# What is wrong with encryption-based / hash-based commitment schemes?

In the slides to my information security class it is stated without explanation that a encryption-based commitment scheme defined as follows is broken:

• Commit: P outputs c = Enck(m)
• Reveal: P sends k to V. V decrypts c and learns m = Deck(c)

Similarly, a hash-based commitment scheme (using cryptographic hash function H) defined as follows is also stated to be broken:

• Commit: P outputs c = H(m)
• Reveal: P sends m to V. V verifies that c = H(m).

Why are these schemes broken with respect to hiding and binding?

The only reasons I can think of that these schemes might be broken are the following:

• In the encryption-based scheme, the encryption might reveal something about the length of the message, breaking the principle of hiding. However, this could be addressed by padding the messages to a fixed length.
• In the hash-based scheme, two hashes might collide, breaking the principle of binding.

Are there any other reasons these schemes are not valid commitment schemes?

• Note that there's nothing wrong with a hash based commitment scheme; the question just implemented it wrong (on purpose). The correct way is to choose a fixed length nonce $n$, and the commitment is $H(n || m)$; to open, you reveal $n$ and $m$ – poncho Jul 27 '19 at 13:32

The second construction is trivially not hiding. It is easy to verify a guess $$m'$$ just by recomputing $$H(m')$$ and comparing the result with the commitment.