Commitment over Gaussian channels with deterministic identification codes

I. INTRODUCTION

• For AWGN channels, infinite linear-scale commitment capacity leaves the meaningful superlinear growth rate to be characterized; deterministic identification over continuous-input channels scales as n log n.The paper identifies linearithmic scale as the scale at which DI capacity can be meaningfully finite and positive.Source: §I · pp. 2–3
• DI identifies whether a chosen message was sent rather than decoding the sent message, while deterministic identification over continuous-input channels can support message lengths scaling as n log n.For DMCs, deterministic identification instead has linear message-length scaling, though its rates can exceed transmission rates.Source: §I · p. 2
• The paper constructs Gaussian-channel commitment codes from capacity-achieving DI codes to obtain linearithmic word-length scaling and lower-bound linearithmic commitment capacity.The construction is motivated by the shared scaling behavior of commitment and DI over continuous channels.Source: §I · p. 3
• A direct commitment protocol sends the message’s DI codeword during commit and later verifies the revealed message with its identification region.Honest acceptance follows the DI missed-identification error, which vanishes for reliable DI codes.Source: §I · p. 3
• In the honest-but-curious setting, a sender’s substitution of a different commitment is bounded by the DI wrong-identification error.The paper distinguishes this setting, where parties follow communication rules, from dishonest security, where they may deviate.Source: §I · p. 3
• In the fully dishonest setting, bindingness must also cover arbitrary off-code input sequences, which standard DI does not contemplate.The paper therefore asks whether a modified DI code can ensure that any input sequence is reliably identified by at most one decoder.Source: §I · p. 3

II. PRELIMINARIES

• The channel adds independent Gaussian noise to each coordinate, and admissible input sequences obey a block or average power constraint.The paper represents the output law conditioned on an input sequence as a Gaussian distribution.Source: §II · p. 4
• Conditional entropy describes channel equivocation, mutual information appears in transmission capacity, and Gaussian DI capacity is treated on the linearithmic scale.For the AWGN channel, the cited DI capacity on that scale is 1/2.Source: §II · p. 4
• The construction uses projections of Gaussian noise onto fixed directions and 2-universal hashing, whose output can extract an approximately uniform string from a source with sufficient min-entropy.The passage introduces the leftover hash lemma as the formal tool for this extraction.Source: §II · p. 5
• A commitment code uses n noisy-channel transmissions during commit, then an opening and verification rule during reveal.The receiver’s commit-phase view includes channel outputs, noiseless communication, and private randomness.Source: §II · p. 5
• The bindingness definition allows a dishonest committer to send any input sequence, while soundness concerns acceptance of an honest commitment.The model assumes rational participants who may deviate for advantage but not merely to prevent task completion.Source: §II · p. 5

III. PROPOSED BC PROTOCOL AND ITS CONCEALMENT

• The sender maps a random k-bit string to a DI codeword, while each of M commitments is assigned a distinct r-bit string.The DI and commitment linearithmic rates are defined respectively from k and r divided by n log n.Source: §III · p. 5
• During commit, the sender samples a two-universal hash function, sends the XOR of its hash of the sampled string with the commitment, and sends the hash description noiselessly.The DI codeword is transmitted through the AWGN channel.Source: §III · pp. 5–6
• During reveal, the sender shares the sampled string; the receiver tests its DI codeword against the noisy output and, if accepted, unmasks the commitment.The receiver computes the commitment as the received masked string XOR the hash of the revealed string.Source: §III · p. 6

A. The proposed protocol is concealing

• The message set’s linearithmic scale exceeds the number of messages a transmission code can reliably decode, supporting the intuition that the receiver cannot identify the sent DI codeword before reveal.The proof nonetheless targets the stronger distributional concealment condition rather than relying only on non-decodability.Source: A. The proposed protocol is concealing · p. 6
• DI’s overlapping decoding regions can leave the receiver with multiple plausible codewords, but commitment requires similar receiver-view distributions for different commitments.The paper therefore uses leftover hashing to bound the distance between those distributions.Source: A. The proposed protocol is concealing · p. 6
• The concealment proof starts from a min-entropy bound for the DI string given the continuous channel output and applies the leftover hash lemma.The commitment message is independent of the sampled DI string and hash choice, allowing the argument to compare receiver views across commitments.Source: A. The proposed protocol is concealing · p. 6

• In the honest-but-curious setting, parties may try to cheat but must follow the protocol guidelines.The setting is also known as the semi-honest scenario.Source: §IV · p. 6
• At reveal, Alice may try to substitute a different DI code word and commitment for the one tied to her valid input.She is required to use a valid code word during the commit phase.Source: §IV · p. 7

A. DI codes are binding in the honest but curious setting

• Any reliable (n, N, λ1, λ2)-DI code gives an honest-but-curious commitment protocol with binding error λ2.The argument bounds acceptance of a false commitment by the DI code's second error probability.Source: A. DI codes are binding in the honest… · p. 7

B. Soundness of the honest but curious BC codes

• Any reliable (n, N, λ1, λ2)-DI code gives an honest-but-curious commitment protocol with soundness error λ1.After honest behavior, rejecting the true commitment is the DI decoder's missed-identification error.Source: B. Soundness of the honest but curious… · p. 7

C. From DI to honest but curious commitment codes

• A reliable DI code with positive linearithmic rate transfers that same rate to commitment, yielding an AWGN honest-but-curious capacity lower bound of 1/2.The construction combines binding and soundness with the protocol's concealment condition.Source: C. From DI to honest but curious… · p. 7

• A modification of the single-layer DI codes in, uses geometric codeword structure and projective decoders to construct commitment codes.The codewords have minimum angular separation on the input ball, and each decoder uses a projection test.Source: §V · p. 8
• The reliable single-layer DI construction achieves linearithmic rate 1/4 with λ = 2Φ(−log n).The passage describes correct acceptance of a tested word with high probability and rejection of a different tested word with high probability.Source: §V · p. 8
• Basic DI reliability supports commitment soundness, but fully dishonest binding requires a stronger notion and a modified code.The modified DI code and resulting commitment rates are analyzed later in the section.Source: §V · p. 8

• After honest behavior, the probability of rejecting the true commitment is the DI code's missed-identification error.The other protocol components are noiseless and deterministic, so they do not affect correctness.Source: A. Projection-based DI codes are sound… · p. 8
• The true commitment is accepted with probability at least 1 − λ1.For the projection-based code, missed identification does not depend on the minimum angular separation θ.Source: A. Projection-based DI codes are sound… · p. 8
• The proposed single-layer DI commitment protocol is ϵs-sound with ϵs = 2Φ(−log n) in the general dishonest setting.Source: A. Projection-based DI codes are sound… · p. 8

B. About bindingness in the dishonest scenario

• In the fully dishonest setting, a sender could exploit overlapping acceptance slabs by sending a non-codeword input that both tests accept.The sender could then reveal either of two commitments after the receiver observes the channel output.Source: B. About bindingness in the dishonest… · pp. 8–9
• A binding DI code has no input sequence that can be reliably accepted by two different tests.This property extends the DI code's protection to sender inputs that are not codewords.Source: B. About bindingness in the dishonest… · p. 8
• Increasing codeword angles shifts slab overlaps away from the sphere center, requiring more power for cheating inputs without changing soundness error or leading-order code size.The construction aims to place every cheating sequence outside the available input region.Source: B. About bindingness in the dishonest… · p. 9
• For the proposed cheating sequence, the probability that either test accepts vanishes, and choosing a different input cannot improve both tests simultaneously.Moving closer to one codeword increases projected distance to the other, while using less than maximum power increases distance to the codewords.Source: B. About bindingness in the dishonest… · p. 10
• The modified DI code yields an εb-binding commitment protocol with εb = 2Φ(−log n).The authors establish bindingness by ruling out any input sequence that can be reliably accepted by two different tests.Source: B. About bindingness in the dishonest… · pp. 8, 10

C. From a binding DI code to a dishonest commitment code

• The binding DI code’s size is bounded using a spherical packing of codewords on a sphere of radius √(nP).The codewords have a minimum angular separation.Source: C. From a binding DI code to a… · p. 10
• The dishonest commitment code achieves a linearithmic rate of 1/4.The binding DI code also achieves a linearithmic rate of 1/4.Source: C. From a binding DI code to a… · p. 11
• The constructed dishonest commitment code is reliable because its concealment, bindingness, and soundness errors vanish as n grows.The argument combines the error calculations for concealment, bindingness, and soundness.Source: C. From a binding DI code to a… · p. 11

VI. PREVIOUS BC CONSTRUCTIONS ARE BASED ON DI

• Earlier AWGN commitment constructions, can be viewed as typicality-based DI codes, which achieve a linearithmic rate of 1/4.The authors describe these as suboptimal relative to projection-based DI codes.Source: §VI · p. 11
• Projection-based codes established the AWGN DI rate of 1/2, closing the gap left by typicality-based codes’ rate of at most 1/4.The passage also notes more recent projective-code work, preceding that result.Source: §VI · p. 11
• The hidden typicality-based commitment construction in achieves a linearithmic commitment rate of 1/4.The passage identifies this as a rate derived from the earlier construction.Source: §VI · p. 11
• Projection-based DI codes achieve a rate of 1/2, and the paper uses them to establish an honest-but-curious commitment lower bound of 1/2.The authors choose this approach for the commitment results, citing its rate and simplicity.Source: §VI · p. 11

VII. DISCUSSION AND CONCLUSIONS

• A DI code becomes suitable for commitment by adding bindingness, preventing one input sequence from being reliably accepted by multiple identification tests.This connection is presented as a way for commitment schemes to inherit DI codes’ asymptotic properties.Source: §VII · p. 11
• The construction achieves linearithmic commitment rates of 1/2 in the honest-but-curious setting and at least 1/4 in the dishonest setting.The honest-but-curious rate lower-bounds the linearithmic commitment capacity; the dishonest construction achieves half that rate.Source: §VII · pp. 11–12
• The achievable linearithmic rate is governed by a universal constant traced to DI construction and the geometry of output distributions, rather than channel power and noise parameters.The paper relates the honest-but-curious commitment rate to the linearithmic DI capacity of 1/2.Source: §VII · p. 12
• Bindingness and soundness errors vanish sub-exponentially, while requiring exponential decay would eliminate linearithmic scaling; hashing-based concealment error vanishes super-exponentially.The stated exponential-error trade-off applies to bindingness and soundness, not concealment,,.Source: §VII · p. 12
• The protocol uses one-way noiseless communication totaling Θ(n log n) bits when using a 2-universal hash family of size 2^O(k).The commit phase sends z_r and the hash-function description; the reveal phase sends w_k.Source: §VII · p. 12
• The authors expect the commitment–DI connection to extend beyond AWGN; adapted capacity-achieving DI codes are known for other continuous channels.They identify these constructions as a natural next step,.Source: §VII · p. 12
• For DMCs, the authors ask whether commitment can be constructed from DI codes despite their capacities depending on different quantities: input entropy for DI and channel equivocation for BC.Both settings have linear rather than linearithmic scaling, and the two quantities are generally different though related.Source: §VII · p. 12
• Tracing the earlier infinite linear-scale AWGN commitment construction reveals that it also relies on a DI code, resembling initial AWGN DI constructions,.The authors take this as support for a potentially more fundamental connection between DI and commitment.Source: §VII · p. 12