I have been thinking about the following use-case: some institution wants to organize bets about an outcome that is of its own choosing. The timeline is as follows:
- The organization chooses the outcome at time T. Bets are open about what the outcome is.
- At time T + N, the decision that the institution made at time T is released, resolving the bets.
For example, we can imagine some TV channel hosting a gambling platform about what characters are going to die in the next season, which has already been written but not yet broadcasted.
The problem is to find a way for the organization to prove that the information it releases at time T + N has effectively been chosen, and not altered since, time T. That is, of course, without releasing the information itself at time T. This ensures, notably, that the organization cannot retroactively chose the outcome to profit in some way from the trend the bets have taken.
My proposal is as follows:
At time T, the organization chooses a random key that it keeps secret. It computes a HMAC of the outcome with the secret key, and publishes it.
At time T + N, the organization releases both the outcome and the secret key.
People can verify that the HMAC is correct, and it is ensured that the published outcome was indeed the one chosen at time T because it would be computationally infeasible to target the published HMAC with another pair of (outcome, key) for a different outcome and key.
Is this sound and correct? Especially the last part in bold? It seems to me that this is basically equivalent to a preimage attack on the hash function with a known prefix for the preimage?