Commitment Schemes in Cryptography Explained

Commitment schemes in cryptography are fundamental tools that allow one party to commit to a chosen value while keeping it hidden, and later reveal that value in a verifiable way. They act as cryptographic “sealed envelopes,” ensuring that the committer cannot change their mind after sealing, while the receiver cannot peek inside until the reveal. This simple yet powerful concept underpins everything from secure voting systems to zero-knowledge proofs in blockchain.

What Is a Commitment Scheme?

A commitment scheme is a two-phase cryptographic protocol between a sender (the committer) and a receiver (the verifier). In the commit phase, the sender chooses a value and produces a commitment (a short piece of data) that binds them to that value without revealing it. In the reveal phase, the sender opens the commitment by providing the original value and any necessary proof, allowing the receiver to verify that the value matches the earlier commitment.

Two core properties define every commitment scheme:

• Hiding: The commitment leaks no information about the underlying value. Even a computationally unbounded adversary (perfect hiding) or a reasonable attacker (computational hiding) cannot learn the value before the reveal.
• Binding: Once committed, the sender cannot produce a different value that would match the same commitment. The scheme prevents cheating—either perfectly (no possible alternate value) or computationally (finding an alternate value is infeasible).

For example, if Alice writes a number on a paper, seals it in an envelope, and gives it to Bob, Bob cannot see the number (hiding), and Alice cannot later change the paper (binding). The envelope is the commitment; tearing it open is the reveal.

How Commitment Schemes Maintain Binding & Hiding

A commitment scheme’s security depends on how it enforces both properties. Most practical schemes achieve one property perfectly and the other computationally.

Hash-Based Commitments (Simple but Powerful)

The simplest commitment scheme uses a cryptographic hash function. The sender:

1. Chooses a value v and a random nonce r (a secret random number).
2. Computes commitment c = H(v ‖ r), where H is a secure hash function like SHA-256.
3. Sends c to the receiver.

During reveal, the sender sends v and r; the receiver recomputes H(v ‖ r) and checks it matches c. This scheme is:

• Computationally hiding: Without the nonce, an attacker would need to brute-force the hash (infeasible for 256‑bit hashes).
• Computationally binding: Finding a different (v', r') that yields the same hash requires breaking collision resistance.

Pedersen Commitments (Perfectly Hiding, Computationally Binding)

Pedersen commitments use elliptic curve cryptography. The commitment is c = g^v · h^r, where g and h are independent generators of a group. Here:

• Perfect hiding: Even with infinite computing power, the receiver cannot learn v from c because r adds a random blinding factor.
• Computationally binding: The sender cannot find a different (v', r') that produces the same c unless they break the discrete logarithm problem.

The trade‑off is speed: hash‑based commitments are faster for basic uses, while Pedersen is preferred in advanced protocols like zero‑knowledge proofs where perfect hiding is critical.

Property	Hash‑Based Commitment	Pedersen Commitment
Hiding	Computational	Perfect
Binding	Computational	Computational
Speed	Very fast	Moderate (group operations)
Typical use	Simple betting, random beacons	ZK‑proofs, anonymous voting

Practical Commitment Scheme: Coin Toss over a Network

Two strangers, Alice and Bob, want to flip a fair coin over the internet without trusting a third party. A commitment scheme solves this elegantly.

1. Alice commits to a random bit b (0 or 1) using a hash commitment. She generates a nonce r, computes c = H(b ‖ r), and sends c to Bob.
2. Bob guesses the parity of the sum of their bits. But since Alice hasn’t revealed yet, Bob sends his own guess (say “heads” or “tails”) without knowing Alice’s bit.
3. Alice reveals her bit b and the nonce r. Bob verifies c matches. The final result is determined by the XOR of Alice’s bit and Bob’s guess (or any agreed function).

Without the commitment scheme, either party could cheat. Alice might wait to see Bob’s guess before choosing her bit, or Bob might change his guess after seeing Alice’s bit. The commitment forces Alice to lock in her bit before Bob guesses, and the reveal ensures Bob cannot dispute what Alice committed to.

Commitment Schemes in Blockchain & Crypto

Blockchain systems rely on commitment schemes for trustless interactions. Here are key applications:

• Zero‑Knowledge Rollups (ZK‑Rollups): The sequencer commits to a batch of transactions using a Merkle tree (a form of commitment). Later, a zero‑knowledge proof verifies the batch without revealing individual transactions. The commitment (Merkle root) is posted on‑chain.
• Cryptographic Auctions: Bidders commit their sealed bids using hash commitments. At reveal, only the highest bid is opened, preserving privacy for losing bidders. This prevents last‑minute bid sniping.
• Lottery & Randomness Generation: Projects like Chainlink VRF use commitment schemes where a user commits to a seed, then a decentralized oracle reveals it. The commitment guarantees the seed cannot be changed after seeing the output.
• Atomic Swaps: Parties commit to asset transfers. If one party cheats, the commitment’s binding property ensures they lose collateral (hash time‑locked contracts).

Why Merkle Trees Are Commitments

A Merkle tree is a hash‑based commitment to a list of data items. The root hash commits to the entire list. To prove an item is included, you provide a Merkle proof (a path of sibling hashes) without revealing other items. This is a compact, efficient commitment scheme used in Bitcoin and Ethereum block headers.

Why Commitment Schemes Matter for Security

Commitment schemes are the backbone of fairness and privacy in decentralized systems. Without them:

• A party could change its mind after seeing others’ moves (the late‑comer advantage).
• Private information could be leaked before it’s safe to reveal.
• Trusted third parties would be required to hold secrets—defeating blockchain’s trustless promise.

By separating the promise from the reveal, commitment schemes enable multi‑step protocols where participants act in sequence without fear of manipulation. They are a foundational primitive in cryptographic game theory, ensuring that rational actors cannot profit from dishonesty.

Conclusion

Commitment schemes in cryptography are elegant tools that let you “lock in” a secret value without revealing it, then prove your honesty later. From hash‑based commitments for simple coin flips to Pedersen commitments in zero‑knowledge proofs, they guarantee hiding and binding properties that make blockchain applications secure and fair. Understanding how a commitment scheme works is essential for anyone delving into cryptographic protocols—it’s the glue that keeps decentralized games, auctions, and rollups trustless.