# Hash as encryption used by Monero

Monero uses a Pedersen commitment $$yG + bH$$ to obfuscate the value of a transaction, where $$b$$ is the value and $$y$$ is the blinding factor.

For the receiver to know both variables, it uses a Diffie-Hellman key exchange to share a secret $$rK$$, where $$r$$ is a randomness chosen by the sender and $$K$$ is a public key of the receiver. $$R = rG$$ is public and sent as part of the transaction. The sender computes the following (the $$amount$$ is also sent in the transaction and $$H$$ is a hash function):

$$y = H(“commitment mask”, H(rK))$$ $$amount = b xor H("amount", H(rK))$$

The receiver is able to compute $$y$$ and $$b$$ using $$R$$ and his private key $$k$$.

My questions are: can this be considered an encryption/decryption scheme and is it already known or is it original to Monero? If the latter, how can we prove its security?

Source: https://web.getmonero.org/library/Zero-to-Monero-2-0-0.pdf, page 45

• This looks like a spin on ECIES tailored to the needs of Monero using a commitment scheme as symmetric encryption. Using a commitment scheme instead of normal authenticated encryption is indeed highly unusual. Now the follow-up question would be whether the use of a commitment scheme (and its extra dlog assumption) would allow us to relax security assumptions in other places of the scheme / give (what?) strong security notion as a result. – SEJPM Feb 11 at 11:36
• So the scheme is at least as secure as ECIES? – Fiono Feb 11 at 12:37