I want to implement non-interactive Bit Commitment scheme for messages of arbitrary length.
And I am curious, what is the reason of using Pedersen Commitment scheme over Salted Hash (in other words HMAC).
Example is coin flipping protocol from Wikipedia:
- Alice "calls" the coin flip but only tells Bob a commitment to her call,
- Bob flips the coin and reports the result,
- Alice reveals what she committed to,
- Bob verifies that Alice's call matches her commitment,
- If Alice's revelation matches the coin result Bob reported, Alice wins
With HMAC Alice calculates a hash of her call at step 1 and reports it to Bob, keeps key (salt) in secret. During reveal step (3) she reveals a key.
With Pedersen Commitment scheme she reports her commitment at step 1, then reveals her call at step 3 with additional data, related to scheme.