Is it possible to obtain the value committed to by Pedersen commitment given the blinding key?

Question

I know that the purpose of the blinding key is to make it difficult to obtain the hidden value. More formally: the Pedersen commitment is comprised of the blinding key $\alpha$, two generators $H$ and $G$ and the value we wish to commit to $v$.

I am familiar with two versions of the Pedersen commitment, the "regular" version where the commitment is $P=G^\alpha \cdot H^v$, and the Elliptic curve version where $P = \alpha\cdot G + v\cdot H$. In both versions, assuming I obtained the blinding key $\alpha$, can I obtain $v$ ($H$ and $G$ are publicly known) in an efficient way?

For the regular commitment I can see that it is a hard problem (under the CDH assumption) so I assume there is no efficient way. However, for the version over elliptic curve, it seems that it is possible to obtain $v$ efficiently, but I am uncertain about it.

Answer 1

Recovering $v$ from $\alpha$, $G$, $H$ and $P=\alpha\cdot G + v\cdot H$ requires solving the discrete log problem to find $v$. Specifically, note that $v\cdot H = P - \alpha\cdot G$ so you need to find the discrete log of this value with base $H$. As such, if $v$ is small then you can find it.

It is crucial to understand that although it is hard to find $v$ in general, it does not mean that revealing $\alpha$ is OK and $v$ is still securely committed. This is because some part of $v$ may be revealed by $v\cdot H$. Thus, this is neither a secure commitment, nor possible to obtain $v$ efficiently.

On the note of working modulo $p$ or over Elliptic curves, this makes no different essentially.