Commitment Schemes & Nullifiers

Commit Now, Reveal Later

A commitment scheme is like sealing a value in an envelope: you produce a commitment (the sealed envelope) that hides the value but binds you to it — you can't change what's inside afterwards, and later you can open it to prove what it was. Good commitments have two properties: hiding (the commitment reveals nothing about the value) and binding (you can't later claim it was a different value). A simple version is hashing a secret with some random 'salt'; the hash is the commitment, and later revealing the secret and salt proves what you committed to. Commitments are everywhere in cryptography and blockchains — in fair coin flips, sealed-bid auctions, voting, and crucially in privacy systems, where you want to prove you did something without revealing the details yet.

Spending a Secret Exactly Once: Nullifiers

Privacy systems face a puzzle: if you hide who owns what (using commitments), how do you stop someone spending the same hidden asset twice, without revealing which asset it is? The answer is a nullifier — a unique value derived from a secret that you publish when you spend, which marks that secret as 'used' without revealing which commitment it corresponds to. Each secret produces exactly one nullifier, so the system can keep a public list of spent nullifiers and reject any repeat, preventing double-spends — yet because the nullifier can't be linked back to the original commitment, privacy is preserved. Commitments hide your assets; nullifiers let you spend them once each without breaking that anonymity. Together they're the core machinery of on-chain privacy.

• A commitment hides a value (hiding) while binding you to it (binding), to reveal later
• A simple commitment: hash your secret with random salt
• A nullifier is a unique 'used' marker derived from a secret, published when spending
• Nullifiers prevent double-spends without revealing which asset was spent