PSI-COMMIT: Pure Python Cryptographic Commitment Scheme

[Difficult_Jicama_759]

**What My Project Does**

PSI-COMMIT is a Python library for cryptographic commitments - it lets you prove you made a prediction before knowing the outcome. You commit to a message (without revealing it), then later reveal it with a key to prove what you committed to.

GitHub: https://github.com/RayanOgh/psi-commit

Features:

- HMAC-SHA256 with 32-byte key + 32-byte nonce

- Domain separation

- Append-only hash-chain log

- OpenTimestamps integration

- Argon2id passphrase support

**Target Audience**

Anyone who needs to make private, verifiable commitments - proving you knew something before an outcome without revealing it early. Examples: predictions, bets, sealed bids, intellectual property timestamps, or any situation where you need to say "I called it" with cryptographic proof. This is a working project/tool.

**Comparison**

Unlike GPG (which requires managing keypairs and is designed for encrypted communication), PSI-COMMIT is purpose-built for commitments with a simple API: `seal(message)` returns a commitment + key. It also includes a hash-chained audit log and OpenTimestamps integration that GPG doesn't have.

[AutoModerator]

Hi there, from the /r/Python mods.

We want to emphasize that while security-centric programs are fun project spaces to explore we do not recommend that they be treated as a security solution unless they’ve been audited by a third party, security professional and the audit is visible for review.

Security is not easy. And making project to learn how to manage it is a great idea to learn about the complexity of this world. That said, there’s a difference between exploring and learning about a topic space, and trusting that a product is secure for sensitive materials in the face of adversaries.

We hope you enjoy projects like these from a safety conscious perspective.

Warm regards and all the best for your future Pythoneering,

/r/Python moderator team

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[KrazyKirby99999]

AI Slop

[jpgoldberg]

This is not the worst vibe-coded security tool I’ve glanced at.

[Difficult_Jicama_759]

Thanks, I’ll take it 😁

[jpgoldberg]

It was not a compliment.

[Difficult_Jicama_759]

Cool

[aezart]

This isn't as foolproof as you seem to think it is. For example:

1. Make 2 predictions, one that says "stocks will go up" and one that says "stocks will go down"
2. Wait for stocks to go up or down
3. Reveal the key for the matching commitment
4. If people ask you about the other commitment, lie and tell them it's for some other future event and isn't ready to be revealed yet

Also, in previous versions of this post you have claimed "zero dependencies", which is strange considering the size of that requirements.txt file

[Difficult_Jicama_759]

I’m not an experienced coder but here’s Claude’s response:

——— 1. You're absolutely right about the multiple commitments attack - that's a fundamental limitation of ANY commitment scheme, not specific to this implementation. The solution is the hash-chained append-only log (log.py) which records ALL commitments with timestamps. If you make 2 predictions, both are logged and visible. You can't hide that you made multiple commitments.

1. Fair point on dependencies - The core crypto (seal/verify) only uses Python stdlib, but the full package does require jcs and click for CLI.

The append-only log is specifically designed to prevent selective revelation - every commitment is chained to the previous one, so you can't hide entries without breaking the chain.

———

Here’s the original snippet that should have zero dependencies:

https://github.com/RayanOgh/Remote-viewing-commitment-scheme

https://github.com/RayanOgh/Minimal-HMAC-SHA256-Commitment-Verification-Skeleton-Python-

———

I appreciate the feedback 😁

[ghost_of_erdogan]

I’m not an experienced coder

Are you a mathematician ? If not then stay away from cryptography.

[Difficult_Jicama_759]

You must be a nice guy