, ▁it ▁is ▁unlikely ▁that ▁F ▁will ▁open ▁to ▁m , ▁unless ▁S ▁can ▁extract ▁m ▁from ▁the ▁messages ▁it ▁received ▁from ▁the ▁environment ▁before ▁R ▁outputs ▁the ▁rece ipt . ▁ ▁However ▁a ▁protocol ▁that ▁is ▁extract able ▁in ▁this ▁sense ▁cannot ▁be ▁statist ically ▁hiding . ▁Suppose ▁such ▁a ▁sim ulator ▁S ▁exists . ▁Now ▁consider ▁an ▁environment ▁that , ▁instead ▁of ▁cor rupt ing ▁C , ▁cor rupt s ▁R ▁instead . ▁Additionally ▁it ▁runs ▁a ▁copy ▁of ▁S . ▁Mess ages ▁received ▁from ▁C ▁are ▁fed ▁into ▁S , ▁and ▁rep lies ▁from ▁S ▁are ▁forward ed ▁to ▁C . ▁ ▁The ▁environment ▁initially ▁tells ▁C ▁to ▁commit ▁to ▁a ▁message ▁m . ▁At ▁some ▁point ▁in ▁the ▁interaction , ▁S ▁will ▁commit ▁to ▁a ▁value ▁m ; ▁this ▁message ▁is ▁handed ▁to ▁R , ▁who ▁outputs ▁m '' '. ▁Note ▁that ▁by ▁assumption ▁we ▁have ▁m ' ▁= ▁m ▁with ▁high ▁probability . ▁Now ▁in ▁the ▁ideal ▁process ▁the ▁sim ulator ▁has ▁to ▁come ▁up ▁with ▁m . ▁But ▁this ▁is ▁impossible , ▁because ▁at ▁this ▁point ▁the ▁commit ment ▁has ▁not ▁been ▁opened ▁yet , ▁so ▁the ▁only ▁message ▁R ▁can ▁have ▁received ▁in ▁the ▁ideal ▁process ▁is ▁a ▁" rece ipt " ▁message . ▁We ▁thus ▁have ▁a ▁contradiction . ▁ ▁Const ruction ▁ ▁A ▁commit ment ▁scheme ▁can ▁either ▁be ▁perfectly ▁binding ▁( it ▁is ▁impossible ▁for ▁Alice ▁to ▁alter ▁her ▁commit ment ▁after ▁she ▁has ▁made ▁it , ▁even ▁if ▁she ▁has ▁un bounded