Solution to Discrete Log as a Commitment Is the solution to a discrete logarithm a reasonable commitment scheme?
By my analysis, the following scheme is a reasonable commitment scheme:
Let $p$ and $q$ be large primes such that $q∣(p−1)$, let $g$ be a generator of the order-$q$ subgroup of $Z^*_P$. Let $m$ be a value from $Z_q$, and $c=g^m\text{ mod }p$. The commitment is $c$ and to open the commitment, the sender reveals $m$.
I believe this scheme is:

(Perfectly?) binding: The discrete logarithm only has one solution and so the sender can't reveal another value, $m'$, such that $c= g^{m'}\text{ mod }p$

(Computationally?) hiding: Obviously, this scheme is not perfectly hiding. But assuming the discrete logarithm is hard, receiver or an adversary can't determine the committed message prior to reveal, so I believe this provides computational hiding.


Is my analysis of the binding &amp; hiding properties correct? Are there other flaws not captured by hiding and binding?
Obviously, this scheme is not perfectly hiding. But assuming the discrete logarithm is hard, receiver or an adversary can't determine the committed message prior to reveal, so I believe this provides computational hiding.

If the receiver had no other information about $m$, then you would be correct.
On the other hand, we typically assume that he has some information; the acid test is &quot;if the receiver knew the committed value was either $m_0$ or $m_1$, he still cannot determine which it is from the commitment&quot;.
Obviously, your approach (or, for that matter, any deterministic method) cannot fulfill that requirement; you need to include some randomness to meet this criteria.