▁g x ' ▁= ▁c , ▁so ▁the ▁scheme ▁is ▁binding . ▁ ▁This ▁scheme ▁isn ' t ▁perfectly ▁conce aling ▁as ▁someone ▁could ▁find ▁the ▁commit ment ▁if ▁he ▁man ages ▁to ▁solve ▁the ▁discrete ▁log arith m ▁problem . ▁In ▁fact , ▁this ▁scheme ▁isn ' t ▁hiding ▁at ▁all ▁with ▁respect ▁to ▁the ▁standard ▁hiding ▁game , ▁where ▁an ▁advers ary ▁should ▁be ▁unable ▁to ▁guess ▁which ▁of ▁two ▁messages ▁he ▁chose ▁were ▁committed ▁to ▁- ▁similar ▁to ▁the ▁IN D - CP A ▁game . ▁One ▁consequence ▁of ▁this ▁is ▁that ▁if ▁the ▁space ▁of ▁possible ▁values ▁of ▁x ▁is ▁small , ▁then ▁an ▁attack er ▁could ▁simply ▁try ▁them ▁all ▁and ▁the ▁commit ment ▁would ▁not ▁be ▁hiding . ▁ ▁A ▁better ▁example ▁of ▁a ▁perfectly ▁binding ▁commit ment ▁scheme ▁is ▁one ▁where ▁the ▁commit ment ▁is ▁the ▁encryption ▁of ▁x ▁under ▁a ▁sem ant ically ▁secure , ▁public - key ▁encryption ▁scheme ▁with ▁perfect ▁comple ten ess , ▁and ▁the ▁de commit ment ▁is ▁the ▁string ▁of ▁random ▁bits ▁used ▁to ▁encrypt ▁x . ▁An ▁example ▁of ▁an ▁information - the oret ically ▁hiding ▁commit ment ▁scheme ▁is ▁the ▁Ped ers en ▁commit ment ▁scheme , ▁which ▁is ▁binding ▁under ▁the ▁discrete ▁log arith m ▁assumption . ▁Additionally ▁to ▁the ▁scheme ▁above , ▁it ▁uses ▁another ▁generator ▁h ▁of ▁the ▁prime ▁group ▁and ▁a ▁random ▁number ▁r . ▁The ▁commit ment ▁is ▁set ▁. ▁ ▁These ▁constru ctions ▁are ▁tight ly ▁related ▁to ▁and ▁ ▁based ▁on