<p>No, this is not possible right now without verifying just the hash.</p>
<p>Also, an attack vector that comes in mind is that someone will see the tx, validate it before it is included in the blockchain and make the block with the correct response first.</p>

CC BY-SA 4.0
2021-06-13T18:25:36.990Z
2021-06-13T18:25:36.990Z
Marek Mahut - StakeNuts
<p>Though it is far from finished and a bit overkill for the guessing game (see the comments on the question), have a look at <a href="https://www.essentialcardano.io/article/kachina-privacy-preserving-smart-contracts" rel="nofollow noreferrer">(1)</a>. For a more involved research paper, see <a href="https://iohk.io/en/research/library/papers/kachina-foundations-of-private-smart-contracts/" rel="nofollow noreferrer">(1)</a>.</p>

CC BY-SA 4.0
2022-08-09T15:39:59.163Z
2022-08-09T15:39:59.163Z
Fermat
<p><strong>Is there any way to make datum data only visible to a smart contract that owns the UTXO?</strong></p>
<p>For example, lets say I wanted to make a guessing game. In this game, person A selects a number and creates an output at the smart contract with a prize (some amount of ADA) and a number in the datum of the UTXO. A second player B can then try to guess the number. For each guess, the player has to pay a certain amount of ADA to the contract. If he is right, all the ADA in the contract is given to him. If he is wrong, the ADA he provided is added to the prize pool. In order for the contract to determine if the guess is correct, it should evaluate the number provided by player B to the number stored in the datum UTXO, provided by player A.</p>
<p>However, datum data is public. It can be retrieved by everyone which means player B can look at the datum of the UTXO at the contract, see what number it holds and guarantee a win. Is there a way (in the smart contract) to enshure the number at the UTXO can only be evaluated under the pre-determined conditions of the smart contract code?</p>
<p>For example, could player A encrypt the number using the public key of the smart contract address, where the smart contract could decrypt the data using its private key on evaluation? This isn't possible since a smart contract doesn't have a private key, therefore, is there another way to achieve this?</p>

CC BY-SA 4.0
2021-06-13T15:49:00.377Z
Perhaps you could store a hash of the number instead of the number directly, then in the script check that the hash of the guess matches?
Danny Tuppeny - CODER
CC BY-SA 4.0
2021-06-13T18:50:07.973Z
If its just a hash of a number, user B could check a lot of numbers and look for a corresponding hash. What could work is letting user A pick a nonce which is added to the number before hashing. After user B shows his guess user A could then provide the nonce to prove that the guess of user B was incorrect. This is the same as what is done in plutus pioneer lesson 7 but it adds extra transactions. Also, once player A reveals the nonce, the game has to stop since it again becomes possible to brute force a matching hash.
OhmRoger
CC BY-SA 4.0
2021-06-13T19:02:40.003Z
The game could continue if player A changes the hash to a new hash where the new hash is generated using the old hash and a new nonce. This enshures that the original number is still the same while preventing a brute force attack.
OhmRoger
CC BY-SA 4.0
2021-06-14T06:38:36.657Z
"If its just a hash of a number, user B could check a lot of numbers and look for a corresponding hash". Isn't this mostly true for the encryption too? The script could easily be run without needing to submit a real transaction to the blockchain, so it could be brute forced?
Danny Tuppeny - CODER
CC BY-SA 4.0
2021-06-14T14:58:48.010Z
That depends on the "encryption". Hashing a number using sha will result in the same hash every time, the hash only changes if the content that is hashed changes. This way, if player A only hashes the number, player B could hash all the numbers that are supported by the 64? bit representation of the number and search for a matching hash. When you talk about encryption you probably mean public-key encryption which takes a know public key and uses it to encrypt some data. The data can then only be decrypted with the matching private key.
OhmRoger
CC BY-SA 4.0
2021-06-14T19:05:22.350Z
Right, but if all the code is available to the guesser (which I believe it has to be because every node has to run it to validate the transaction), they could do the same thing (try every int) though the encryption route too?
Danny Tuppeny - CODER
<plutus><smart-contract><utxo>
Smart contract datum encryption
# Smart contract datum encryption

(Asked by: username_0 on 2021-06-13)

**Is there any way to make datum data only visible to a smart contract that owns the UTXO?**

For example, lets say I wanted to make a guessing game. In this game, person A selects a number and creates an output at the smart contract with a prize (some amount of ADA) and a number in the datum of the UTXO. A second player B can then try to guess the number. For each guess, the player has to pay a certain amount of ADA to the contract. If he is right, all the ADA in the contract is given to him. If he is wrong, the ADA he provided is added to the prize pool. In order for the contract to determine if the guess is correct, it should evaluate the number provided by player B to the number stored in the datum UTXO, provided by player A.

However, datum data is public. It can be retrieved by everyone which means player B can look at the datum of the UTXO at the contract, see what number it holds and guarantee a win. Is there a way (in the smart contract) to enshure the number at the UTXO can only be evaluated under the pre-determined conditions of the smart contract code?

For example, could player A encrypt the number using the public key of the smart contract address, where the smart contract could decrypt the data using its private key on evaluation? This isn't possible since a smart contract doesn't have a private key, therefore, is there another way to achieve this?

**Tags:** plutus, smart-contract, utxo
> **Comments:**
> **username_1**: Perhaps you could store a hash of the number instead of the number directly, then in the script check that the hash of the guess matches?  
> **username_0**: If its just a hash of a number, user B could check a lot of numbers and look for a corresponding hash. What could work is letting user A pick a nonce which is added to the number before hashing. After user B shows his guess user A could then provide the nonce to prove that the guess of user B was incorrect. This is the same as what is done in plutus pioneer lesson 7 but it adds extra transactions. Also, once player A reveals the nonce, the game has to stop since it again becomes possible to brute force a matching hash.  
> **username_0**: The game could continue if player A changes the hash to a new hash where the new hash is generated using the old hash and a new nonce. This enshures that the original number is still the same while preventing a brute force attack.  
> **username_1**: "If its just a hash of a number, user B could check a lot of numbers and look for a corresponding hash". Isn't this mostly true for the encryption too? The script could easily be run without needing to submit a real transaction to the blockchain, so it could be brute forced?  
> **username_0**: That depends on the "encryption". Hashing a number using sha will result in the same hash every time, the hash only changes if the content that is hashed changes. This way, if player A only hashes the number, player B could hash all the numbers that are supported by the 64? bit representation of the number and search for a matching hash. When you talk about encryption you probably mean public-key encryption which takes a know public key and uses it to encrypt some data. The data can then only be decrypted with the matching private key.  
> **username_1**: Right, but if all the code is available to the guesser (which I believe it has to be because every node has to run it to validate the transaction), they could do the same thing (try every int) though the encryption route too?  

---

## 2 answers

### Answer by username_2 on 2021-06-13. Score: 2 | Accepted answer

No, this is not possible right now without verifying just the hash.

Also, an attack vector that comes in mind is that someone will see the tx, validate it before it is included in the blockchain and make the block with the correct response first.


---

### Answer by username_3 on 2022-08-09. Score: 0

Though it is far from finished and a bit overkill for the guessing game (see the comments on the question), have a look at [(1)](https://www.essentialcardano.io/article/kachina-privacy-preserving-smart-contracts). For a more involved research paper, see [(1)](https://iohk.io/en/research/library/papers/kachina-foundations-of-private-smart-contracts/).


---

