Hacker News Reader

Comment by gs17 | Hacker News Reader

There's a bunch of committment schemes: https://en.wikipedia.org/wiki/Commitment_scheme , but a simple (although I'm not sure it's ideal) one would be to hash a random value concatenated with the message, transmit the hash as your commitment to that message, and to reveal it send the random value and message so the verifier can confirm the hash comes out the same.

View on HN

But would your example commitment work in this case when the verifier never receives the "message" of the graph that's being committed to?

The "message" would have to be each vertex's color, separately, rather than the entire graph's coloring at once. Then when the verifier requests the edge for this round, the prover reveals those the commitments for the two vertices on that edge and only those two.

Since the prover doesn't know which edge will be selected and has to commit one color to each vertex, inspecting one random edge per round is enough. They either committed to a 3-coloring and any edge is valid, or they didn't and there's at least one edge we could pick to reject them. The rest of the graph doesn't need to be revealed for us to either gain confidence that they have a coloring or know for certain they do not.

Interesting! Thanks especially for the link to the Wikipedia page.

So in the demo, the black (uncolored) shape _kind of_ represents the commitment. Although as you pointed out, it doesn't explain how it is verified! Instead of a black shape, it would be a shape made out of hash values that are meaningless until the random number for any one of them is revealed. And the protocol is to only reveal one of them each time?

Exactly, the only difference is that two commitments would be revealed, since each vertex color is committed, if we let them commit to edges instead it would be much easier to lie!

Reply on news.ycombinator.com