Cryptography · T691 · Commit-Reveal Joint Randomness

One Honest Party Randomness Demo

Commit-reveal joint randomness, taught by running it. Every party first publishes a commitment, SHA-256 of its secret contribution mixed with the ceremony salt, and only after all commitments are on the table does anyone reveal. The ceremony output is SHA-256 over the ordered reveals: as long as one party contributes fresh entropy, no coalition of the others can steer the result, and no participant can change its contribution after committing. A dedicated panel shows the one attack commit-reveal does not stop, the last-revealer abort, and names what real protocols add.

⚠ This page is a teaching model, not a randomness beacon. It demonstrates the commitment idea over inputs you declare or entropy your own browser generates; it does not produce randomness anyone should bet on, sign with, or rely on. There is no coordinator, no relay, and no network call of any kind: every hash is computed locally with WebCrypto. The dishonest-party simulation is a model of behavior, not a proof about any real adversary.
Commit-Reveal SHA-256 · WebCrypto Only Zero Network Teaching Model · 3 to 7 Parties
๐Ÿ”’ All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data โ€” use synthetic or anonymised inputs only.
Ceremony Parameters

Declare the ceremony salt and the number of simulated parties. Each party's contribution is fresh crypto.getRandomValues entropy unless you type one in; a typed contribution is your declaration, and the page never checks it for strength. Commitments are computed and published first; reveals happen only after every commitment is published.

Attack Panel · The Last-Revealer Abort

Commit-reveal binds what a party can reveal, but it cannot force a party to reveal at all. The last party to reveal sees every other contribution, can compute the final output for each of its own possible reveals, and can refuse to reveal (abort) whenever the outcome is not the one it wants. Repeat the ceremony with a aborting party and the distribution of accepted outcomes skews toward that party's preference: the abort itself is the bias. Run the demonstration below to watch a 3-party ceremony where party 3 is the last revealer and aborts an unfavorable outcome.

What real protocols add: economic penalties escrowed against the commitment (an abort burns the deposit), verifiable delay functions so the last revealer cannot precompute its options in time, and threshold schemes (for example k-of-n verifiable secret sharing) where the reveal survives any minority of refusals. None of these are simulated here; this page stops at naming them.

Scope and Estate

Positive scope: this page shows the commitment idea end to end and nothing more. It is a teaching model, not a randomness beacon, and its output must not be used for drawing lots, key generation, signing, or any decision that matters.

  • Estate counterpart, does today: art-774 beacon-seeded fair sampling v2 derives a fair sample from an externally verifiable public randomness beacon. Where you need randomness anchored to something the world can check, use a beacon; where you need a set of mutually distrusting parties to mint a value together, use commit-reveal.
  • Salt design note: the ceremony salt here follows the sha256-salted@1 labelled design, with the ceremony itself acting as the salt source: the string you declare is mixed into every commitment, and the joint contributions are what make the final output unpredictable.
  • What this page runs on: WebCrypto SHA-256 (SubtleCrypto.digest) and crypto.getRandomValues only, no library, no coordinator, no relay, no storage, no clock read, no network of any kind.