As an amateur, my first encounter with commitments has been in the form of an hash of the committed value, then I have learnt about seeding the hash as blinding technique. Going on I have discovered how useful is the structure induced by Pedersen or El-Gamal commitments and the binding/hiding flavours. All of this to explain my current background.
Recently I have had a bird-eye view on KZG commitments, I have read that Bulletproofs is an Inner-Product-Argument commitment, and that FRI-based commitments use hashes.
So I'm a bit confused by the usage of term "commitments". The commit to secret data seems the recurring common step, but the revealing phase imho is really variegated:
- in seeded hashes and Pedersen/El-Gamal is a go/no-go choice (the prover can prove its honesty just revealing the data);
- KZG verifier can discover if the prover is honest just challenging it with a single point (so at most marginally affecting the data secrecy)
- Bulletproofs proves range membership of data without revealing it
- FRI: don't know yet but I guess they also have some "magic" beyond data revealing via opening
So KZG, IPA, FRI as commitments seem very different and more powerful than previous ones (not to mention they seem to require an "active" verifier in the revealing step)... so why the same name? Is it really just because of common initial commit to secret data or is there something more deep?
The comments by @knaccc have been illuminating, and I have got a latter confirm about our conclusion here: https://scroll.io/blog/kzg
[...] Now, with polynomial commitment schemes, the committer commits to a polynomial ϕ ϕ, rather than some arbitrary message m m. Polynomial commitment schemes satisfy the above-mentioned properties of normal commitment schemes, and also achieve an additional property: the committer should be able to “open” certain evaluations of the committed polynomial without revealing the entire thing. [...]