Pedersen Commitment

A Pedersen commitment is a cryptographic scheme that allows one to commit to a chosen value while keeping it hidden, with the ability to later reveal the value in a way that is provably binding to the original commitment. It is a type of homomorphic commitment, meaning commitments to different values can be combined (added) to produce a valid commitment to the sum of those values. This property is expressed as Commit(a) + Commit(b) = Commit(a + b), which is fundamental for protocols requiring privacy and verification, such as confidential transactions and zero-knowledge proofs.

The scheme operates over a cryptographic group, typically an elliptic curve. To commit to a secret value v, one computes C = v*G + r*H, where G is a standard generator, H is a second independent generator (whose discrete log relationship to G is unknown), and r is a randomly chosen blinding factor. The commitment C reveals nothing about v due to the randomness of r (the property of hiding), but it is impossible to later open C to a different value v' without knowing the discrete log of H relative to G (the property of binding). The blinding factor r must be revealed alongside v to verify the opening.

In blockchain contexts, Pedersen commitments are a core component of confidential transaction protocols, like those used in Monero and Mimblewimble. They allow the encryption of transaction amounts so that Commit(amount1) + Commit(amount2) = Commit(amount3) can be publicly verified without revealing the actual values, proving that no money was created or destroyed. This enables strong financial privacy while maintaining the integrity of the ledger's accounting, as the sum of inputs equals the sum of outputs plus fees.

The security of a Pedersen commitment relies on the Discrete Logarithm Problem (DLP) being hard in the chosen group. If one could find the relationship H = k*G, the binding property would be broken, as the committer could generate different pairs (v, r) that open to the same commitment C. Therefore, the parameter H must be generated in a publicly verifiable, nothing-up-my-sleeve manner to ensure trust in its independence from G. This setup is often achieved through a secure hash function or a public ceremony.

Beyond confidential transactions, Pedersen commitments serve as a building block for more complex cryptographic protocols. They are used in zero-knowledge range proofs (to prove a committed number lies within a specific interval without revealing it), verifiable secret sharing, and various multi-party computation (MPC) schemes. Their additive homomorphism makes them exceptionally useful for constructing proofs about aggregated data while preserving the privacy of individual data points within a blockchain's transparent environment.

A Pedersen commitment is a cryptographic commitment scheme that allows a prover to commit to a secret value v by publishing a commitment C, which is a point on an elliptic curve, without revealing v. The commitment is generated using a publicly agreed-upon generator point G and a second, independent blinding generator H. The prover selects a random blinding factor r and computes the commitment as C = v*G + r*H. The properties of elliptic curve cryptography ensure that C reveals nothing about v (hiding) and that the prover cannot later claim a different value v' was committed (binding).

The scheme's security relies on the Discrete Logarithm Problem (DLP) on the chosen elliptic curve. The hiding property is unconditionally secure if the points G and H are chosen such that their discrete logarithm relationship is unknown (i.e., no one knows a scalar x where H = x*G). This means even a computationally unbounded adversary cannot deduce v from C. The binding property is computationally secure, relying on the assumed hardness of the DLP; forging a commitment for a different value would require solving the discrete log.

To later open or verify the commitment, the prover reveals the original pair (v, r). Any verifier can then recompute v*G + r*H and check that it matches the published commitment C. This simple open-and-verify mechanism is fundamental to its utility. Pedersen commitments are additively homomorphic, meaning the commitment to the sum of two values equals the sum of their individual commitments: Commit(v1 + v2) = Commit(v1) + Commit(v2). This property is crucial for protocols requiring private computations on committed values, such as confidential transactions.

In blockchain applications like Monero and Mimblewimble, Pedersen commitments are used to encrypt transaction amounts. Instead of publishing plaintext values, outputs are represented as commitments C. The homomorphic property allows the network to verify that the sum of input commitments equals the sum of output commitments (plus a commitment to the fee), proving no new money was created, all while keeping the actual amounts hidden. The blinding factor r ensures that even identical amounts produce unique, unlinkable commitments, providing strong privacy.

While powerful, standard Pedersen commitments have limitations. They are not succinct for complex statements and lack a built-in zero-knowledge proof system for arbitrary predicates. This led to the development of more advanced vector commitments and polynomial commitments like KZG commitments, which build upon similar principles but enable efficient proofs about committed data. Nevertheless, the elegance and provable security of the original Pedersen construction make it a cornerstone of privacy-preserving cryptography.

The process begins when a prover selects a secret value they wish to commit to, such as a transaction amount v. To create the commitment, they also generate a secret random blinding factor r. Using a publicly agreed-upon elliptic curve, the prover computes the commitment C as C = v*G + r*H, where G and H are two independent, publicly known generator points. This single piece of data, C, is then published or sent to a verifier. Crucially, due to the properties of the elliptic curve and the randomness of r, the original value v is completely hidden; C reveals nothing about the committed amount.

The hiding property is visually akin to placing the secret value inside a locked box (C) and handing it over. Anyone can see the box but cannot discern its contents. Later, to open the commitment, the prover must reveal both the original secret value v and the blinding factor r to the verifier. The verifier then performs the same calculation: v*G + r*H. If the result matches the original commitment C, the commitment is successfully verified. This demonstrates the binding property: the prover cannot find a different pair of values (v', r') that produce the same commitment C without solving the discrete logarithm problem, which is computationally infeasible.

This mechanism is foundational for confidential transactions in blockchain protocols like Mimblewimble and Monero. In such systems, transaction amounts are hidden within Pedersen Commitments, preserving financial privacy while still allowing the network to verify that no money is created out of thin air. The verifier can check mathematical relationships between commitments—for example, that the sum of input commitments equals the sum of output commitments plus a commitment to the fee—without learning any actual amounts. This enables additive homomorphism, where commitments to v1 and v2 can be added to create a valid commitment to v1 + v2, a property essential for verifying balance correctness in zero-knowledge.