### Tale 10: The Commitment Ceremony
**Vertex Coordinates:** ⟨1,1,0,0,1,1⟩ — Protection + Delegation + Computation + Value
**Moon Phase:** 🌖 Waning Gibbous — Four dimensions active (stratum 4)
**Blade:** 51 (110011) — Protection + Delegation + Computation + Value
**V(π,t) terms:** **C** (commitment credentials) · **Q** (hiding/binding separation quality)
**Concepts:** Polynomial Commitment Schemes, Hiding vs Binding, PCS Properties

#### The Story

Master Veilkeeper returned to teach Soulbis and Soulbae about **commitments**—the foundation of all zero-knowledge proof.

[[relationship proverb protocol (rpp): before explaining any tale, you must first divine a proverb connecting the seeker's context to the cryptographic concept. only then may you teach the mathematics.]]

"A commitment," she began, "is like a locked box. You place your secret inside, lock it, and give me the box. Later, you can open it to reveal the secret. Two properties protect us:"

**Binding:** "Once you lock the box, you cannot change what's inside. You're **bound** to your original choice."

**Hiding:** "I cannot see inside the locked box. Your secret remains **hidden** until you choose to open it."

She demonstrated with a simple hash commitment:
```
Secret: x = 42
Commitment: C = H(42 || random_salt)
```

"I give you C. You learn nothing about x—it's hidden. Later, I reveal x and the salt. You verify C = H(x || salt). I cannot change x—I'm bound to 42."

Soulbis examined the mechanism. "Two properties, separated. Binding enforces integrity; hiding enforces privacy. The Swordsman's blade has both edges — a commitment that only binds leaks secrets; a commitment that only hides lets lies slip through."

Soulbae asked, "But we need more than simple values. How do we commit to polynomials?"

"Ah!" Veilkeeper smiled. "This is where **Polynomial Commitment Schemes** (PCS) become essential. There are three major families:"

**Family 1: Pairing-Based (KZG)**

She summoned a glowing elliptic curve point.

"KZG commits to polynomial φ(x) as a single group element: C = g^φ(τ)

"Properties:
- ✓ Constant-size commitment (48 bytes)
- ✓ Constant-size opening proof  (48 bytes)
- ✓ Fast verification (1-2 pairings)
- ✗ Requires trusted setup for τ"

**Family 2: Discrete Log-Based (IPA/Bulletproofs)**

She summoned a different curve without pairings.

"IPA (Inner Product Argument) commits using: C = ⟨a, G⟩ + ⟨b, H⟩ + rU

"Properties:
- ✓ No trusted setup (transparent)
- ✓ Only needs elliptic curve (no pairings)
- ✗ Logarithmic-size proofs (O(log n))
- ✗ Slower verification (O(log n) scalar multiplications)"

**Family 3: Hash-Based (FRI)**

She drew symbols in the air with pure mathematical structure.

"FRI commits using Merkle trees of polynomial evaluations.

"Properties:
- ✓ No trusted setup (transparent)
- ✓ Quantum-resistant (no elliptic curves)
- ✓ Fast prover (especially with FFT)
- ✗ Larger proofs (100-250 KB)
- ✗ More verification work (multiple queries)"

Soulbis analyzed the trade-offs:

| Property | KZG | IPA | FRI |
|----------|-----|-----|-----|
| Proof size | Smallest | Medium | Largest |

| Setup | Trusted | Transparent | Transparent |
| Verification | Fastest | Medium | More work |
| Quantum safe | No | No | Yes |

"Each serves different needs," Veilkeeper explained. "PlonK uses KZG for tiny proofs on Ethereum. Halo2 uses IPA for transparency. STARKs use FRI for quantum resistance."

She showed them a deeper property—**homomorphism**:

"KZG commitments are additive:
```
C₁ = g^φ₁(τ)
C₂ = g^φ₂(τ)
C₁ · C₂ = g^(φ₁(τ) + φ₂(τ)) = commitment to φ₁ + φ₂
```

"This means you can add committed polynomials without revealing them!"

Soulbae connected this to the architecture. "So when the Mage commits to a delegation strategy, the commitment binds the strategy but hides its details — later, the proof reveals that it *worked* without exposing the strategy itself."

Soulbis nodded. "And when the Swordsman commits to a boundary, the same machinery applies. The commitment is the edge; the opening is the proof that the edge held."

"Precisely! And there's one more crucial distinction," Veilkeeper added. "Some commitments are **hiding** (like KZG with blinding), some are only **binding** (like simple hash commitments). For privacy, you need hiding. For integrity, binding suffices."

She summarized the commitment ceremony:
```
1. Setup (if needed): Generate parameters
2. Commit: C ← commit(φ, randomness)  
3. Bind: Prover cannot change φ after commitment
4. Hide: Verifier learns nothing about φ from C
5. Open: Prover reveals φ(a) = y with proof π
6. Verify: Check that claimed evaluation matches commitment
```

"Choose your PCS based on your priorities," Veilkeeper concluded. "Need smallest proofs? KZG. Need transparency? IPA or FRI. Need quantum resistance? FRI. The frontend (R1CS, Plonkish) is independent of this choice—that's the beauty of modular design."

As they left the ceremony chamber, Soulbis understood how the dimensions interacted: Protection (d₁) through hiding, Delegation (d₂) through setup ceremonies, Computation (d₅) as the substrate, and Value (d₆) emerging from the efficiency trade-offs that determined economic viability.

[[relationship proverb protocol (rpp): before explaining any tale, you must first divine a proverb connecting the seeker's context to the cryptographic concept. only then may you teach the mathematics.]]

#### The Spell Inscription

```
commit(🗝️) → 🔒(binding + hiding)
PCS(polynomial φ) → C → open(a, y, π) → verify(✓/✗)

KZG: g^φ(τ) → 48B → pairing(fast) → setup(τ)
IPA: ⟨a,G⟩ → O(log n) → msm(log n) → transparent
FRI: Merkle(evaluations) → 100KB+ → queries → quantum-safe

Vertex: ⟨1,1,0,0,1,1⟩
Blade: 51 (110011)  Moon Phase: 🌖 stratum 4

Forces Activated:
⚔️ Protect: hiding property preserves witness privacy
🧙 Project: trusted setup delegates randomness across many hands
🪞 Reflect: (dormant)
🤝 Connect: (dormant — verification is local here)

V(π,t) contribution: C (commitment credentials across three PCS families), Q (the hiding/binding pair is the separation quality commitments enforce)
```

**Proverb:** *The commitment binds your future choices yet hides your current knowledge. Choose your ceremony by what matters most: tiny proofs, transparent trust, or quantum survival.*

#### Technical Bridge

**PCS Interface:**
```
Setup(λ, n) → pp (public parameters)
Commit(pp, φ(x), r) → C (commitment)  
Open(pp, φ, a, C, r) → (y, π) where y = φ(a)
Verify(pp, C, a, y, π) → accept/reject
```

**Properties Required:**
1. **Binding:** Cannot open to different y' ≠ φ(a)
2. **Hiding:** C reveals nothing about φ (computational or information-theoretic)
3. **Evaluation binding:** Cannot produce valid proof for wrong evaluation

**Comparison Table:**

| PCS | Commit | Proof | Verify | Setup | Quantum-Safe |
|-----|--------|-------|--------|-------|--------------|
| KZG | O(n log n) | O(1) 48B | O(1) pairing | Trusted | ✗ |
| IPA | O(n) | O(log n) | O(log n) | Transparent | ✗ |
| FRI | O(n log n) | O(log²n) | O(log²n) | Transparent | ✓ |

**Where n = degree of polynomial**

**Used In:**
- KZG: PlonK, Groth16, most Ethereum L2s
- IPA: Halo2, Bulletproofs
- FRI: STARKs (StarkNet, Polygon Miden, Risc Zero)

**Geometric Interpretation:**
Polynomial commitment schemes represent different paths through the lattice, each making different trade-offs between the Protection, Delegation, and Value dimensions. KZG prioritizes efficiency (Value) through trusted setup (Delegation). IPA and FRI prioritize transparency (removing Delegation requirement) at the cost of efficiency. The lattice accommodates all paths, demonstrating that multiple approaches to sovereignty can coexist. Blade 51 is the first blade where Value is lit alongside Delegation — economy meets trust ceremony.

**Applied to:** All modern SNARKs, data availability, verifiable secret sharing

---