I understand that the end result of a Pedersen Hash (like this one) is a point in an Elliptic Curve.

In the example implementation mentioned above, the input $M$ is split into chunks of 200 bits (the last one possibly being smaller). For each chunk, disconnected/random points in the Elliptic Curve are generated and the end result is a linear combination of those points, with the coefficients depending on the bits present in each chunk.

My question is: suppose I wanted to hash something 200 bits long. I would therefore only need one chunk and one generated point. Of course, this point would be multiplied by a scalar generated by the bits in the chunk to give the resulting hash. Would this be a “secure” hash? Or should I split $M$ into smaller chunks so as to have at least a minimum amount of different points to combine linearly?


  • $\begingroup$ You are wrong. Because each of those chunks are added on the babyJubJub curve. $\endgroup$ Commented Jul 11, 2023 at 23:06
  • $\begingroup$ How can I be wrong if I'm asking a question? Lol $\endgroup$
    – popeye
    Commented Jul 27, 2023 at 14:43

1 Answer 1


A Pedersen hash only guarantees collision resistance. If you have a single base of prime order and an input smaller than that order, then the "hash" is one-to-one so it is perfectly collision-resistant.

However, using a hash in a non-compressing application is an almost-sure sign that your protocol relies on other/additional security properties to collision resistance. Depending on what those properties are, a Pedersen hash may not be appropriate at all for the application, regardless of how many bases are used.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.