Re: Bit Commitment Query

[Hal <hfinney@shell.portal.com>]

For Robbie Gates, I agree that the bit commitment he describes seems
more complicated than necessary.  The simpler one, where you just hash
(R,b), is the one I have seen used.  I suggest asking on sci.crypt.
Bruce Schneier and many other good cryptographers read that group.

For Futplex, the idea of using a block encryption algorithm in a 
similar way, encrypting (R,b) with a secret key K, and later revealing
K, is a little questionable because block encryption algorithms are not
designed to avoid collisions in the same way hashes are.  Futplex
suggests that it should be hard to find two keys K_1 and K_2 such that
E_K_1(R, b1) = E_K_2(R, b2) where b1<>b2.  But this is not necessarily
true.  A cryptosystem might have the property, say, that complementing
the key is equivalent to complementing bit 0 of the plaintext.  DES has
some simple complementation properties (although not this one).  Unless
you can show that a cipher with this property is inherently weak then
it is not a valid assumption that a cipher won't have this property.

There is some literature on creating hash functions out of block ciphers.
The two are really not interchangeable.

Hal