Research On Identity-based Trapdoor Mercurial Commitment

Commitment is a one of the most important basic conceptions in cryptography, whichis a fundamental primitive in constructing zero knowledge proof, secure electroniccommerce protocols and digital signatures. Trapdoor commitment scheme (also calledchameleon commitment) is a commitment which allows anyone with the knowledge oftrapdoor to open the commitment in any desired ways (and thus “equivocate”). Trapdoorcommitment scheme is different from the traditional one which enjoys the property ofbanding, so it has important application in identity authentication, abuse-free contractsigning, electronic auction, electronic voting and fair exchange. In Eurocrypt2005, Chaseet al proposed a variant of commitment called mercurial commitment. Compared with thetraditional commitment, the sender must decide whether to make the commitment equivocalor binding before forming the commitment in mercurial commitment. Meanwhile, theopening of mercurial commitment is two-tiered. In the soft-opening (also called teasing), itis possible for the sender to come up with a commitment that can be teased to any value ofthe sender’s choice. Mercurial commitment is an underlying building block for constructingidentity-based (non-interactive) zero-knowledge sets（ZKS）.In this thesis, identity-based trapdoor mercurial commitment schemes are furtherresearched, which enjoy the advantages of both identity-based trapdoor commitment andtrapdoor mercurial commitment. It is an underlying building block for constructingidentity-based zero-knowledge sets. At present, the existing schemes of identity-basedtrapdoor mercurial commitment are based on Discrete Logarithms system (strongDiffie–Hellman Assumption, Computational Diffie–Hellman Assumption and the DiscreteLogarithms Assumption). In this paper, we propose our own schemes on the RSAAssumption. We first propose a new identity-based trapdoor mercurial commitment schemeunder the RSA assumption. Moreover, we prove that the proposed construction can achievethe desired security properties and apply the scheme to the identity-based zero-knowledgesets.