# Pedersen commitments, what happens if I choose $H$ such that $H = a\times G$?

For Pedersen commitments of the form $$C = x\times G + r\times H$$, what is the worst thing I can do if I already know $$H$$ such that $$H = a\times G$$ ?

For standard curves, there are specifications for what value of $$G$$ should be used. Is there any such specification for values of $$H$$ ? What is the worst an adversary can do when they choose $$H = a\times G$$ and the rest of the world assumes that no-one knows a relation between $$H$$ and $$G$$ ?

If the committer knows $$a$$, then it is no longer binding.
For any $$m$$ you commit, the commitment will be $$(m+a)G$$, so it is easy to find $$m'$$ and $$a'$$ such that $$m'+a'=m+a$$ to open the commitment.
Edit to add: If the receiver knows $$a$$, then it is still information theoratically hiding because the sender chooses $$r$$ which is uniformly random.
• Can you please completely answer the question, this clearly does not compromise my security of the $x$ ? Given access to multiple such commitments, can the adversary figure out $x$? – sanket1729 Oct 15 '18 at 1:07