Manuel Blum. Coin Flipping by Telephone. In Allen Gersho, editor, Advances in Cryptology: A Report on CRYPTO 81, CRYPTO 81, IEEE Workshop on Communications Security, pages 11-15, Santa Barbara, CA, USA, August 24-26, 1981. U.C. Santa Barbara, Dept. of Elec. and Computer Eng., ECE Report No 82-04, 1982.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....reveal :Alice,Bob ( 15 where authority (Alice) 16 17 if (isCommitted) 18 return declassify(bid, Alice:Bob ) 19 else return 1; 20 Figure 1. Bid commitment program 2. 4 Bid commitment example Figure 1 shows an example of a Jif program based on the well known Bit Commitment Protocol [5]. Instead of committing a bit, the program commits a non negative integer. The principal Alice commits a bid v to a principal Bob without revealing the bid. Later, Alice reveals v and Bob verifies that it is the bid Alice previously committed. We chose this example because it is short but has ....

Manuel Blum. Coin flipping by telephone. In Advances in Cryptology: A Report on CRYPTO 81, pages 11--15, 1981.

....the choice of one of the secret quantities x or k, or their public counterparts y and r, then the server would gain an advantage over the client and the resulting scheme might not be secure. Fortunately, the parties need only agree on random values, a task usually referred to as coin flipping [8]. This can be implemented by first having each party choose a random share, then exchanging and combining the shares to produce the agreed upon value. Of course, the two parties might not reveal their shares simultaneously. To prevent the second party, say the server, from choosing its share after ....

M. Blum. Coin flipping by telephone. In IEEE Spring COMPCOM, pages 133--137, 1982.

....with parameters x and n is one way, it is also a Universal One Way Hash Function. Proof: Analogous to Theorem 3.1. 2. 5 Bit Commitment vs. a Strong Receiver Bit commitment is a basic protocol which is useful and essential in many cryptographic applications, such as coin flipping by telephone [3], zero knowledge and minimum disclosure proofs ( 21, 7] and identification schemes [13] Naor [38] has shown how to implement bit commitment given any pseudo random generator. His scheme suffices for the all applications above, except minimum disclosure. Furthermore, his scheme enables commit to ....

....party need not be available during the execution of the protocol ) We give the protocol assuming that the trusted third party has chosen a 1 ; a 2 ; a n=2 2 . If there is no such third party, then the a i s and a i s can be chosen via coin flipping over the telephone [3] which can be implemented using a bit commitment scheme vs a strong committer, as in [38] This commitment can also be based on the hardness of subset sum. The commit protocol to a bit b: 1. Alice chooses s 2R f0; 1g . a i i , To reveal, she sends s and b. Bob verifies that the ....

M. Blum, Coin Flipping by Telephone, Proc. 24th IEEE Compcon, 1982, pp. 133-137.

....arbitrary small fraction of a bit under the same conditions. But cryptography is no longer interested solely in protecting communications. As a result of public key cryptography [10] a large number of other cryptographic tasks have emerged. Examples of such tasks are Coin flipping by telephone [3] and Mental Poker. These may involve two or more parties, some of which may be dishonest. The general concept of Distributed Function Evaluation was first introduced by Yao [21] and later extended to Mental Games by Goldreich, Micali and Wigderson [12] Distributed Function Evaluation and ....

....have several applications in the field of cryptographic protocols. In particular one can implement zero knowledge proofs of a variety of statements using bit commitment schemes [14, 13, 4] The first implementations of bit commitment schemes were given in a computational complexity scenario [3]. Unfortunately, proofs of their (computational) security have always required an unproven assumption since otherwise they would imply very strong results such as P 6= NP. This section is inspired by that work of [5] to achieve Bit Commitment in the model of Quantum Cryptography. 3.1 Bit ....

M. Blum. Coin flipping by telephone. In Proceedings of IEEE Spring Computer Conference, pages 133--137. IEEE, 1982.

....verifier or the complexity of its communications with the prover is unbounded. However, we are able to propose a practical storage enforcing commitment scheme, for which the storage and the amortized communication complexity are independent of the length of the message. Regular commitment schemes [Blu83] bind the prover to a particular value of a string that is to be kept secret during some stages of the execution of a protocol. These commitment schemes are not designed to permit repeated verification of a commitment to the same string. Storage enforcing commitment schemes on the other hand are ....

M. Blum, "Coin flipping by telephone," Proc. of CRYPTO'81, pp. 11--15, 1981.

....8) and let H = S k H k . Remark: One way to choose hard instances for all known factoring algorithms seems to be to choose k to be large enough and then to choose n randomly from H k . These numbers were used in [Wi80] and their wide applicabilty to cryptography was demonstrated by Blum in [Bl82] hence they are commonly referred to as Blum integers . Let Qn denote the set of quadratic residues (mod n) We note that for n 2 H : 1 has Jacobi symbol 1 but is not in Qn . 2 has Jacobi symbol 1 (and is not in Qn ) We also note every x 2 Qn has exactly one square root y 2 Qn , but has ....

....integers . Let Qn denote the set of quadratic residues (mod n) We note that for n 2 H : 1 has Jacobi symbol 1 but is not in Qn . 2 has Jacobi symbol 1 (and is not in Qn ) We also note every x 2 Qn has exactly one square root y 2 Qn , but has four square roots y; y; w; w altogether (see [Bl82] for proof) Roots w and w have Jacobi symbol 1, while y and y have Jacobi symbol 1. The following assumption about the intractability of factoring is made throughout this subsection. Intractability Assumption for Factoring (IAF) Let A be a probabilistic polynomial time (factoring) algorithm. ....

Blum, M. \Coin Flipping by Telephone," Proc. IEEE Spring COMPCOM (1982), 133-137.

....she opens it. Bob knows that the contents were not tampered with, since the box was at his possession. Bit commitment has been used for zero knowledge protocols [GMW1] BCC] identification schemes [FS] Multi party protocols [GMW2] CDG] and can implement Blum s coin flipping over the phone [B]. Part of this work done while author was at UC Berkeley. Research supported by NSF grant CCR 88 13632 1 A current research program in cryptography is to base the security on as general assumptions as possible. Past successes of the program had been in establishing various primitives on the ....

M. Blum, Coin Flipping by Telephone, Proc. 24th IEEE Compcon, 1982, pp. 133-137.

....that once the envelope is sealed, Alice cannot change her mind on the bit, but Bob does not yet know the bit. Surprisingly, extremely powerful protocols can be constructed using just this simple primitive. A very simple example is a protocol known as coin flipping by telephone. As the story goes [6], Alice and Bob are getting divorced and want to divide their common belongings by flipping a coin. They only speak over the telephone (or communicate by email) but they do not trust each other. As can be easily verified, the following protocol resolves their problem. Protocol 1 ( HonestCoinFlip ....

M. Blum (1982). Coin flipping by telephone. In Proc. IEEE Spring COMPCOM, pages 133--137. IEEE.

....with parameters x and n is one way, it is also a Universal One Way Hash Function. Proof: Analogous to Theorem 3.1. 2. 5 Bit Commitment vs. a Strong Receiver Bit commitment is a basic protocol which is useful and essential in many cryptographic applications, such as coin flipping by telephone [3], zero knowledge and minimum disclosure proofs ( 20, 7] and identification schemes [12] Naor [34] has shown how to implement bit commitment given any pseudo random generator. His scheme suffices for the all applications above, except minimum disclosure. Furthermore, his scheme enables commit to ....

.... protocol ) We give the protocol assuming that the trusted third party has chosen a 1 ; a 2 ; a n=2 2 f0; 1g l(n) and a 0 1 ; a 0 2 ; a 0 n=2 2 f0; 1g l(n) If there is no such third party, then the a i s and a 0 i s can be chosen via coin flipping over the telephone [3] which can be implemented using a bit commitment scheme vs a strong committer as in [34] The commit protocol to a bit b: 1. Alice chooses s 2 f0; 1g n =2. 2. If b = 0 then Alice sends Bob T = X i2s a i 3. If b = 1 then Alice sends Bob T = X i2s a 0 i , To reveal, she sends s and ....

M. Blum, Coin Flipping by Telephone, Proc. 24th IEEE Compcon, 1982, pp. 133-137.

....once the enveloppe is sealed, Alice cannot change here mind on the bit, but Bob does not yet know the bit. Surprisingly, extremely powerful protocols can be constructed using just this simple primitive. A very simple example is a protocol known as coin flipping by telephone. As the story goes [6], Alice and Bob are in divorce and want to divide their common belongings by flipping a coin. They only speak over the telephone (or communicate by email) but they do not trust each other. As can be easily verified, the following protocol resolves their problem. Protocol 1 ( HonestCoinFlip ) 1: ....

M. Blum. Coin flipping by telephone. In Proc. IEEE Spring COMPCOM, pages 133--137. IEEE, 1982.

....x 0 represents Alice s bid. Commitment schemes are useful for identification schemes[16] multiparty protocols[17] and are an an essential component of many zero knowledge proof schemes [18, 5, 11] 2 Previous Work on Commitment Schemes Since commitment schemes were first introduced by Blum[3] in 1982 for the problem of coin flipping by telephone, commitment schemes have been an active area of research. However, one must face the facts of life : It is well known (and easy to see) that in a two player scenario with only noiseless communication, OT [Oblivous Transfer] and BC [Bit ....

....bounded, so that one achieves an asymmetric result: either computational binding and unconditional privacy, or unconditional binding and computational privacy. Commitment schemes that are computationally binding and unconditionally private have been proposed by many researchers, including Blum[3], Goldwasser, Micali, and Rivest (implicit in their signature scheme[19] Brassard, Chaum, and Cr epeau[5] Brassard, Cr epeau, and Yung[8] Halevi and Micali[21] and Halevi[20] Brassard and Yung[7] develop a very general framework and theory for all bit commitment schemes having unconditional ....

M. Blum. Coin flipping by telephone. In Proc. IEEE Spring COMPCOM, pages 133--137. IEEE, 1982.

....whereby a card is chosen at random from the deck such that each card is equally likely to be chosen, and there is no way for the device nor the smartcard to bias the selection. In the end, the card is known to both parties. The basic idea is based on previous work on coin flipping by telephone [5]. In the remainder of the paper, when we say that the smartcard deals a random card to the device, we are referring to this protocol. We focus our protocol description on a standard pocker deck of 52 cards, although the protocol can easily be generalized for other games. We map the cards in the ....

M. Blum. Coin flipping by telephone. In Proc. IEEE Spring COMPCOM, pages 133--137. IEEE, 1982.

....In this work we concentrate on the case where the Sender is computationally bounded, but the Receiver may be all powerful. 1.1 Previous Work Many commitment schemes in the unbounded receiver model are known based on number theoretic constructions. The first such scheme was suggested by Blum [4] in the context of flipping coins over the phone. Blum described a commitment scheme for one bit, which is based on the hardness of factoring large integers. Blum s scheme calls for one or two modular multiplications and a k bit commitment string for every bit which is being committed to (where k ....

M. Blum. Coin flipping by telephone. In Proc. IEEE Spring COMPCOM, IEEE, 1982. Pages 133--137.

....significance, and their quantum implementations. 2. 1 Bit commitment This primitive can be implicitly traced back to very early public key cryptography papers [40, 42] It as been used for coin tossing protocols (Alice and Bob who do not trust each other want to toss a coin over a telephone line) [8, 9, 2], zero knowledge proofs (Alice wants to prove the validity of a statement to Bob without revealing him anything else than the fact that the statement is true) 35, 36, 12, 11, 32, 16, 10, 38] and more or less every single cryptographic protocol involves bit commitments somewhere. It is a very ....

....quantum mechanics for cryptography. Wiesner invented this protocol in the early 1970 s, long before the cryptographers even realized the significance of this work. The Oblivious Transfer as described earlier is due to Rabin [40] It has been used in the design of several more complicated protocols [8, 9, 40]. More formally correct versions of this protocol were later given by Fischer, Micali, and Rackoff in [30] and by Berger, Peralta and Tedrick in [7] Other similar protocols were in the meanwhile introduced: Even, Goldreich and Lempel s one out of two oblivious transfer [29] which is more or ....

M. Blum. Coin flipping by telephone. In Proc. IEEE Spring COMPCOM, pages 133--137. IEEE, 1982.

....an arbitrary small fraction of a bit under the same conditions. But cryptography is no longer interested solely in protecting communications. As a result of public key cryptography [10] a large number of other cryptographic tasks have emerged. Examples of such tasks are Coin flipping by telephone [3] and Mental Poker. These may involve two or more parties, some of which may be dishonest. The general concept of Distributed Function Evaluation was first introduced by Yao [21] and later extended to Mental Games by Goldreich, Micali and Wigderson [12] Distributed Function Evaluation and Mental ....

....have several applications in the field of cryptographic protocols. In particular one can implement zero knowledge proofs of a variety of statements using bit commitment schemes [14, 13, 4] The first implementations of bit commitment schemes were given in a computational complexity scenario [3]. Unfortunately, proofs of their (computational) security have always required an unproven assumption since otherwise they would imply very strong results such as P 6= NP. This section is inspired by that work of [5] to achieve Bit Commitment in the model of Quantum Cryptography. 3.1 Bit ....

M. Blum. Coin flipping by telephone. In Proceedings of IEEE Spring Computer Conference, pages 133--137. IEEE, 1982.

No context found.

M.Blum, Coin Flipping by Telephone, IEEE COMPCON, pp.133-137, 1982.

....or unpredictability of oe but on the well mixedness of its bits 2 Notice that sharing a random string oe is a weaker requirement than being able to interact. In fact, if A and B could interact they would be able to construct a common random string. For instance, by coin tossing over the phone [Bl1]; the converse, however, is not true. Arthur Merlin Games. The question of the power of hidden randomness versus public randomness had already been discussed in Complexity Theory in the context of proof systems. Goldwasser, Micali, and Rackoff [GoMiRa] and Babai and Moran [Ba, BaMo] consider ....

....this paper with respect to the following special moduli. Blum integers. For n 2 N , we define the set of Blum integers of size n, BL(n) as follows: x 2 BL(n) if and only if x = pq, where p and q are primes of length n both j 3 mod 4. These integers were first used for cryptographic purposes by [Bl1]. Blum integers are easy to generate. By Fact 2.3 and the density of the primes j 3 mod 4 (de la Vallee Poussin s extension of the prime number theorem [Sh] it is easy to prove the following Fact 2.8 There exists an efficient algorithm that, on input 1 n , outputs the factorization of a ....

M. Blum, Coin Flipping by Telephone, IEEE COMPCON 1982, pp. 133--137.

No context found.

Manuel Blum. Coin Flipping by Telephone. In Allen Gersho, editor, Advances in Cryptology: A Report on CRYPTO 81, CRYPTO 81, IEEE Workshop on Communications Security, pages 11-15, Santa Barbara, CA, USA, August 24-26, 1981. U.C. Santa Barbara, Dept. of Elec. and Computer Eng., ECE Report No 82-04, 1982.

No context found.

M. Blum. Coin flipping by telephone. In Proceedings of IEEE Spring Computer Conference, pages 133--137. IEEE, 1982.

No context found.

M. Blum. Coin flipping by telephone. In Proc. of 24th IEEE Spring Computer Conference, pages 133--137. IEEE Press, 1982.

No context found.

M. Blum, "Coin flipping by telephone," CRYPTO 81, pp. 11--15, 1981.

No context found.

M. Blum. Coin Flipping by Telephone. In proc. IEEE Spring COMPCOM, pages 133-137, 1982.

No context found.

M. Blum. Coin flipping by telephone. In IEEE Spring COMPCOM, pp. 133--137, 1982.

No context found.

M. Blum. Coin flipping by telephone. In Proc. of 24th IEEE Spring Computer Conference, pages 133--137. IEEE Press, 1982.

No context found.

Manuel Blum. Coin flipping by telephone. In Advances in Cryptology: A Report on CRYPTO 81, pages 11--15, 1981.

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC