Commitment Scheme

A commitment scheme is a two-phase cryptographic protocol consisting of a commit phase and a reveal phase. In the commit phase, a party (the committer) generates a commitment, which is a cryptographic hash or encrypted value that binds them to a secret message m without revealing it. This commitment is sent to one or more verifiers. The scheme provides two essential security properties: hiding, which ensures the commitment reveals no information about m, and binding, which prevents the committer from later revealing a different message m' that matches the same commitment.

These schemes are foundational to numerous blockchain and cryptographic applications. For instance, they are the core mechanism behind Merkle trees, where leaf node data is committed in a root hash. They enable zero-knowledge proofs by allowing a prover to commit to a witness before the proof protocol begins. In blockchain consensus, they are used in verifiable random functions (VRFs) for leader election and in protocols like Ouroboros for electing slot leaders secretly. The classic hash-based commitment uses a cryptographic hash function H and a random nonce r, where the commitment is C = H(r, m).

Beyond simple hashing, more advanced constructions like Pedersen commitments and Kate-Zaverucha-Goldberg (KZG) polynomial commitments offer additional properties. Pedersen commitments provide information-theoretic hiding and are additively homomorphic, meaning the commitment to the sum of two messages equals the sum of their individual commitments—a feature used in confidential transactions. KZG commitments, central to Ethereum's proto-danksharding, allow for efficient proofs about polynomial evaluations, forming the basis for KZG commitments in data availability sampling.

The security and efficiency trade-offs between different commitment schemes are critical for system design. Hash-based schemes are computationally binding and hiding, relying on the collision-resistance and pre-image resistance of the hash function. Pedersen commitments are unconditionally hiding but computationally binding, depending on the discrete logarithm problem. The choice impacts system trust assumptions, proof sizes, and verification speed. For example, a vector commitment scheme allows committing to an ordered list of values and later proving a specific element at position i, which is essential for stateless blockchain clients.

In practice, a developer might implement a commitment to a bid in an auction smart contract. The bidder sends a commitment commit(bid, salt) to the contract. After the bidding period closes, they reveal the original bid and salt. The contract verifies the reveal by recomputing the hash and checking it matches the stored commitment. This ensures bids remain secret until the reveal phase, preventing front-running. This pattern is directly analogous to how commit-reveal schemes work in blockchain transactions to conceal information like voting choices or random number generation inputs before they are needed for consensus.

A commitment scheme is a two-phase cryptographic protocol consisting of a commit phase and a reveal phase. In the commit phase, a sender (the committer) generates a commitment, which is a cryptographic hash or encrypted value that binds them to a secret message (e.g., a number, a bid, or a prediction) without disclosing it. This commitment is sent to a receiver. The scheme provides two essential security properties: hiding, which ensures the secret remains concealed until revealed, and binding, which prevents the committer from changing the secret after the commitment is made.

The core mechanism relies on a one-way function, typically a cryptographic hash like SHA-256. To commit to a value v, the committer often combines it with a randomly generated secret r (a nonce or salt) to create the commitment C = H(r, v). Sending only C hides v due to the preimage resistance of the hash. Later, during the reveal phase, the committer discloses both v and r. The receiver can then recompute H(r, v) and verify it matches the original commitment C, proving the committer did not alter the value.

These schemes are foundational for building more complex protocols that require fairness and secrecy in environments without trust. Key applications include zero-knowledge proofs (ZKPs), where commitments hide intermediate values in a computation; secure voting systems, to prevent voters from changing their ballots; coin toss protocols over a network; and blockchain features like confidential transactions and verifiable random functions (VRFs). In blockchain, they are crucial for scalability solutions like rollups, where transaction data is committed to a main chain before being fully processed.

A commitment scheme is a cryptographic protocol that allows one party, the committer, to bind themselves to a chosen value (the message) without revealing it, and later reveal it in a way that is verifiably consistent with the initial commitment. This process is often described with the analogy of sealing a value in a locked box; the commitment phase is the sealing, and the reveal phase is the unlocking. The two essential properties that guarantee security are hiding, which ensures the secret value remains concealed until revealed, and binding, which prevents the committer from changing the value after the commitment is made.

The process begins with the commit phase. Here, the committer takes a secret message m and a random value r (the blinding factor). They compute a commitment string C = Commit(m, r) using a one-way function like a cryptographic hash (e.g., SHA-256). This commitment C is then published or sent to a verifier. At this point, C reveals no information about m (hiding), and the committer is now bound to the pair (m, r). They cannot later claim they committed to a different message m' without finding a collision for the hash function (binding).

Later, during the reveal phase, the committer discloses the original message m and the randomness r to the verifier. The verifier then recomputes the commitment using the same function: C' = Commit(m, r). If C' matches the originally published commitment C, the reveal is valid and consistent. This simple yet powerful verification proves the committer knew m at the time of the initial commitment without requiring them to disclose it prematurely. This mechanism is foundational for protocols requiring delayed disclosure, such as coin tosses, sealed-bid auctions, or advanced consensus algorithms.

In blockchain contexts, commitment schemes are ubiquitous. They are the engine behind Merkle trees, where leaf data is committed to in a root hash. Pedersen commitments and Polynomial commitments (like KZG) are more advanced schemes used in confidential transactions and zero-knowledge rollups (e.g., zk-SNARKs, zk-STARKs) to prove knowledge of large datasets without revealing the data itself. Here, the commitment phase allows a prover to compute a small, fixed-size proof, while the reveal and verify phase allows anyone to check the proof's validity against the public commitment.

Understanding this visualizeable lock-and-key process is crucial for grasping more complex cryptographic constructions. It transforms the abstract need for temporal secrecy and cryptographic binding into a concrete, executable protocol. Whether securing a simple bet or enabling the scalability of a Layer 2 network, the commitment scheme's two-phase dance of commit and reveal remains a fundamental pattern for building trustless and private interactions in decentralized systems.

A commitment scheme is a cryptographic primitive that allows one party to commit to a chosen value while keeping it hidden, with the ability to later reveal it. The process is executed in two distinct phases: the commit phase and the reveal phase. This ensures the binding property, meaning the committer cannot change the value after committing, and the hiding property, meaning the receiver learns nothing about the value until it is revealed. The following pseudocode outlines a simple commitment scheme using a cryptographic hash function like SHA-256, which is a common method for constructing a computationally hiding and binding commitment.

In the commit phase, the algorithm takes a secret value and a random nonce (or salt) to generate a commitment string. The pseudocode commitment = hash(secret + nonce) combines the secret and the random nonce before hashing. The resulting hash digest is the commitment, which is sent to the verifier. The committer must securely store the original secret and nonce pair. Crucially, because the hash function is preimage-resistant, the verifier cannot feasibly reverse the commitment to discover the secret, satisfying the hiding property. The use of the random nonce is essential to prevent brute-force attacks against low-entropy secrets.

The reveal phase occurs when the committer decides to disclose the original value. They send the previously hidden secret and nonce to the verifier. The verifier then independently recomputes the hash: computed_commitment = hash(received_secret + received_nonce). They compare this computed value to the original commitment they stored. If computed_commitment == stored_commitment, the reveal is valid, proving the committer revealed the exact value they originally committed to. This verification process enforces the binding property, as any attempt to reveal a different (secret, nonce) pair would result in a different hash, causing the verification to fail.

This simple hash-based commitment, while illustrative, has limitations. It is only computationally binding—relying on the collision resistance of the hash function—and computationally hiding. For stronger, perfectly hiding guarantees, more advanced schemes like Pedersen commitments are used, often employing discrete logarithms in cryptographic groups. Commitment schemes are foundational for zero-knowledge proofs, secure voting protocols, and blockchain applications like Merkle trees and verifiable random functions (VRFs), where a party must prove they selected a value in advance without revealing it prematurely.