How do I generate a number for a lottery and later proves its existence I want to create a lottery that works like this: I choose a secret number A in the range [0:999] and publish an object B. People must try to guess the number A to win. When somebody wins, I want to publish an object C. The object C shall now together with B prove the existence of A, such that people know that A was determined from the beginning of the lottery.

Calculating A given B should be either impossible or unfeasible due to computational requirements.

I don't know much about cryptography, but have come up with the following proposal on my own:

p1, p2 = large prime numbers chosen at random, where p1 &lt; p2   
f = a hash function: N x N -&gt; {0, 1, ..., 1000}

A = f(p1 | p2)
B = (p1*p2, f)
C = p1


My idea is that given B, it is easy to calculate A if C is also known, but computationally hard without C. Note that both the hash function and the product of p1 and p2 is given as the object B.

What do you think about my proposal, will it work? Is there any better or simpler methods?
You could use HMAC for this. HMAC is available in pretty much every crypto library out there.

The process would work like this. Randomly pick A and C. For simplicity, let's assume they are strings (of any length). Compute $B=HMAC(A,C)$. Publish $B$. Once someone guesses $A$, you publish $C$. Anyone can then verify that $B=HMAC(A,C)$.

As long as a good hash function is used, and $C$ is sufficiently long (say 128 bits), knowing $B$ should not help anyone compute $A$.



The benefits of doing this over what you propose in the question is that it is much simpler, faster, and the values generated are much smaller. For factorization to be hard enough, your primes will have to be around 1000 bits each.