# The rigorous proof in the commitment based on CRHF

I'm reading about the lecture of Yevgeniy Dodis. In his lecture 14, section 2.3.2, gives a commitment construction based on CRHF, but the proof of hiding is high-level. I want to know the rigorous proof that why even subject to $$u(x)=m$$, the still leaves distribution of $$u$$ look almost uniform to the adversary independent of $$m$$.

Thanks for any help, hint or reference.

What's more, if we change the construction in the picture. Let $$c=(u,h(x),u(x)\oplus m)$$, where $$u$$ is uniformly distributed over $$\mathcal{U}$$ and the other things are same. Then, we can use the leftover hash lemma to proof hiding. And the binding is still based on CRHF.

At a high level, they show that: given messages $$m_1, m_2$$; Define $$C(m) = (u ,y)$$ being the random variable corresponding to producing a commitment on $$m$$ (the scheme is randomized); and $$y = h(x)$$. Furthermore, the statistical distance between $$C(m_1)$$ and $$C(m_2)$$ defined as $$\Delta(C; m_1, m2) = \sum_{u,y}|\Pr[C(m_1) = (u,y)] - \Pr[C(m_2) = (u, y)]| \leq 2^k.$$ The argument is a bit technical and well described in the paper. But it boils down to: although $$u(x) = m$$, the distribution on $$u$$ with this constraint is statistically close to the distribution induced for a different $$m'$$. Therefore, reveals very little information on the message.