How Blockchain Works | Commit–Reveal and Hidden Choices

Imagine a fictional class choosing a colour for its reading corner. Each pupil should choose without copying the most popular answer already displayed.

If pupils simply announce their choices one after another, later pupils see earlier choices. A different arrangement lets everyone make a choice first and disclose it later.

Commit–reveal uses that separation. The first stage publishes a commitment related to the choice. The later stage supplies an opening that can be checked against the commitment.

The classroom story is an analogy, not a secure voting system. It introduces two different moments: becoming bound to a choice and making the choice readable. Keeping those moments separate is the main idea.

Contents · Next chapter

The class could place choices into sealed envelopes. Each envelope becomes a visible sign that a pupil has submitted something, while its contents remain concealed.

A digital commitment can play a related role, but it is not literally an envelope. Its guarantees depend on the construction, input preparation and assumptions.

In a common hash-based approach, the participant computes a digest from a precisely defined message that includes the choice and suitable secret information. The commitment is published; the opening is retained for later.

Do not infer from an unreadable digest alone that the choice is safely hidden. The number of possible messages and the secrecy of the additional input matter.

Contents · Previous chapter · Next chapter

Two goals help explain a commitment. Binding means that changing the committed choice later should be infeasible under the scheme’s assumptions. Hiding means that the commitment should not reveal the choice before opening.

Those are different properties. An arrangement can bind a participant while revealing too much. A concealment mechanism can also fail to bind the participant to one definite answer.

Our paper envelopes approximate these ideas: an opaque envelope conceals the text, while a seal and an identity label discourage substitution. Paper classroom controls are not cryptographic guarantees.

When someone says “we use commitments”, ask which properties the actual construction provides and under which assumptions. The name of the technique is not its complete security argument.

Contents · Previous chapter · Next chapter

Suppose the only permitted choices are red and blue. If a participant publishes only the hash of the bare colour word, an observer can hash both possible words and compare.

The observer has not broken the hash function. The observer has searched a tiny set of candidate inputs.

This is why a changing-looking string should not be mistaken for secrecy. The strength of a commitment construction depends on more than the digest’s length.

The classroom analogy is a transparent numbering system: if red always produces ticket R and blue always produces ticket B, replacing a word with a ticket does not hide the choice from someone who knows the rule. Representation and confidentiality are different jobs.

Contents · Previous chapter · Next chapter

A hash-based commitment commonly includes fresh, sufficiently unpredictable secret randomness along with the choice. This expands the possible messages an observer would have to consider.

The extra value is sometimes called a salt or nonce, although those words have different roles elsewhere in computing. Here the relevant job is to help conceal the committed choice.

A predictable classroom number such as a pupil’s public seat number would not provide meaningful secrecy. Nor would posting the secret beside the commitment.

This is a conceptual explanation, not a recipe for generating or storing secrets. Production schemes need an appropriate random source, defined encoding and careful handling. A convenient value that changes is not automatically unpredictable enough for the intended threat model.

Contents · Previous chapter · Next chapter

A pupil commits to red. But red for which question: the reading-corner wall, the class badge or next week’s team?

A commitment should bind the intended context, not merely an isolated answer. Depending on the design, the message can include the round, purpose, participant and relevant network or application context.

Encoding also matters. If multiple fields are joined ambiguously, different field combinations can produce the same input before hashing. That is an input-design problem, not necessarily a cryptographic hash collision.

For the paper exercise, write the round and question on the same slip as the choice. This makes it harder to reuse one sealed answer for a different decision while claiming that its meaning never changed.

Contents · Previous chapter · Next chapter

Computing a commitment privately is not the same as recording it where the protocol expects it. A participant needs evidence that the commit-stage requirement was satisfied.

In a blockchain system, that can involve a transaction being accepted under the relevant rules. Submission, inclusion and the required settlement assurance remain separate considerations.

The fictional class records whose sealed envelopes arrived before the commit deadline. A pupil who prepared an envelope at home but never submitted it has not satisfied that classroom rule.

The lesson is about evidence, not impatience. An application should explain whether it has prepared a commitment, submitted it or observed the required accepted record. Those are different states in the workflow.

Contents · Previous chapter · Next chapter

During the reveal stage, a participant supplies the information needed to open the commitment. The checker recomputes or otherwise verifies the relationship using the scheme’s rules.

For a hash-based teaching picture, the same choice, secret and bound context should reproduce the recorded digest. A different choice should fail the comparison unless the scheme or its assumptions are broken.

A matching opening establishes a specific link to the earlier commitment. It does not establish that the choice was wise, honest or appropriate.

In the colour exercise, opening an envelope proves what was written inside the recorded envelope, assuming the paper controls worked. It does not prove that every pupil understood the question or felt free from outside pressure.

Contents · Previous chapter · Next chapter

A useful protocol needs rules about when commitments are accepted and when openings are accepted. Otherwise, participants may observe information before making what was supposed to be an earlier hidden choice.

The precise timing rules vary. A design may use block-related conditions, timestamps or another defined mechanism. Those choices inherit the timing and availability limits of the underlying system.

Do not turn an example waiting period into a universal blockchain requirement.

For our class, the teacher closes the envelope collection before opening any envelope. That simple ordering expresses the intended separation. A digital system needs an equally explicit rule, expressed in the information its actual execution environment can check.

Contents · Previous chapter · Next chapter

A participant can make a valid commitment and then fail to reveal. The commitment does not force a person or service to send the opening.

The cause might be a lost secret, a missed deadline, an unavailable interface or a deliberate decision to withhold. The protocol needs to define what happens next.

This is a completion problem, sometimes described in terms of liveness. It is different from checking whether an opening matches.

In the classroom, a sealed envelope without its required opening step may leave one choice unresolved. The remaining pupils need a rule for continuing. A cryptographic relationship can constrain an answer while still leaving the overall activity unable to finish.

Contents · Previous chapter · Next chapter

Imagine a fictional game that combines participants’ revealed choices to produce an outcome. A participant who reveals last may see what the outcome would be before deciding whether to reveal at all.

Even if that participant cannot change the committed choice, withholding can still influence which outcomes become available or whether the game finishes.

This shows why binding does not automatically imply fairness. The participant may be unable to substitute a new answer yet retain a valuable choice between revealing and withholding.

Real designs can add rules addressing this problem, but each brings assumptions and trade-offs. A beginner explanation should identify the option to withhold rather than declaring the system fair merely because every submitted opening is checked correctly.

Contents · Previous chapter · Next chapter

A protocol may attach consequences to missing or invalid reveals. These can discourage some behaviour, but their effectiveness depends on incentives, enforcement and the participant’s objective.

A fictional class might exclude an unopened envelope from the result. That policy makes completion possible, but it can also change the outcome. Another policy might cancel the round, which gives a non-revealer a way to disrupt it.

There is no universal consequence that solves every application.

This guide does not recommend deposits, financial penalties or a production game design. It teaches a narrower habit: write down the missing-reveal rule and analyse who benefits under it. A consequence is part of the mechanism, not proof that strategic behaviour has disappeared.

Contents · Previous chapter · Next chapter

After an opening becomes public, the choice and associated information may remain readable in the recorded history. Commit–reveal is usually delayed disclosure, not permanent confidentiality.

An observer might also learn metadata before the reveal: who submitted a commitment, when it arrived and how often the participant uses the system.

The classroom analogy is direct. Keeping an envelope sealed until Friday does not make the opened slip private on Saturday.

Before adopting the technique, identify which information should remain secret and for how long. If an application needs lasting secrecy, it requires additional design. Do not promise long-term privacy using a mechanism whose intended second stage is to disclose the information.

Contents · Previous chapter · Next chapter

ENS documents a commit–reveal process for registering certain names. Its stated purpose includes reducing opportunities to copy a visible registration request and get ahead of it.

That is a concrete application of delayed disclosure, not a claim that every naming, privacy or fairness problem is solved.

The exact parameters and rules belong to the deployed controller and its current documentation. This guide deliberately does not turn those parameters into instructions for a live registration.

The transferable lesson is the shape of the workflow: first record a commitment to defined registration information, then reveal the corresponding information under the applicable timing rules. Evaluate the remaining assumptions separately from the existence of those two stages.

Contents · Previous chapter · Next chapter

The class now wants a private, fair and inclusive election. Commit–reveal alone does not settle eligibility, duplicate participation, coercion, tally correctness, accessibility or permanent ballot secrecy.

It may also reveal each participant’s final choice, which conflicts with some definitions of a secret ballot.

This is why a mechanism should not be promoted into an entire governance system. One component can solve a narrow disclosure-order problem while leaving other requirements untouched.

Write the desired properties first. Then identify which are supplied by commitments, which require other mechanisms and which remain unresolved. The same discipline applies to blockchain applications outside voting: a useful cryptographic component is not a complete institutional process.

Contents · Previous chapter · Next chapter

Use a fictional question with three choices: red, blue or green. Each participant writes the round label and choice on a slip, seals it and records a participant label outside.

Collect all envelopes before opening any. Record which participants submitted on time. Then open them and compare the visible contents with the round’s rules.

Now repeat with one envelope deliberately left unopened. Decide in advance whether the round continues, excludes that entry or stops.

This activity illustrates stage separation and missing openings. It does not demonstrate computational hiding or binding. Do not label paper seals “cryptographically secure”. The point is to make the protocol’s questions visible before studying a real construction.

Contents · Previous chapter · Next chapter

After the exercise, avoid saying “the process was perfectly fair”. Say something narrower: all recorded envelopes were collected before disclosure, or one participant did not complete the reveal stage.

For a digital system, a similarly bounded report identifies the construction, recorded commitments, accepted openings, timing rules and unresolved entries.

Also distinguish a mismatching opening from an absent opening. One fails a relationship check; the other supplies nothing to check.

Accurate reporting improves design. It shows whether the problem concerns concealed inputs, changed choices, incomplete participation or the policy used to determine the outcome. Those problems may require different remedies even when they occur in the same round.

Contents · Previous chapter · Next chapter

Commit–reveal lets someone commit to a defined choice before disclosing the information needed to check it. A suitable construction can make changing the choice or learning it early difficult under stated assumptions.

The rest of the workflow still matters: fresh secrets, clear encoding, bound context, stage deadlines, accepted records and a rule for missing reveals.

A commitment does not force disclosure. A valid opening does not guarantee a fair institution. Delayed disclosure is not permanent secrecy.

When you meet the technique, ask four questions: what is bound; what remains hidden; when can it be opened; and what happens if somebody never opens it? Those questions reveal both its usefulness and its limits.

Contents · Previous chapter · Worked situations