> commitment = SHA256( binding_factor || data )
> Tell someone the commitment, then [later] reveal both the data and blinding factor.
It looks like I can change my data, then generate a binding factor that will combine to produce the original hash input.
>It looks like I can change my data, then generate a binding factor that will combine to produce the original hash input.
If you can find SHA256 collisions on demand. But if you can do that, you should probably be writing a paper about it and advancing the state of the art.
I compute C = B || D.
I reveal C.
I later choose new data D'.
I compute C = B' || D'.
I reveal B' and D'.
Since both B and D were secret, B' and D' are accepted.
Secretly masking data lends to malleability. (EDIT: Not a mask)
EDIT: As CJefferson points out the operation is not a mask, but concatenation of a fixed length random value which invalidates this example. Exploiting this secrecy would require a weakness in SHA256 that allows input prefixes to produce colliding hash states (hard).
