New answers tagged commitments
There is one subtle problem with your proposed protocol: unless $f$ is restricted to commutative functions, the lottery can choose to reveal one of two values. Here's how he does it: the lottery selects $p1$ and $p2$ as per the protocol, and publishes $p1\times p2, f$. However, when it comes time to reveal the committed value, and the lottery sees that the ...
You could use HMAC for this. HMAC is available in pretty much every crypto library out there. The process would work like this. Randomly pick A and C. For simplicity, let's assume they are strings (of any length). Compute $B=HMAC(A,C)$. Publish $B$. Once someone guesses $A$, you publish $C$. Anyone can then verify that $B=HMAC(A,C)$. As long as a good hash ...
The commitment is the receiver's output from the protocol's initial phase, and the opening value is a witness that the commitment is to whatever it's to. The 'Binding' and 'Hiding' properties are defined w.r.t. the commitment scheme.
Top 50 recent answers are included