# Proving a commitment hides the value hidden in an encrypted puzzle

I am making a protocol that has one missing piece. It involves 2 non-trusted party $$A$$ and $$B$$ and a semihonest third party $$C$$. This protocol has a contingency step where if $$A$$ leaves prematurely, $$B$$ is supposed receive time locked puzzle. It is important that $$B$$ cannot get the puzzle early. The puzzle ensures that after a period of time, $$B$$ will get a value he is supposed to get, but not immediately. Neither $$A$$ nor $$B$$ want $$C$$ to be able to learn the value hidden in the puzzle (therefore $$C$$ can't have the puzzle), and $$B$$ shouldn't be able to start working on the puzzle until $$A$$ leaves and $$C$$ reveals the puzzle. $$A$$ also needs to prove to $$B$$ that the value hidden in the puzzle matches a commitment (preferably Pedersen) at the beginning of the protocol. Note that once $$A$$ leaves, $$C$$ wishes to leave almost immediately (for important structural reasons), so it can't just be an encryption to which $$C$$ holds the key and $$C$$ gives it to $$B$$.

My question is does such a system currently exist? This system being as follows: $$A$$ creates a time locked puzzle that cannot be worked on by $$B$$ until a value is released while still proving that the puzzle hides the same value as a commitment.

I know that such a scheme can be created by going down to the bit-level, but I would strongly prefer a more efficient solution.

I am aiming for a sequential puzzle that takes around 2 hours for a powerful computer to solve, akin to this paper.

TLDR: Is there a way to encrypt a puzzle such that the puzzle cannot be worked on until it is decrypted while still proving that the solution to the puzzle matches a commitment?

• This is a XY problem, you propose the solution already along your problem. You don't need a timelocked something. You could also have a secret shared between B and C, where C sends his share to B if A leaves. Nothing fancy, just let A create the shares and a ZK proof that the shares actually contain what they are supposed to contain.
– tylo
Jun 20, 2019 at 22:24
• That solution won't work. $C$ can't wait around after $A$ leaves, but $B$ can't have the secret until some time has passed. If $B$ has the value immediately, it poses a problem for $A$, and $A$ leaving isn't necessarily malicious. Jun 21, 2019 at 3:00