# Pedersen commitments equivalence

Is there a zero-knowledge proof that proves that two Pedersen commitments commit the same value?

An EC Pedersen commitment is of the form $$C=(bG+vH)$$, where $$v$$ is the scalar value being committed to, $$b$$ is the scalar blinding factor, and $$G$$ and $$H$$ are well-known generator points on the curve. They must be chosen such that the discrete log of $$H$$ w.r.t. $$G$$ is unknowable.

Let there be two commitments, $$C_1$$ and $$C_2$$ to the same value $$v$$ but with different blinding factors $$b_1$$ and $$b_2$$.

To prove that $$C_1$$ is a commitment to the same value as $$C_2$$, provide a signature (such as a Schnorr signature) for the public key $$C_1-C_2$$ on the generator point $$G$$.

This works because if the values are the same, they cancel out and $$C_1-C_2=(b_1-b_2)G$$. This means a signature can be provided, using the private key $$b_1-b_2$$.

If the values did not cancel each other out, then the private key required to generate the signature would be $$b1-b2+v_1(G/H)-v_2(G/H)$$. It is impossible to know this private key, because the EC discrete log assumption is that $$G/H$$ is unknowable.

Therefore, being able to provide a signature on the generator point $$G$$ proves the values must be the same.

The technique I've described is used as part of cryptocurrencies that use Greg Maxwell's confidential transactions protocol.