F-eqv — Equivocal, adaptively secure commitment

F-eqv (Equivocal, adaptively secure commitment) is part of Commitments and Proofs in the UC functionality encyclopedia. Status: a canonical, well-established UC functionality.

No functionality is printed under this name, and the reason is structural rather than accidental: equivocability is a property of a scheme, not an object a functionality can describe. A commitment functionality hides the committed value and binds the committer; there is no interface at which it could “equivocate”, because it stores the value directly and has no ciphertext to reinterpret. Equivocability is what the simulator does when it has to open a commitment it made before learning the value — and simulators are not functionalities.

So the box a reader wants here is F-COM, or F-MCOM for the multi-commitment case. Equivocability is one of the two properties a scheme must have to realize either of them against an adaptive adversary.

Why there is no box

The harvest, and what it found. scripts/uc_source.py resolved both references on this page. Canetti and Fischlin’s Universally Composable Commitments prints four functionalities — the common reference string, the ideal commitment functionality for a single commitment, the ideal commitment functionality for multiple commitments, and the zero-knowledge functionality \(\mathcal{F}_{\mathsf{zk}}\) — and no \(\mathcal{F}_{\mathsf{eqv}}\). Two of those four are already written up on this site from that very paper. Beaver’s Adaptive zero-knowledge and computational equivocation predates the UC framework and prints no ideal functionality at all, which is the expected result for a citation naming the origin of a technique.

And this is not an extraction failure. The five false-negative modes this encyclopedia has recorded are all mechanical — a name set with a diacritic, a page id naming two functionalities, glyphs that do not survive the text layer, a box printed in a paper the page does not cite, and a definition given as a numbered environment rather than a figure. None applies: the paper’s four boxes were found, read, and two of them transcribed.

A forward search does not change the answer. The literature treats equivocability and extractability together, as the pair of scheme properties that UC commitment demands — “UC commitment schemes require equivocability and extractability at the same time”, and constructions are described as compilers that take a straight-line extractable commitment and produce one that is “extractable and equivocal, therefore yielding UC-security”. That is consistently a statement about schemes realizing \(\mathcal{F}_{\mathsf{com}}\), never about a separate ideal functionality.

What the closest printed things are

  • F-COM and F-MCOM, both written from Canetti–Fischlin. Realizing either against an adaptive adversary is exactly what “equivocal, adaptively secure commitment” names, and the adaptivity is a property of the realization rather than a line in the box.
  • The impossibility that makes this interesting. Canetti and Fischlin show that UC commitment is unrealizable in the plain model between committer and receiver alone; a setup such as F-CRS is required. Equivocability is how the simulator uses that setup — it holds a trapdoor the real committer does not, and the trapdoor is what lets it open both ways.

What would resolve this

Either finding a paper that prints a functionality under this name — in which case this page becomes an ordinary entry, and the finding is worth recording — or retiring the slot and folding its content into F-COM as a note on adaptive security. The second is the more likely outcome, and this page is written so that the decision is informed rather than silent.

Formal artifacts

No machine-checked formalization yet.

References:

  • Canetti and Fischlin. Universally composable commitments. In Advances in Cryptology – CRYPTO 2001, volume 2139 of LNCS, pages 19–40, 2001. Read at ePrint revision 20010710:161305, the only posting. Prints the common reference string functionality, the single- and multi-commitment functionalities, and \(\mathcal{F}_{\mathsf{zk}}\); no \(\mathcal{F}_{\mathsf{eqv}}\).
  • Beaver. Adaptive zero-knowledge and computational equivocation. In 28th ACM Symposium on Theory of Computing (STOC), 1996. The origin of the equivocation technique, five years before the UC framework; prints no ideal functionality. The harvester could not fetch it — there is no open PDF at that DOI — so the “no box” claim for this reference rests on the paper’s date and subject rather than on a scan, and is marked as such: [UNVERIFIED: not machine-read; ACM DOI is paywalled].