# Is the hash-based commitment IND-CPA?

As we know the well-known hash-based commitment is as follows:

• Prover: given a message $$m$$, it:

(1) picks a fresh random value $$r$$

(2) computes $$H(r||m)=c$$.

• Verifier: given $$c$$ and the commitment opening: $$(r,m)$$, checks $$H(r||m)=c$$

Question: Am I right that in the random oracle model, the above scheme is IND-CPA?

• – kelalaka Apr 8 at 17:41

Notice that the above scheme cannot be an encryption since there is no encryption/decryption key. In fact, if the hash function has a larger domain than range, there may be multiple pairs $$(m,r)$$ that map to the same $$c$$ and one cannot know which one is the correct (even if they were all powerful).
It is true, however, that the scheme you propose is hiding: for any two messages $$m_0,m_1$$ it holds that $$H(r,m_0)$$ and $$H(r,m_1)$$ are indistinguishable in the random oracle model.