Commit–reveal randomness, explained

Before a guess, the server selects a card and creates a fresh random nonce. It joins the card and nonce in an unambiguous byte sequence and computes a SHA-256 hash. The participant receives that digest before sending a guess.

After the guess is fixed, the server reveals the card and nonce. Recomputing the same digest shows that these values fit the earlier commitment. Changing a circle into a star, or inventing a different nonce, would almost certainly produce a different digest.

There are only five Zener symbols. If the server hashed the card alone, a participant could hash all five names and compare them with the commitment before guessing. The nonce expands the hidden space so dramatically that this dictionary attack is no longer practical.

The nonce must be new for every trial and revealed exactly. The encoding also belongs in the protocol: ‘star’ followed by ‘12’ must never be confused with another pair of values that happens to create the same text before hashing.

A matching reveal proves that the disclosed card was committed before the guess. It does not prove that the card was sampled uniformly. A dishonest server could commit in advance to a biased sequence and reveal it perfectly. Distribution tests and open code address that separate claim.

It also cannot prove what happened on a device that never received the commitment. The open record must therefore preserve the commitment, guess, reveal, trial order, and algorithm version together. Tamper-evidence is a chain; omitting one link turns a cryptographic display into decoration.