]$. On the other hand, a malicious party can set the error probability to any value in the range $[\gamma,\delta]$.

Definition III.1** (Unfair Noisy Channels)**

The $(\gamma,\delta)$-UNC receives as input a bit $X$ and outputs a bit $Y$. The transition probability of the $(\gamma,\delta)$-UNC is determined by an auxiliary parameter $T$ whose alphabet are the real numbers in the interval $[\gamma,\delta]$. If the transmitter or the receiver is malicious, he can choose the value of $T$; otherwise it is randomly chosen and is not revealed to the parties. The transition probability is given by $P_{Y|XT}(y,x,t)=1-t$ if $y=x$ and $P_{Y|XS}(y,x,t)=t$ if $y\neq x$.

Damgård et al. [15] proved that, on one hand, if $\delta\geq 2\gamma(1-\gamma)$ then the $(\gamma,\delta)$-UNC is trivial (i.e., secure commitment protocols cannot be based on this channel). On the other hand, if $\delta<2\gamma(1-\gamma)$ then there is a commitment protocol based on the $(\gamma,\delta)$-UNC.

Remark: Note that a $(\gamma,\delta)$-UNC can equivalently be seen as the concatenation of two binary symmetric channels, $W_{f}$ with error probability $\gamma$ and $W_{v}$ with error probability $\theta$ for $0\leq\theta\leq\frac{\delta-\gamma}{1-2\gamma}$. The error probability of the channel $W_{v}$ can be controlled by a malicious party and it is unknown in the case that both parties are honest.

Definition III.2

We say that two strings $x^{n}$ and $y^{n}$ are $\epsilon$-compatible with an $(\gamma,\delta)$-Unfair Noisy Channel if, for $\epsilon>0$, the Hamming distance ($\mathsf{HD}$) of $x^{n}$ and $y^{n}$ is at most $\delta n+\epsilon$. Similarly, two random variables $X^{n}$ and $Y^{n}$ are said to be compatible with an $(\gamma,\delta)$-Unfair Noisy Channel if ${\Pr\left[\,{\mathsf{HD}(X^{n},Y^{n})>\delta n}\,\right]}$ is negligible in $n$.

III-B Commitment Capacity

Since $(\gamma,\delta)$-UNC are valuable resources, one would like to use them in the most efficient way. Hence the important question of determining the commitment capacity of these channels arises. Our goal in this work is to determine the commitment capacity of unfair noisy channels in the same way that Winter et al. [18] did for the discrete memoryless channels and Nascimento et al. [19] did for the Gaussian channels. Let us begin by defining the concept of commitment protocols and recalling its security notions.

A commitment protocol has two phases: called commitment and opening. There are two parties involved in the protocol: the committer (also denoted Alice) and the verifier (also denoted Bob). The protocol works as follows. In the commitment phase, Alice commits to a value $c$, but without revealing anything about it to Bob. Later on, Alice can execute the opening phase to disclose the value $c$ to Bob. The security guarantee that Alice expects from the protocol is that nothing about $c$ should be learned by Bob in the first phase, while the security guarantee that Bob expects is that Alice should not be able to change the value committed to after the first phase. We proceed with a more detailed description of these definitions and of the resources available to the parties in our model.

Alice and Bob have two channels available between them:

• $-$

a bidirectional authenticated noiseless channel, and

• $-$

$(\gamma,\delta)$-UNC from Alice to Bob

Note that this model allows multiple uses of the $(\gamma,\delta)$-UNC within a protocol in an interactive manner. Let $n$ denote the number of times that the parties use the $(\gamma,\delta)$-UNC channel.

Commitment Protocol

A commitment protocol is a family of protocols indexed by the security parameter $n$. Each protocol uses the $(\gamma,\delta)$-UNC $n$ times and proceeds in two phases as described below. For the sake of simplicity in the notation we will not explicitly mention the dependence on the security parameter. Both parties have access to local randomness. Note that all the messages generated by Alice and Bob are well-defined random variables, depending on the value that Alice wants to commit to, $c$, and the local randomness of the parties. As usual, we assume that the noiseless messages exchanged by the players and their personal randomness are taken from $\{0,1\}^{*}$.

Commitment Phase

Alice has an input $c$ (from the message space ${\cal C}$) that she wants to commit to. There are $n$ rounds of communication through the $(\gamma,\delta)$-UNC and in each of these rounds Alice inputs a symbol $x_{i}$ to the $(\gamma,\delta)$-UNC and an output $y_{i}$ is delivered to Bob. Let $X^{n}$ be the random variable denoting the bitstring sent through the $(\gamma,\delta)$-UNC and $Y^{n}$ the bitstring received through the $(\gamma,\delta)$-UNC. The parties can use the bidirectional authenticated noiseless channel at any time, with the messages possibly depending on $X^{n}$, $C$ and the local randomness. Let $M$ be the random variable denoting all the noiseless messages exchanged between the players,

Opening Phase

The parties only exchange messages over the noiseless channel. Alice announces the value $\hat{c}$ and the bitstring $\hat{x}^{n}$ that she claims that she used during the first phase. Finally Bob executes a test $\beta(\hat{x}^{n},y^{n},m,\hat{c})$ in order to decide if he accepts the value $\hat{c}$ or not.

We call Bob’s view all the data in his possession after the completion of the commitment phase and denote it by $view_{B}$.

A commitment protocol is $\epsilon$-sound if for honest Alice and Bob executing the protocol and for all $c\in{\cal C}$ and for any $X^{n}$ compatible with $Y^{n}$ for the $(\gamma,\delta)$-UNC,

[TABLE]

A commitment protocol is $\epsilon$-concealing if for any possible behavior of Bob in the commitment phase,

[TABLE]

A protocol is $\epsilon$-binding, if for all $\widetilde{c},\overline{c}\in{\cal C}$ such that $\widetilde{c}\neq\overline{c}$ and for any strategy of (a dishonest) Alice to pick the random variable $X^{n}$ that is sent through the $(\gamma,\delta)$-UNC channel, and the random variables $\widetilde{X}^{n}$ and $\overline{X}^{n}$ that are presented during the opening phase

[TABLE]

We call a commitment protocol secure if there exists a function $\epsilon$ that is negligible in the security parameter $n$ and is such that the protocol is $\epsilon$-sound, $\epsilon$-concealing and $\epsilon$-binding.111For easy of presentation the security of the constructions is argued in the stand-alone model (as usual in cryptography) in which case there is only one execution of the protocol. But the security of the commitment protocols based on noisy channels can be extended to the UC framework [49] in which the protocols can be composed and arbitrary protocols can be executed in parallel [50, 51].

Remark: We restrict our model to protocols where the public conversation $M$ does not depend on the channel output $Y^{n}$ given $X^{n}$, that is $I(M;Y^{n}|X^{n})=0$. This is indeed the case for all the protocols in the literature. Moreover, the public communication is used solely to prevent Alice from cheating, thus we see no reason for a commitment protocol based on noisy channels to have its public communication depending on the channel output for a given input $X^{n}$.

The commitment rate of the protocol is given by

[TABLE]

A commitment rate is said to be achievable if there exists a secure commitment protocol that achieves this rate. The commitment capacity of a $(\gamma,\delta)$-UNC is the supremum of the achievable rates.

Our main result is presented below and states the commitment capacity of the $(\gamma,\delta)$-UNC. The proof appears in sections IV and V.

Theorem III.3

The commitment capacity of any non-trivial $(\gamma,\delta)$-Unfair Noisy Channel is given by

[TABLE]

IV Protocol - Direct Part

We first prove the direct part of the theorem, i.e., we describe the protocol that achieves the commitment capacity and prove its security. The protocol follows the approach of Damgård et al. [15] and uses two rounds of hash challenge-response in order to guarantee the binding property: the intuition is that the first round reduces the number of inputs that Alice can successfully open to be polynomial in the security parameter. The second round then binds Alice to one specific input. The concealing condition is achieved using a 2-universal hash function $\mathsf{Ext}$ chosen by Alice that is used to generate a secure key which is then applied as a one-time pad to cipher $c$.

Let $\theta=\frac{\delta-\gamma}{1-2\gamma}$ and let $\nu>0$ be a parameter of the protocol. Let $\alpha_{1}$, $\alpha_{2}$, $\beta$ be parameters such that $\alpha_{1},\alpha_{2}>0$, $\beta>\alpha_{1}+\alpha_{2}$, and $n(h(\theta)+\alpha_{1})$, $n\alpha_{2}$ and $n(h(\gamma)-h(\theta)-\beta)$ are integers. In the following commitment protocol the message space is ${\cal C}=\{0,1\}^{n(h(\gamma)-h(\theta)-\beta)}$.

Commitment Phase: Alice wants to commit to the binary string $c\in{\cal C}$. The parties proceed as follows:

Alice chooses a random binary string $x^{n}=(x_{1},\ldots,x_{n})$ of dimension $n$ and for $1\leq i\leq n$ sends the bit $x_{i}$ to Bob over the $(\gamma,\delta)$-UNC. 2. 2.

Bob receives the string $y^{n}=(y_{1},\ldots,y_{n})$ sent over the $(\gamma,\delta)$-UNC, chooses uniformly at random a function $g_{1}$ of the class of $4n$-universal hash functions ${\cal G}_{1}:\{0,1\}^{n}\rightarrow\{0,1\}^{n(h(\theta)+\alpha_{1})}$, and sends the description of $g_{1}$ to Alice over the noiseless channel. 3. 3.

Alice computes $e_{1}=g_{1}(x^{n})$ and sends it to Bob. 4. 4.

Bob chooses uniformly at random a function $g_{2}$ of the class of $2$-universal hash functions ${\cal G}_{2}:\{0,1\}^{n}\rightarrow\{0,1\}^{n\alpha_{2}}$, and sends its description to Alice over the noiseless channel. 5. 5.

Alice chooses uniformly at random a function $\mathsf{Ext}:\{0,1\}^{n}\rightarrow\{0,1\}^{n(h(\gamma)-h(\theta)-\beta)}$ of the class of two-universal hash functions, computes $d=c\oplus\mathsf{Ext}(x^{n})$ and $e_{2}=g_{2}(x^{n})$, and sends $d$, $e_{2}$ and the description of $\mathsf{Ext}$ to Bob over the noiseless channel.

Opening Phase: Alice wants to reveal the value of $c$ to Bob. The parties proceeds as follow:

Alice sends to Bob over the noiseless channel the values $x^{n}$ and $c$. 2. 2.

Bob checks if $\gamma n-\nu n\leq\mathsf{HD}(x^{n},y^{n})\leq\delta n+\nu n$, if $g_{1}(x^{n})=e_{1}$, $g_{2}(x^{n})=e_{2}$ and if $c=\mathsf{Ext}(x^{n})\oplus d$. Bob accepts if there are no problems in the tests.

Theorem IV.1

The protocol is secure and can achieve the commitment rate $h(\gamma)-h(\theta)-\beta$ for any $h(\gamma)-h(\theta)>\beta>0$ and $n$ sufficiently large.

Proof:

We proof that the protocol is binding, concealing and sound, and furthermore achieves the desired commitment rate.

Soundness

The protocol fails for honest Alice and Bob only if $\mathsf{HD}(x^{n},y^{n})>\delta n+\nu n$ or $\mathsf{HD}(x^{n},y^{n})<\gamma n-\nu n$. We have that the expectation of $\mathsf{HD}(x^{n},y^{n})$ is less than or equal to $\delta n$, because the $(\gamma,\delta)$-UNC has error probability less than or equal to $\delta$. So the Chernoff bound guarantees that the probability that $\mathsf{HD}(x^{n},y^{n})>\delta n+\nu n$ is a negligible function of $n$. Similarly we can prove that the probability that $\mathsf{HD}(x^{n},y^{n})<\gamma n-\nu n$ is a negligible function of $n$.

Concealment

For any $\eta>0$ and $n$ sufficiently large, we have that

[TABLE]

where the first inequality follows from the chain rule for smooth entropy, the first equality from the fact that $G_{1}(X^{n}),G_{2}(X^{n})$ are functions of $G_{1}$, $G_{2}$ and $X^{n}$, the second equality from the fact that $X^{n}$ is independent of $G_{1}$, $G_{2}$ given $Y^{n}$ and the last inequality follows from the facts that the error probability of the channel is at least $\gamma$, the range of $G_{1}$ has cardinality $2^{n(h(\theta)+\alpha_{1})}$ and the range of $G_{2}$ has cardinality $2^{n\alpha_{2}}$.

Setting $\varepsilon=2^{-\kappa n}$ (with $\kappa>0$), for $n$ sufficiently large, the security of the key obtained by applying the hash function $\mathsf{Ext}:\{0,1\}^{n}\rightarrow\{0,1\}^{n(h(\gamma)-h(\theta)-\beta)}$ to $x$ follows from the leftover-hash lemma since $\beta>\alpha_{1}+\alpha_{2}$ and $\kappa$ and $\eta$ can be arbitrarily small for $n$ sufficiently large. Note that having a negligible statistical distance is equivalent to having a negligible mutual information [52].

Binding

A dishonest Alice can cheat successfully only if she finds two different strings $\overline{x}^{n}$ and $\widetilde{x}^{n}$ such that $\gamma n-\nu n\leq\mathsf{HD}(\overline{x}^{n},y^{n})\leq\delta n+\nu n$, $\gamma n-\nu n\leq\mathsf{HD}(\widetilde{x}^{n},y^{n})\leq\delta n+\nu n$, and both pass the sequentially performed hash challenge-response tests, for arbitrarily small $\nu$ and sufficiently large $n$. We can assume without loss of generality that Alice sets the error probability of the channel to $\gamma$ when she sends $x^{n}$. In the typicality test an honest Bob accepts any string that is jointly typical with $y^{n}$ for any error probability $\gamma\leq\rho\leq\delta$. So Alice can cheat only if she finds two strings $\overline{x}^{n}$ and $\widetilde{x}^{n}$ so that both pass the hash tests and are jointly typical with $x^{n}$ for binary symmetric channels with error probabilities $0\leq\overline{\tau}\leq\theta$ and $0\leq\widetilde{\tau}\leq\theta$. The number of such jointly typical strings is upper bounded by $2^{n(h(\theta)+\varepsilon^{\prime})}$ for any $\varepsilon^{\prime}>0$ and $n$ sufficiently large. We fix $\alpha_{1}>\varepsilon^{\prime}$.

Let the viable set denote the channel inputs that Alice can possibly open to Bob and he would accept. If there were no hash checks, the viable set would have at most $2^{n(h(\theta)+\varepsilon^{\prime})}$ elements. Lets consider this initial viable set. The goal of the first round of hash challenge-response is to, with overwhelming probability, reduce the number of elements of the viable set to at most $8n+1$. In this first round, Alice has to commit to one arbitrary value $e_{1}$ for the output of the hash function $g_{1}$. Considering the $j$-th viable string before this first round, we define $I_{j}$ as $1$ if that string is mapped to $e_{1}$ by $g_{1}$; and $I_{j}=0$ otherwise. Let $I=\sum_{j}I_{j}$. Clearly $\mu=E[I]<1$ as $\alpha_{1}>\varepsilon^{\prime}$. Let $e_{1}$ be considered bad if $I$ is bigger than $8n+1$. Given that $g_{1}$ is $4n$-wise independent, by applying Lemma II.4 with $t=4n$ and $A=2t=8n$, we get

[TABLE]

Then the probability that any $e_{1}$ is bad is upper bounded by

[TABLE]

But if the viable set contains at most $8n+1$ elements after the first hash challenge-response round, the probability that some of those collide in the second hash challenge-response round is upper bounded by

[TABLE]

which is negligible in $n$.

Commitment Rate

For $n$ sufficiently large, $\alpha_{1}$ and $\alpha_{2}$ can be made arbitrarily small, and thus $\beta$ can also be made arbitrarily small while preserving the security of the protocol. Therefore it is possible to achieve the commitment rate $h(\gamma)-h(\theta)-\beta$ for any $h(\gamma)-h(\theta)>\beta>0$.

V Converse

For proving the converse, we will assume a specific cheating behavior for Alice. As we are interested in proving an upper bound in the commitment capacity, restricting Alice’s behavior will only strength our result. Let $k=\log|\mathcal{C}|$ and $C$ be uniformly random over $\mathcal{C}$. Let $X^{n}$ be a random variable representing the data Alice inputs into the unfair noisy channel. Assume, Alice sets the noise level of the unfair noisy channel connecting her to Bob to $\gamma$. Let $Y^{n}$ be a random variable obtained by passing $X^{n}$ through the unfair noisy channel (Channel 1). Let $Z^{n}$ be a random variable obtained by passing $X^{n}$ through a binary symmetric channel with error probability equal to $\theta$ with $0\leq\theta\leq\frac{\delta-\gamma}{1-2\gamma}$ (Channel 2). Denote the conversation over the public authenticated and noiseless channel by $M$.

In the case of commitments based on fair noisy channels, it was proved in [18] that after the commit phase is finished, if Bob is presented with Alice’s inputs to the channel, $X^{n}$, he is able to obtain almost complete knowledge on the committed value $C$. Here we will prove that in the case of unfair noisy channels if Bob is presented with a noisy version of $X^{n}$ he is still able to compute the committed value $C$ with high probability.

Lemma V.1

$H(C|Z^{n}M)\leq 1+kp$* for $p$ negligible in $n$.*

Proof:

Let $C,X^{n},Y^{n},Z^{n}$ and $M$ be defined as above. We first give a procedure so that the commitment $C$ can be estimated with high probability from $Z^{n},Y^{n}$ and $M$.

The procedure is as follows: given $Z^{n},Y^{n}$ and $M$, compute the value $c$ that maximizes ${\Pr\left[\,{\beta(Z^{n},Y^{n},M,c)=accept}\,\right]}$, breaking ties in an arbitrary way. Because of the bindingness condition, we know that no two different values of $c$ will be accepted with high probability

[TABLE]

for all $\widetilde{X}^{n}$ and $\overline{X}^{n}$ compatible with $Y^{n}$.

Moreover, from the correctness property of the protocol and from the fact that $Z^{n}$ and $Y^{n}$ are compatible for the unfair noisy channel in question, we know that for the correct value $c$ we have

[TABLE]

Thus, with high probability this procedure will give us the right committed value $c$. Let $p$ be the probability that this procedure returns a wrong value. Using Fano’s inequality we get

[TABLE]

One can prove that the output of the channel $Y^{n}$ is not needed in the above described procedure. The intuition is that $Z^{n}$ is a “less noisy” version of $X^{n}$ and thus can be used (instead of $Y^{n}$) for retrieving the value of the commitment. In order to formalize this result, we need to use the assumed independence of the public conversation $M$ and $Y^{n}$ given $X^{n}$, i.e., $I(M;Y^{n}|X^{n})=0$. First, we pass (or simulate the passing of) $Z^{n}$ through a binary symmetric channel with error probability $\gamma$. Denote the output of the simulated channel by $\widetilde{Y}^{n}$. Note that $\widetilde{Y}^{n}$ and $X^{n}$ are compatible. Moreover, given the fact that the public conversation is independent of $Y^{n}$ given $X^{n}$, we have that the public communication of the protocol using Channel 1 ($M$), $C,X^{n}$ and $\widetilde{Y}^{n}$ are a valid transcript of a commitment protocol (the correctness, binding and concealing properties should apply). Thus, one has from the correctness property that

[TABLE]

From bindingness we have that

[TABLE]

for all $\widetilde{X}^{n}$ and $\overline{X}^{n}$ compatible with $\widetilde{Y}^{n}$.

Again, using Fano’s inequality we get

[TABLE]

Because the Markov chain $CX^{n}\leftrightarrow Z^{n}\leftrightarrow\widetilde{Y}^{n}$ holds, we have that $H(C|Z^{n}\widetilde{Y}^{n}M)=H(C|Z^{n}M)$, which proves our result.

We have that

[TABLE]

where inequality 1 comes from the $\epsilon$-concealing requirement and inequality 2 from the previous lemma.

Now we develop the expression $I(C;Z^{n}|M)-I(C;Y^{n}|M)$ using the same steps used on the Section V of the seminal work of Csiszár and Körner [10]; the details are included for the sake of completeness. Let $Z^{i}$ denote $Z_{1}\ldots Z_{i}$ and $\hat{Y}^{i}$ denote $Y_{i}\ldots Y_{n}$. We expand $I(C;Z^{n}|M)$ starting from $I(C;Z_{1}|M)$ and $I(C;Y^{n}|M)$ starting from $I(C;Y_{n}|M)$

[TABLE]

Similarly we obtain

[TABLE]

We have that

[TABLE]

Similarly we can get that

[TABLE]

Therefore

[TABLE]

Letting $L$ be a random variable uniformly distributed in $\{1,\ldots,n\}$ and independent of $CMX^{n}Y^{n}Z^{n}$, and setting $U\triangleq MZ^{L-1}\hat{Y}^{L+1}L$, $V\triangleq UC$, $X\triangleq X_{L}$, $Y\triangleq Y_{L}$ and $Z\triangleq Z_{L}$ we get that $U\leftrightarrow V\leftrightarrow X\leftrightarrow YZ$ form a Markov chain and

[TABLE]

Putting everything together, for any secure commitment protocol, there are $U\leftrightarrow V\leftrightarrow X\leftrightarrow YZ$ such that

[TABLE]

where $\epsilon^{\prime}=\frac{1+kp+\epsilon}{n}$ goes to 0 for $n$ sufficiently large.

We now set $\theta=\frac{\delta-\gamma}{1-2\gamma}$. In our case channel 2 is less noisy than channel 1, therefore maximizing over all $U\leftrightarrow V\leftrightarrow X\leftrightarrow YZ$ we get

[TABLE]

where inequality 4 comes from the fact that both expressions in the brackets are non-negative since channel 2 is less noisy than channel 1 and inequality 5 follows taking the maximum over $X$. Hence

[TABLE]

where $\epsilon^{\prime}$ goes to 0 for $n$ sufficiently large. This completes the proof of the converse.

VI Final Remarks

In this paper we obtained the commitment capacity of the unfair noisy channels. A similar notion of capacity for oblivious transfer was defined in [34]. We state as an open problem to obtain the oblivious transfer capacity of unfair noisy channels. Another open question is to derive the commitment capacity of weak channels [53]. In the case of elastic channels, for commitments from Alice to Bob, the channel is essentially degraded to a binary symmetric channel with crossover probability $\gamma$ and therefore the commitment capacity is $h(\gamma)$. On the other hand, we conjecture that the commitment capacity for commitments from Bob to Alice is $h(\delta)-h(\theta)$ for $\theta=\frac{\delta-\gamma}{1-2\gamma}$. However, if either of the two restrictions of the elastic channels in relation to unfair noisy channels is discarded (i.e., only the receiver being able to set the crossover probability; and the crossover probability being fixed to $\delta$ when both parties are honest), then we get back to the same commitment capacity as for the unfair noisy channels.

Finally, we need in our proof to assume that $I(M;Y^{n}|X^{n})=0$, that is, the public communication and the channel outputs are independent given the channel inputs. While that is a natural condition respected by all the protocols that exist, we believe that, ultimately, a more general proof that does not depend on this restriction is possible. We leave such a proof as a future research problem.