Making commitment scheme on elliptic curves perfectly binding

Question

So, the question is, a commitment scheme on elliptic curve is given.

Initialisation phase:

1. There is an elliptic curve EC, generator point $G$ over $GF(p)$, which creates a group, and random prime number $e$.
2. Choose an $x$.
3. Calculate $M = x \cdot G$.
4. Calculate $M' = e \cdot M$.
5. Extract $xM$, where $xM$ is an $x$ coordinate of $M$.
6. Calculate $H = xM \cdot G$.

EC, $G$, $e$ are public parameters, $x$ is a private parameter.

Commitment is defined as follows: $C = x \cdot G + r \cdot H$.

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

It is possible to calculate $C = x \cdot G + r \cdot H$ and $C = x' \cdot G + r' \cdot H'$. Therefore, it is possible to calculate $r' = (x + r \cdot xM - x') / x'M$.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose $H$ as another generator point.

Are there any other ways to make this commitment perfectly binding?

Answer 1

If I'm not wrong: first got a Pedersen commitment (computationally binding & theoretically hiding), then "transform" it in an ElGamal commitment (theoretically binding & computationally hiding), nice primer in 1

Answer 2

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

Actually, it's not even computationally binding, as the committer knows the discrete log of $H$ (it's $xM$), and so he can trivially open the commitment any way he wants.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose H as another generator point.

Pedersen commitments cannot be made perfectly binding, because no matter how you choose $H$, it would be possible (although, in practice, computationally infeasible, or so we hope) to compute the discrete log, and so it'd be possible to open the commitment with different values.

For a commitment to be perfectly binding, then what must happen is that, for any possible commitment, there is only one possible secret that it can open to; Pedersen doesn't fulfill that.