commitreveal

Commit-reveal is a two-phase protocol used in cryptography and distributed systems to allow a party to commit to a value without revealing it, and later reveal the value to prove what was committed. In a typical setup, the committer chooses a value m and some randomness r, computes a commitment C = Commit(m, r) (often a cryptographic hash like C = H(m || r) or a dedicated commitment scheme), and publishes C. In the reveal phase, the committer discloses (m, r). Any verifier recomputes Commit(m, r) and checks that it matches C. If so, the reveal is valid.

Two core properties characterize a commitment scheme used in commit-reveal: hiding and binding. Hiding means the commitment conveys no information about m (or r) until the reveal. Binding means the committer cannot open the same commitment to two different values after the fact. Some schemes achieve different security guarantees based on whether they are computationally binding or information-theoretically binding, and whether hiding is unconditional or computational.

Variants range from non-interactive schemes (where a single message suffices) to interactive protocols that involve multiple rounds. Commit-reveal is widely used in sealed-bid auctions, online voting, randomness beacons, and many blockchain protocols to avoid front-running or premature disclosure of sensitive inputs. It also appears in privacy-preserving multi-party computations and verifiable delay functions.

A simple example is a sealed-bid auction: bidders compute C = H(bid || nonce) and publish C. Later, they reveal (bid, nonce); others verify that H(bid || nonce) equals C. Potential limitations include reliance on the strength of the commitment function, the need to enforce timely reveals, and handling parties that refuse to reveal or that refuse to participate honestly.