# Is Commitment Scheme with hash function is a perfectly hiding scheme?

If I use a hash function to construct the commitment scheme, can I say it is perfectly hiding?

• $$m$$ is the message
• $$r$$ is a random value

In commit stage, $$c = C(m, r)$$

In reveal stage, by revealing $$r$$ and verify $$c = C(m, r)$$

Because there is $$m'$$ and $$r'$$ exist for $$C(m, r) = C(m', r')$$ So it is perfectly hiding, and it can open it both ways, so it is computationally binding.

Am I correct?

However, the construction you're looking at is a folklore commitment scheme in the Random Oracle Model, where $$C$$ is modeled as a random oracle. In this case, the construction is computationally hiding, but it is not perfectly hiding. The reason is the following: While you observation that, due to compression, there must exist some $$m',r'$$ such that $$C(m,r)=C(m',r')$$ this is not sufficient.
Perfect hiding would require that for any $$m'$$ there exists an $$r'$$, such that $$C(m,r)=C(m',r')$$. And this is generally not the case (and indeed unlikely) for a random function.
• So it must be all $m'$ exists $r'$ fulfilling $𝐶(𝑚,𝑟)=𝐶(𝑚′,𝑟′)$, then we can call it perfect hiding? – Jeff Lee Mar 23 '20 at 13:12
• Can I say so if we use $g=a^m b^r mod p$ for the C, it is perfectly hiding, but computationally hiding? – Jeff Lee Mar 23 '20 at 13:23