So, the question is, a commitment scheme on elliptic curve is given.
Initialisation phase:
- There is an elliptic curve EC, generator point $G$ over $GF(p)$, which creates a group, and random prime number $e$.
- Choose an $x$.
- Calculate $M = x \cdot G$.
- Calculate $M' = e \cdot M$.
- Extract $xM$, where $xM$ is an $x$ coordinate of $M$.
- Calculate $H = xM \cdot G$.
EC, $G$, $e$ are public parameters, $x$ is a private parameter.
Commitment is defined as follows: $C = x \cdot G + r \cdot H$.
As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.
It is possible to calculate $C = x \cdot G + r \cdot H$ and $C = x' \cdot G + r' \cdot H'$. Therefore, it is possible to calculate $r' = (x + r \cdot xM - x') / x'M$.
However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose $H$ as another generator point.
Are there any other ways to make this commitment perfectly binding?