Commitments — Building Block

A commitment scheme lets you "lock in" a value without revealing it, then later "open" it.

Two properties:

1. Hiding: commitment leaks nothing about the value.
2. Binding: you can only open to one value.

Simplest: commit(x) = hash(x || r) for random r.

• Hiding (if r is unpredictable, hash output is indistinguishable from random).
• Binding (collision resistance: can't find x' with same hash unless you find a collision).

To open: send (x, r). Verifier checks hash(x || r) == commitment.

Used in:

• Sealed-bid auctions (commit your bid, reveal at the end).
• Coin flips over the phone.
• Foundation of every ZK protocol.

Pedersen commitment (homomorphic): C = g^x * h^r over an EC group.

• Two generators g, h with unknown discrete log relationship.
• Hiding (perfect): given commitment C, ANY x has SOME r making C valid → no info leaks.
• Binding (computational): finding two openings = solving DLP.

The magic: C(x1) * C(x2) = C(x1 + x2). Adding commitments adds the underlying values. Critical for confidential transactions and bulletproofs.

Most ZK systems are built on Pedersen-like commitments + sigma protocols + Fiat-Shamir.