# Is it possible to obtain the value committed to by Pedersen commitment given the blinding key?

I know that the purpose of the blinding key is to make it difficult to obtain the hidden value. More formally: the Pedersen commitment is comprised of the blinding key $$\alpha$$, two generators $$H$$ and $$G$$ and the value we wish to commit to $$v$$.

I am familiar with two versions of the Pedersen commitment, the "regular" version where the commitment is $$P=G^\alpha \cdot H^v$$, and the Elliptic curve version where $$P = \alpha\cdot G + v\cdot H$$. In both versions, assuming I obtained the blinding key $$\alpha$$, can I obtain $$v$$ ($$H$$ and $$G$$ are publicly known) in an efficient way?

For the regular commitment I can see that it is a hard problem (under the CDH assumption) so I assume there is no efficient way. However, for the version over elliptic curve, it seems that it is possible to obtain $$v$$ efficiently, but I am uncertain about it.

• Mathematically speaking they are the same, they just use different underlying groups, but the security reduction is always relative to the group operation. That is, it "automatically" adapts to the discrete logarithm problem (DLP) over finite fields or the elliptic-curve DLP which is what the second uses. Feb 25, 2018 at 11:05

Recovering $v$ from $\alpha$, $G$, $H$ and $P=\alpha\cdot G + v\cdot H$ requires solving the discrete log problem to find $v$. Specifically, note that $v\cdot H = P - \alpha\cdot G$ so you need to find the discrete log of this value with base $H$. As such, if $v$ is small then you can find it.
It is crucial to understand that although it is hard to find $v$ in general, it does not mean that revealing $\alpha$ is OK and $v$ is still securely committed. This is because some part of $v$ may be revealed by $v\cdot H$. Thus, this is neither a secure commitment, nor possible to obtain $v$ efficiently.
On the note of working modulo $p$ or over Elliptic curves, this makes no different essentially.