Commitment Schemes

Imagine flipping a coin over the phone. You call heads, your friend flips, and… how do you know they didn't just say you lost? There is no shared coin, only two people who don't fully trust each other.

A commitment scheme is the cryptographic fix: a digital sealed envelope. You write your value down, seal it, and hand over the envelope. The other side can hold it but can't read it (hiding). Later you open it — and you can't have swapped the paper inside (binding). Two promises that sound contradictory, kept at the same time.

With that one gadget, strangers can flip coins fairly, bid in sealed auctions, and prove they know a secret without revealing it. It is one of the quiet building blocks under almost every modern cryptographic protocol.

Play both roles. Pick a value and a random secret, then Commit — the demo hashes them together into a single fingerprint and shows only that. The value stays hidden, but you can no longer change it.

<p class="hint">{{hint}}</p>
<div class="row">
  <label>{{lbl_value}} <input id="value" value="HEADS"></label>
  <label>{{lbl_secret}} <input id="secret" value="r4nd0m"></label>
  <button id="gen" type="button" class="ghost">{{btn_new_secret}}</button>
</div>
<div class="btns">
  <button id="commit" type="button">{{btn_commit}}</button>
  <button id="reveal" type="button" disabled>{{btn_reveal}}</button>
  <button id="cheat" type="button" class="ghost" disabled>{{btn_cheat}}</button>
</div>
<div class="env" id="env">{{no_commitment}}</div>
<div class="status" id="status"></div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; }
.hint { font-size: .9rem; color: #444; margin: 0 0 .7rem; line-height: 1.45; }
.row { display: flex; gap: .6rem; flex-wrap: wrap; align-items: end; margin-bottom: .6rem; }
label { font: 600 .8rem system-ui, sans-serif; color: #1d3557; display: flex; flex-direction: column; gap: .2rem; }
input { font: 500 14px ui-monospace, monospace; padding: .4rem .5rem; border: 1px solid #cdd9e3; border-radius: 8px; width: 9rem; }
.btns { display: flex; gap: .5rem; flex-wrap: wrap; margin: .3rem 0 .6rem; }
button { font: 600 14px system-ui, sans-serif; padding: .45rem .9rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 8px; cursor: pointer; }
button.ghost { background: #fff; color: #1d3557; }
button:disabled { opacity: .4; cursor: not-allowed; }
.env { background: #e8eef3; border: 1px dashed #adb1b8; border-radius: 10px; padding: .7rem .9rem;
       font: 600 13px ui-monospace, monospace; color: #1d3557; word-break: break-all; line-height: 1.5; }
.status { font-size: 1rem; font-weight: 600; margin: .6rem 0; min-height: 1.4em; line-height: 1.4; }
.status.ok { color: #0a7d33; }
.status.bad { color: #c92f3c; }

// Code not found

Now Reveal: send the original value and secret. Anyone can re-hash them and check they match the published commitment. Try the Try to cheat button — change the value after committing, and the verifier instantly rejects it, because no other input produces the same fingerprint. That is hiding and binding working together, exactly as in the cross-linked zero-knowledge proofs.

How hard is it to build a sealed envelope that really works? The status here is solved, and well-understood.

• The two goals fight each other. Hiding says the commitment leaks nothing about the value; binding says you can open it only one way. You cannot have both perfectly at once — if the commitment perfectly hides the value, some other value must also fit it, so binding can only be computational, and vice versa.
• They exist exactly when one-way functions do. Moni Naor (1991) showed that secure bit commitment can be built from any pseudorandom generator — and hence from any one-way function, the weakest assumption in cryptography. No one-way functions, no commitments.
• Security rests on hardness, not impossibility. A hash-based commitment is binding because finding a hash collision is believed intractable. Break that hardness — by reversing the function or finding collisions — and you break the envelope.
• It is not a Millennium problem. Unlike P vs NP, the construction question is settled. What stays open is the grander question of whether one-way functions exist at all — which would follow from, and is tied to, P ≠ NP.

So the sealed envelope is not magic: it is a clean reduction. Its safety is exactly as solid as the one-way function underneath it.

"Decide now, reveal later, cheat at neither" turns out to be the shape of a huge number of real protocols:

• Fair coin flipping and games: two distrustful parties each commit to a bit, then reveal and XOR them — neither can bias the result.
• Sealed-bid auctions and elections: bidders or voters commit first so no one can adjust their choice after seeing others, then everyone opens at once.
• Zero-knowledge proofs: the prover commits to intermediate values and selectively reveals them, the core trick behind zero-knowledge proofs and modern privacy tech.
• Blockchains and randomness beacons: commit-reveal schemes generate unbiased shared randomness and prevent front-running of transactions.

Wherever two sides must act in the right order without trusting each other, a commitment scheme is usually hiding underneath.

A commitment scheme keeps two promises that sound impossible together: it tells you nothing about the value, yet pins the committer to exactly one. The trick is to lean on a one-way function — easy to compute, believed hard to reverse — so cheating is not forbidden by logic, only by intractability.

That modest gadget is everywhere: coin flips, auctions, votes, blockchains, and the heart of zero-knowledge proofs. The next time you need two strangers to play fair, remember the sealed envelope — and that its strength is borrowed, in the end, from problems we believe no one can solve quickly.