EXHIBIT 04● REAL SHA-256 · window.crypto.subtle
Hash Commitment Scheme
A way to lock in a hidden choice now and prove later that you did not change it
✓ Binding
✓ Hiding
This is like sealing your answer in an envelope before anyone is allowed to open it. You commit first, which locks in your choice, and then you reveal it later so everyone can check that you did not swap it out.
Here the digital envelope is a real SHA-256 hash. Once the bid and secret nonce are revealed, anyone can recompute the hash and confirm that the original commitment was honest and unchanged.
Toy vs Production Parameters
| Dimension | This Exhibit | Production Expectation |
|---|---|---|
| Commitment primitive | SHA-256 digest (real) | Hash + protocol-specific domain separation |
| Nonce source | 32-byte browser RNG | Strict entropy controls + protocol audits |
| Application model | Two bidder educational flow | Authenticated multi-party protocol with dispute handling |
| Security envelope | Inspectable demo UI | Formal protocol proofs + hardened backend integration |
Two bidders lock in hidden bids as SHA-256 hashes, then reveal them later. The hash binds each bid so it cannot be changed after the fact.
BIDDER A
Secret bid
—
Random nonce (32 bytes)
—
SHA-256(bid ‖ nonce)
—
BIDDER B
Secret bid
—
Random nonce (32 bytes)
—
SHA-256(bid ‖ nonce)
—
Commitments lock bids before revelation — neither bidder can see or change the other's bid once committed.
Real SHA-256 runs in your browser via window.crypto.subtle.digest(). Binding: changing even one character produces a completely different 256-bit hash. Hiding: the nonce is doing this work, not the hash. Bids here are integers from $100 to $999 — only 900 possibilities — so
SHA-256(bid) alone would hide nothing: an observer would hash all 900 candidates in well under a millisecond and read the bid straight off the table. Committing to SHA-256(bid ‖ nonce) with a fresh 32-byte nonce is what puts the value beyond search. And what that buys is computational hiding — it rests on SHA-256 being hard to invert, not on information theory. A Pedersen commitment hides perfectly: even an adversary with unbounded time learns nothing. That is the tradeoff — a hash commitment is perfectly binding and computationally hiding; Pedersen is the reverse.One caveat on the presets. The preset links above pass
?seed=…, which switches this exhibit to a deterministic RNG so a walkthrough replays identically. In that mode the nonce comes from a seed printed in the URL, so it is not secret and hiding does not hold at all. Use the presets to rehearse the demo, not to reason about hiding.