The following problem needs to be solved:

  1. Person A will be guessing the number that Person B has in mind.
  2. Only Person B can confirm that the answer provided by Person A is correct.
  3. Person A can not be sure if Person B is fair

Is there any cryptograhpic way to achieve something like this:

  1. A third party will generate a random value X which both Person A and Person B are able to see in an encrypted form
  2. Only once Person A has guessed value X, it should be possible for Person A and Person B to decrypt value X.

All ideas and suggestions are welcome on how to achieve this. Thank you!


All ideas and suggestions are welcome on how to achieve this.

It sounds like commitments should be one way to handle it.

A commitment scheme is a method where:

  • Someone (person B) can generate and publish a commitment to a secret value; someone else (person A) looking at the commitment learns nothing about the secret value (we say that this is the 'hiding' property of the commitment scheme.

  • Later, person B can open the commitment; they publish the secret value and a proof that the committed value corresponds to the secret value (which anyone can verify). We insist that person B cannot generate a proof to any secret value other than the one in mind when they generated the commitment (we say that this is the 'binding' property of the commitment scheme.

In your case, person B will initially generate a commitment to the number he has in mind. Then, when person A has published his guess, person B will open the commitment, and show whether person A's guess to the secret value was correct or not.

The simplest commitment scheme is a hash based commitment; to generate a commitment to the value X, person B would select a fixed size random value r and publish $\text{hash}( r || X )$ (where $\text{hash}$ is a collision resistant hash function, such as SHA256 or SHA3); to open the commitment, you would publish $r$ and $X$. This is simple, however sometimes you need more from your commitment scheme (such as the ability to generate proofs about your commitments, for example, that the committed value is not the value that person A guessed (without revealing the correct value); if so, then Pedersen commitments make that a lot easier. I don't know enough about what you need from a commitment scheme to advise you which way to go.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.