Computational cryptography › Public-key encryption and key exchange › Classical number theory › Elliptic-curve discrete log
COMMITMENTPrimitive

Pedersen commitments

In plain words

A sealed envelope for a number: you can't change what's inside later, and nobody can peek.

The idea: Commit to a number v as v·G + r·H, using a fresh random r and two points G and H whose relationship nobody knows. The random r blinds v completely: every possible v fits the commitment with some r. But opening it as a different value would require knowing how H relates to G, a discrete log. And commitments add up: the sum of two commitments commits to the sum of the values, which lets a blockchain check that inputs equal outputs without seeing any amounts.

Why it matters: Used in private transactions and zero-knowledge proofs.

The details

On the map: binding only (hiding is unconditional)

A commitment is a sealed envelope: you fix a value now and reveal it later. Pedersen commits to v as g^v × h^r[1].

Hiding is unconditional: every value is equally consistent with the commitment. Binding relies on discrete log: opening to two different values would reveal the log of h. Commitments can be added together, which confidential transactions (Monero, Mimblewimble)[2, 3] and many zero-knowledge proofs use.

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Nothing on the map depends on it: it is an end point, something people use directly.

References

  1. Torben Pryds Pedersen. Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing. Advances in Cryptology — CRYPTO ’91, 1991. doi:10.1007/3-540-46766-1_9
  2. Ring Signature Confidential Transactions for Monero. IACR Cryptology ePrint Archive, Paper 2015/1098. eprint.iacr.org/2015/1098
  3. Benedikt Bunz, Jonathan Bootle, Dan Boneh et al. Bulletproofs: Short Proofs for Confidential Transactions and More. 2018 IEEE Symposium on Security and Privacy (SP). doi:10.1109/sp.2018.00020