Pedersen Commitment

A Pedersen Commitment is a cryptographic commitment scheme that allows a prover to commit to a secret value (e.g., a transaction amount) by publishing a commitment value, which hides the original data but can later be opened to verify its authenticity. It is perfectly hiding, meaning the commitment reveals zero information about the committed value, and computationally binding, meaning it is infeasible for the committer to later open the commitment to a different value. This is achieved using a mathematical construction based on discrete logarithms within a cryptographic group, such as an elliptic curve.

The core mechanism relies on two public generators, G and H, of a prime-order group where the discrete log relationship between them is unknown. To commit to a value v, the committer selects a random blinding factor r and computes the commitment C = v*G + r*H. The pair (v, r) is the opening, kept secret initially. The randomness r ensures the same value v produces a completely different, unpredictable commitment each time, providing the hiding property. The binding property stems from the difficulty of finding two different pairs (v, r) and (v', r') that hash to the same commitment C.

In blockchain systems, particularly those focused on privacy like Monero and Mimblewimble, Pedersen Commitments are fundamental. They are used to encrypt transaction amounts in Confidential Transactions, allowing network nodes to verify that the sum of inputs equals the sum of outputs (ensuring no new money is created) without knowing the actual amounts. This is done by exploiting the homomorphic property of the commitments: the sum of input commitments minus the sum of output commitments equals a commitment to zero, which can be publicly verified.

Beyond simple value hiding, Pedersen Commitments form the basis for more advanced zero-knowledge proof systems. Their additive homomorphism allows for the construction of range proofs (e.g., Bulletproofs) that demonstrate a committed value lies within a specific interval (e.g., is non-negative and doesn't overflow) without revealing it. This is critical for preventing overflow attacks in private payment systems. The scheme is named after its inventor, cryptographer Torben Pryds Pedersen, who introduced it in 1991.

When implementing Pedersen Commitments, careful parameter selection is crucial. The generators G and H must be chosen in a trusted setup where no one knows the discrete logarithm of H with respect to G (i.e., no one knows x such that H = x*G). If this secret were known, the binding property would be broken. Furthermore, the random blinding factor r must be a cryptographically secure random number; reusing it for different commitments to the same value compromises privacy, as the commitments would be identical.

A Pedersen commitment is a cryptographic scheme that allows a party to commit to a chosen value (or set of values) while keeping it hidden, with the ability to later reveal the committed value for verification. It is a binding and hiding commitment scheme, meaning the committer cannot change the value after the fact (binding), and the commitment itself reveals no information about the value (hiding). The scheme is additively homomorphic, allowing mathematical operations on commitments to be performed without revealing the underlying data, a property foundational to confidential transactions and zero-knowledge proofs.

The protocol works by leveraging a cryptographic group, typically an elliptic curve. To commit to a secret value v, the committer selects a random blinding factor r. The commitment C is computed as C = v*G + r*H, where G is a standard generator point and H is a second, independent generator point whose discrete logarithm relationship to G is unknown. The randomness r ensures the commitment is perfectly hiding—even for the same value v, different r produces a completely different, unpredictable commitment C. The committer then sends C to a verifier.

Later, to open or reveal the commitment, the committer discloses the original pair (v, r). The verifier recalculates v*G + r*H and checks if it matches the original commitment C. If it matches, the commitment is successfully opened, proving the committer knew v and r all along. The binding property relies on the discrete logarithm assumption; changing the committed value after the fact would require solving for a relationship between G and H, which is computationally infeasible.

The additive homomorphism is a critical feature: given two commitments C1 = v1*G + r1*H and C2 = v2*G + r2*H, their sum C3 = C1 + C2 is a valid commitment to the sum of the values (v1 + v2) with the sum of the blinding factors (r1 + r2). This allows systems to prove that committed values satisfy certain equations (e.g., that the sum of transaction inputs equals the sum of outputs, with no new money created) without revealing the individual amounts, as utilized in Confidential Transactions for Bitcoin-like blockchains.

In practice, Pedersen commitments are a core component in privacy-focused blockchain protocols like Mimblewimble and Bulletproofs. In Mimblewimble, they obscure transaction amounts and enable efficient blockchain pruning. Bulletproofs are short, efficient zero-knowledge proofs that can demonstrate a committed value lies within a certain range (e.g., is a positive number), which is essential for preventing overflow attacks in confidential transaction systems without requiring a trusted setup.

A Pedersen Commitment is a cryptographic commitment scheme that allows a party to commit to a chosen value while keeping it hidden, with the ability to later reveal the value in a provable manner. It is a binding and hiding commitment, constructed using a group of prime order and two independent generators. The core operation is C = v*G + r*H, where v is the secret value, r is a secret blinding factor, and G and H are the public generators. This structure ensures the commitment C reveals nothing about v (hiding) and that the committer cannot later claim they committed to a different value v' (binding) under standard cryptographic assumptions.

The scheme's security relies on the discrete logarithm problem and the assumed difficulty of finding a relationship between the two generators G and H. If an adversary could find a scalar x such that H = x*G, the commitment would no longer be binding. Therefore, H must be generated in a trusted setup or via a nothing-up-my-sleeve number to ensure its independence from G. This property of perfect hiding and computational binding makes it ideal for applications like confidential transactions, where amounts can be hidden while still allowing network validation.

A critical property is homomorphism. Given two commitments C1 = v1*G + r1*H and C2 = v2*G + r2*H, their sum C3 = C1 + C2 is a commitment to the sum of the values (v1 + v2) with the combined blinding factor (r1 + r2). This enables powerful cryptographic protocols: - Range proofs (e.g., Bulletproofs) can prove a committed value is within a range without revealing it. - In blockchain systems like Mimblewimble, it allows the verification that transaction inputs equal outputs (∑C_inputs - ∑C_outputs = 0*G + r*H) without revealing any amounts, ensuring confidentiality and correctness.