2
$\begingroup$

For Pedersen commitments of the form $C = x\times G + r\times H$, what is the worst thing I can do if I already know $H$ such that $H = a\times G$ ?

For standard curves, there are specifications for what value of $G$ should be used. Is there any such specification for values of $H$ ? What is the worst an adversary can do when they choose $H = a\times G$ and the rest of the world assumes that no-one knows a relation between $H$ and $G$ ?

$\endgroup$
2
$\begingroup$

If the committer knows $a$, then it is no longer binding.

For any $m$ you commit, the commitment will be $(m+a)G$, so it is easy to find $m'$ and $a'$ such that $m'+a'=m+a$ to open the commitment.

Edit to add: If the receiver knows $a$, then it is still information theoratically hiding because the sender chooses $r$ which is uniformly random.

$\endgroup$
  • $\begingroup$ Can you please completely answer the question, this clearly does not compromise my security of the $x$ ? Given access to multiple such commitments, can the adversary figure out $x$? $\endgroup$ – sanket1729 Oct 15 '18 at 1:07
  • $\begingroup$ Edited the answer, see above. $\endgroup$ – Changyu Dong Oct 15 '18 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.