In Bulletproofs range proof, Pedersen commitments look like $C=aG+bH$

If I need to proof several values' range proof and keep G as constant, do I need to change H everytime?

I have found it doesn't change in Grin and dalek-cryptography.

  • $\begingroup$ The points $G$ and $H$ are usually public parameters so that the discrete logarithm from $G$ to $H$ is not known. This leads to them being the same for every commitment (at least usually). $\endgroup$ May 5, 2019 at 15:18

1 Answer 1


Pedersen commitments fulfil two basic properties:

  1. Perfectly hiding.

Since $b$ is uniformly random, $C=aG+bH$ can become any element of the group, independent from the randomness of $a$.

  1. Computationally binding.

If I don't know the discrete logarithm relation between $G$ and $H$, I cannot cheat by opening $C$ to a different $a,b$ pair.

Additionally, Bulletproofs relies on Pedersen commitments being additively homomorphic: for another commitment $C'=a'G+b'H$, we have that $C+C'$ is a commitment to $a+a',b+b'$. To see this: $C+C' = (a+a')G+(b+b')H$. For this to work, we need $H$ to be a fixed point.

So, to sum up: $H$ shouldn't change because we require additive homomorphism, and $H$ does not need to change because it already provides perfect hiding!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.