THE COMMITMENT — a dart

THE COMMITMENT seal your answer now, reveal it later — binding and hiding at once

A commitment scheme is a cryptographic sealed envelope. You publish c = H(m, r) — a hash of your message with a random nonce — and it does two opposing things at once: it hides m (c leaks nothing about it) yet it binds you (you cannot later find a different m’ that also hashes to c). Later you reveal (m, r) and anyone recomputes the hash to check. It is how you play poker over the phone, run fair coin-flips, and build zero-knowledge proofs — promise first, prove honesty after.

THE TECHNIQUE c = H(m, r) — hiding (reveals nothing) + binding (can’t change m)

The demo commits to message 42 with a nonce, verifies the reveal, and shows a different message gives a different commitment (binding): live demo

HISTORY & CREDIT commitment schemes (Blum) · 1981

“You must show your move to prove you didn’t change it.” — commit to its hash first; reveal later; the hash both hides and binds. cited

hiding · c = H(m, r) with random r — the commitment reveals nothing about m.
binding · collision-resistance means no m’ ≠ m gives the same c — you are stuck with your answer.
1981 · Manuel Blum — “coin flipping by telephone”; the base of zero-knowledge and fair protocols.

A promise you cannot see into and cannot take back — two opposite guarantees carried in one hash. binding+hiding

RECOMMEND FOR I-13 commit and bind, on the compiler

On the canonical compiler, committing to 42 gives c=98552; the reveal verifies, and committing to 43 gives a different c (binding):

$ i13 run zd_commitment.i13 # c = H(m, r) RUN OK · 62 step(s) · peak stack 3 · call depth 1 c = 98552 -- commitment to m=42 verify = 1 -- reveal (42, r) recomputes c c_other = 98683 -- commit to 43 binding = 1 -- different message -> different commitment

Recommend as a NULL — two properties, both recognizer-side. A commitment carries hiding and binding together, which is tempting as “extra output-structure.” But both are hardness/verification properties (B41): hiding is what an adversary cannot learn, binding is what a verifier would catch — statements about recognizing, not about generating a new output invariant, and both rest on the hash being one-way/collision-resistant. i13 grounds the mechanics (verify, binding). NULL — the primitive under zero-knowledge, but a witness at heart.