# Pedersen commitments in bulletproofs

In Bulletproofs range proof, Pedersen commitments look like $$C=aG+bH$$

If I need to proof several values' range proof and keep G as constant, do I need to change H everytime?

I have found it doesn't change in Grin and dalek-cryptography.

• The points $G$ and $H$ are usually public parameters so that the discrete logarithm from $G$ to $H$ is not known. This leads to them being the same for every commitment (at least usually). May 5, 2019 at 15:18

Pedersen commitments fulfil two basic properties:

1. Perfectly hiding.

Since $$b$$ is uniformly random, $$C=aG+bH$$ can become any element of the group, independent from the randomness of $$a$$.

1. Computationally binding.

If I don't know the discrete logarithm relation between $$G$$ and $$H$$, I cannot cheat by opening $$C$$ to a different $$a,b$$ pair.

Additionally, Bulletproofs relies on Pedersen commitments being additively homomorphic: for another commitment $$C'=a'G+b'H$$, we have that $$C+C'$$ is a commitment to $$a+a',b+b'$$. To see this: $$C+C' = (a+a')G+(b+b')H$$. For this to work, we need $$H$$ to be a fixed point.

So, to sum up: $$H$$ shouldn't change because we require additive homomorphism, and $$H$$ does not need to change because it already provides perfect hiding!