Commitment Scheme

The hiding property ensures the commitment reveals no information about the underlying value. An adversary cannot distinguish between commitments to two different values, even if they choose the values themselves. This is achieved through computational hiding (secure against polynomial-time adversaries) or statistical hiding (secure against unbounded adversaries).

• Pedersen Commitments offer statistical hiding based on the discrete logarithm problem
• Hash-based commitments provide computational hiding via preimage resistance
• Essential for sealed-bid auctions and private voting systems

The binding property prevents the committer from opening the commitment to a different value than the one originally committed. Once a commitment is published, the committer is bound to the original value.

• Computational binding: Secure against polynomial-time adversaries (Pedersen commitments)
• Statistical binding: Secure against unbounded adversaries (hash-based commitments)
• Violation would allow double-spending in cryptocurrencies or cheating in verifiable games
• No scheme can simultaneously achieve both statistical hiding and statistical binding

A two-phase protocol fundamental to blockchain systems and decentralized applications:

Phase 1 — Commit: The sender publishes C = Commit(v, r) where v is the value and r is a random nonce (blinding factor). The commitment C is broadcast to all parties.

Phase 2 — Reveal: The sender publishes (v, r). Any verifier can recompute Commit(v, r) and check it matches C.

• Prevents front-running in decentralized exchanges
• Enables fair lotteries and random beacon generation
• Used in Submarine Swaps and Lightning Network atomic swaps

A homomorphic commitment scheme widely used in privacy-preserving protocols. Given generators g and h of a cyclic group where the discrete log relation is unknown:

C = g^v · h^r

Key properties:

• Statistically hiding: h^r perfectly masks the value v
• Computationally binding: Breaking binding requires solving the discrete logarithm problem
• Additively homomorphic: Commit(v1, r1) · Commit(v2, r2) = Commit(v1+v2, r1+r2)

Used in Confidential Transactions (Monero, Elements), Bulletproofs, and zk-SNARK constructions.

A commitment to an ordered sequence of values (v₁, v₂, ..., vₙ) that allows opening individual positions without revealing the entire vector. The proof size is sublinear or constant relative to the vector length.

• Merkle Trees: The classic vector commitment with O(log n) proofs
• KZG Commitments: Constant-size proofs using polynomial commitments and bilinear pairings
• Verkle Trees: Combine vector commitments with tree structures for efficient stateless clients

Critical for Ethereum's Verge upgrade, stateless blockchains, and verifiable databases.

A generalization allowing the committer to prove evaluations of a function on the committed data without revealing the data itself.

Types:

• Polynomial Commitments: Commit to a polynomial and prove P(x) = y at any point
• Inner Product Commitments: Prove the inner product of two committed vectors
• Lookup Commitments: Prove a committed value exists in a committed table

These form the cryptographic backbone of modern zk-SNARK proving systems including Plonk, Halo2, and Marlin, enabling succinct verifiable computation.