Collapse-binding commitments in the standard model∗

Introduction. Commitment schemes are one of the most fundamental primitives in cryptography. A commitment scheme is a two-party protocol consisting of two phases, the commit and the open phase. The goal of the commitment is to allow the sender to transmit information related to a message m during the commit phase in such a way that the recipient learns nothing about the message (hiding property). But at the same time, the sender cannot change his mind later about the message (binding property). Later, in the open phase, the sender reveals the message m and proves that this was indeed the message that he had in mind earlier (by sending some “opening information” u). Unfortunately, it was shown by [3] that the binding and hiding property of a commitment cannot both hold with information-theoretical security. Thus, one typically requires one of them to hold only against computationally-limited adversaries. Since