Commitment Scheme

A commitment scheme is a fundamental cryptographic primitive that works like a sealed, tamper-evident envelope: a party can commit to a value during a commit phase, keeping it hidden, and then later reveal it during an open phase, proving it was the exact value committed to all along. This two-phase structure underpins auctions, coin-flipping protocols, and a remarkable amount of Bitcoin's own architecture — once you learn to spot the commit-then-reveal pattern, you find it everywhere in the protocol.

Hiding and binding

Two properties define a sound commitment. Hiding means the commitment reveals nothing about the value before it is opened, so a receiver cannot peek inside the envelope. Binding means the committer cannot later open the commitment to a different value, so they are locked into their original choice. A scheme cannot be perfectly hiding and perfectly binding simultaneously; designers choose which property is unconditional and which rests on a computational assumption. The simplest practical construction is a hash commitment: publish the SHA-256 hash of your value concatenated with a random salt, and later reveal both. The salt matters — committing to a low-entropy value like "heads" without one lets anyone brute-force the envelope shut or open.

Commitments inside Bitcoin

Bitcoin is, structurally, a machine built out of commitments. Every block header commits to its full transaction set through the Merkle root — 80 bytes binding gigabytes of history, which is what lets lightweight clients verify inclusion proofs. Each block commits to its predecessor by hash, chaining commitments into the ledger's immutability. Taproot is an elegant commitment construction in its own right: alternative spending scripts are committed inside a public key via a tweak, hidden until (and unless) the owner chooses to reveal one, so the cooperative case discloses nothing about the contingencies. Even a mined block is a commit-then-reveal of the miner's work: the nonce search commits energy to a specific template before the world learns of it.

Pedersen commitments and blinded values

A widely used algebraic variant is the Pedersen commitment, which adds a random blinding factor so the committed value is unconditionally hidden, and which is additively homomorphic: commitments can be summed to produce a commitment to the sum of the underlying values. That homomorphism is the engine of Confidential Transactions and Mimblewimble — a verifier can check that committed inputs equal committed outputs, proving no inflation, without ever learning the amounts. Commitment schemes also appear inside zero-knowledge proofs, where the prover commits to intermediate values before answering challenges, and in threshold-signing protocols like FROST, where signers commit to their nonces before producing signature shares — precisely to stop a malicious participant from choosing a nonce after seeing everyone else's.

A worked example

Two people want to settle a coin flip over the phone. Alice picks "heads," generates a random salt, and sends Bob the SHA-256 hash of heads||salt — her sealed envelope. Bob, having seen only an opaque hash, now calls the flip openly: "tails." Alice then reveals her value and salt; Bob hashes them and confirms they match the commitment. Alice could not change her pick after hearing Bob (binding), and Bob learned nothing before choosing (hiding). Strip away the phone call and the same three moves — commit, challenge, reveal — are running inside protocols from auctions to FROST signing sessions.

For anyone building or evaluating self-custody and privacy tooling, the commit-then-reveal pattern is a foundation worth recognizing on sight. When a protocol asks participants to publish something opaque now and explain it later, you are looking at a commitment scheme — and the right questions are always the same two: what stops the committer from opening it differently (binding), and what could an observer learn before the reveal (hiding)?