Commitment scheme

A commitment scheme satisfies two security properties. Hiding guarantees the commitment reveals no information about the value, and binding prevents opening it to a value different from the original; both cannot hold perfectly at once. Typical constructions are the hash-based commitment, commit = H(value || nonce), and the Pedersen commitment, C = vG + rH over an elliptic curve, which is perfectly hiding and homomorphic. Merkle trees and KZG are its vector and polynomial variants.

It is a base building block of zero-knowledge cryptography and many practical protocols: sealed-bid auctions where each bidder commits to their bid and reveals it later, commit-reveal schemes for on-chain randomness, voting and confidential payments. It separates the moment of deciding from the moment of revealing with no room for manipulation.

The concept was formalized in the cryptography of the 1980s; the Pedersen scheme comes from Torben Pryds Pedersen (CRYPTO 1991). No single FIPS or RFC defines it as such: it is specified within concrete protocols. Real cases: Ethereum's ENS name registry uses a commit-reveal process to prevent front-running when registering domains, and Pedersen commitments are used in confidential transactions such as Confidential Transactions and in Monero's RingCT model to hide amounts.