On Simulation-Sound Trapdoor Commitments

We study the recently introduced notion of a simulation-sound trapdoor commitment (SSTC) scheme. In this paper, we present a new, simpler deenition for an SSTC scheme that admits more eecient constructions and can be used in a larger set of applications. Speciically, we show how to construct SSTC schemes from any one-way functions, and how to construct very eecient SSTC schemes based on speciic number-theoretic assumptions. We also show how to construct simulation-sound, non-malleable, and universally-composable zero-knowledge protocols using SSTC schemes, yielding, for instance, the most eecient universally-composable zero-knowledge protocols known. Finally, we explore the relation between SSTC schemes and non-malleable commitment schemes by presenting a sequence of implication and separation results, which in particular imply that SSTC schemes are non-malleable.