114 Bit Commitment Using Hash Functions

The purpose of r2 is to protect Alice’s secret bit b. To find b before Alice opens the commitment, Bob would have to find r′ 2 and b ′ such that H(r1r 2b ′) = c. This is akin to the problem of inverting H and is likely to be hard, although the one-way property for H is not strong enough to imply this. On the one hand, if Bob succeeds in finding such r′ 2 and b ′, he has indeed inverted H , but he does so only with the help of r1—information that is not generally available when attempting to invert H . The purpose of r1 is to strengthen the protection that Bob gets from the hash properties of H . Even without r1, the strong collision-free property of H would imply that Alice cannot find c, r2, and r′ 2 such that H(r20) = c = H(r ′ 21). But by using r1, Alice would have to find a new colliding pair for each run of the protocol. This protects Bob by preventing Alice from exploiting a few colliding pairs for H that she might happen to discover.