Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
As we know the well-known hash-based commitment is as follows:
Prover: given a message $m$, it:
(1) picks a fresh random value $r$
(2) computes $H(r||m)=c$.
Verifier: given $c$ and the commitment opening: $(r,m)$, checks $H(r||m)=c$
Question: Am I right that in the random oracle model, the above scheme is IND-CPA?
Indistinguishability under chosen message attacks (IND-CPA) is a security definition for encryption schemes and not for commitments. So we cannot claim that a commitment scheme is IND-CPA.
Notice that the above scheme cannot be an encryption since there is no encryption/decryption key. In fact, if the hash function has a larger domain than range, there may be multiple pairs $(m,r)$ that map to the same $c$ and one cannot know which one is the correct (even if they were all powerful).
It is true, however, that the scheme you propose is hiding: for any two messages $m_0,m_1$ it holds that $H(r,m_0)$ and $H(r,m_1)$ are indistinguishable in the random oracle model.
