I have been thinking about the following use-case: some institution wants to organize bets about an outcome that is of its own choosing. The timeline is as follows:

  1. The organization chooses the outcome at time T. Bets are open about what the outcome is.
  2. At time T + N, the decision that the institution made at time T is released, resolving the bets.

For example, we can imagine some TV channel hosting a gambling platform about what characters are going to die in the next season, which has already been written but not yet broadcasted.

The problem is to find a way for the organization to prove that the information it releases at time T + N has effectively been chosen, and not altered since, time T. That is, of course, without releasing the information itself at time T. This ensures, notably, that the organization cannot retroactively chose the outcome to profit in some way from the trend the bets have taken.

My proposal is as follows:

  1. At time T, the organization chooses a random key that it keeps secret. It computes a HMAC of the outcome with the secret key, and publishes it.

  2. At time T + N, the organization releases both the outcome and the secret key.

People can verify that the HMAC is correct, and it is ensured that the published outcome was indeed the one chosen at time T because it would be computationally infeasible to target the published HMAC with another pair of (outcome, key) for a different outcome and key.

Is this sound and correct? Especially the last part in bold? It seems to me that this is basically equivalent to a preimage attack on the hash function with a known prefix for the preimage?


As usual there is already a wide range of solutions for this particular problem.

Abstracted this is called a commitment scheme. WikiPedia cites Oded Goldreich with this quote for a short explanation:

[A commitment scheme] allows one to commit to a chosen value (or chosen statement) while keeping it hidden to others, with the ability to reveal the committed value later.

There are various forms or implementations of this: one commonly used (for instance by WikiLeaks) are so called pre-commitment hashes. These hashes are checksums (md5, sha256, ..) of encrypted files. Individuals can download the files but cannot open them until the distributor of the file gives out the password. This way the distributor is - as Goldreich says - able to commit to a value while keeping it hidden.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.