, ▁or ▁send ▁the ▁opposite ▁answer ▁and ▁Y '. ▁However , ▁G ( Y ) ▁and ▁G ( Y ) ▁are ▁only ▁able ▁to ▁produce ▁ 2 n ▁possible ▁values ▁each ▁( that ' s ▁ 2 2 n ) ▁while ▁R ▁is ▁picked ▁out ▁of ▁ 2 3 n ▁values . ▁She ▁does ▁not ▁pick ▁R , ▁so ▁there ▁is ▁a ▁ 2 2 n / 2 3 n ▁= ▁ 2 − n ▁probability ▁that ▁a ▁Y ' ▁satisfying ▁the ▁equation ▁required ▁to ▁che at ▁will ▁exist . ▁ ▁The ▁conce aling ▁property ▁follows ▁from ▁a ▁standard ▁reduction , ▁if ▁Bob ▁can ▁tell ▁whether ▁Alice ▁committed ▁to ▁a ▁zero ▁or ▁one , ▁he ▁can ▁also ▁distinguish ▁the ▁output ▁of ▁the ▁pseudo - random ▁generator ▁G ▁from ▁true - random , ▁which ▁contradict s ▁the ▁crypt ographic ▁security ▁of ▁G . ▁ ▁A ▁perfectly ▁binding ▁scheme ▁based ▁on ▁the ▁discrete ▁log ▁problem ▁and ▁beyond ▁ ▁Alice ▁cho oses ▁a ▁group ▁of ▁prime ▁order ▁p , ▁with ▁generator ▁g . ▁ ▁Alice ▁randomly ▁pick s ▁a ▁secret ▁value ▁x ▁from ▁ 0 ▁to ▁p   −   1 ▁to ▁commit ▁to ▁and ▁calcul ates ▁c ▁= ▁g x ▁and ▁publish es ▁c . ▁The ▁discrete ▁log arith m ▁problem ▁dict ates ▁that ▁from ▁c , ▁it ▁is ▁computation ally ▁in fe as ible ▁to ▁compute ▁x , ▁so ▁under ▁this ▁assumption , ▁Bob ▁cannot ▁compute ▁x . ▁On ▁the ▁other ▁hand , ▁Alice ▁cannot ▁compute ▁a ▁x ' ▁<> ▁x , ▁such ▁that