# Making commitment scheme on elliptic curves perfectly binding

So, the question is, a commitment scheme on elliptic curve is given.

Initialisation phase:

1. There is an elliptic curve EC, generator point $$G$$ over $$GF(p)$$, which creates a group, and random prime number $$e$$.
2. Choose an $$x$$.
3. Calculate $$M = x \cdot G$$.
4. Calculate $$M' = e \cdot M$$.
5. Extract $$xM$$, where $$xM$$ is an $$x$$ coordinate of $$M$$.
6. Calculate $$H = xM \cdot G$$.

EC, $$G$$, $$e$$ are public parameters, $$x$$ is a private parameter.

Commitment is defined as follows: $$C = x \cdot G + r \cdot H$$.

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

It is possible to calculate $$C = x \cdot G + r \cdot H$$ and $$C = x' \cdot G + r' \cdot H'$$. Therefore, it is possible to calculate $$r' = (x + r \cdot xM - x') / x'M$$.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose $$H$$ as another generator point.

Are there any other ways to make this commitment perfectly binding?

If I'm not wrong: first got a Pedersen commitment (computationally binding & theoretically hiding), then "transform" it in an ElGamal commitment (theoretically binding & computationally hiding), nice primer in 1

• Nice! To summarize what's in the link, you generate the commitment as the two points $mG + rH, rG$ (where $m$ is the value you're committing to). That works... Sep 2, 2021 at 17:52

As far as I studied this commitment scheme, I see that this scheme is not perfectly binded because H depends on value of G.

Actually, it's not even computationally binding, as the committer knows the discrete log of $$H$$ (it's $$xM$$), and so he can trivially open the commitment any way he wants.

However, the only possible solution for making this commitment perfectly binding is to make a Pedersen commitment by deleting steps 4-6 and choose H as another generator point.

Pedersen commitments cannot be made perfectly binding, because no matter how you choose $$H$$, it would be possible (although, in practice, computationally infeasible, or so we hope) to compute the discrete log, and so it'd be possible to open the commitment with different values.

For a commitment to be perfectly binding, then what must happen is that, for any possible commitment, there is only one possible secret that it can open to; Pedersen doesn't fulfill that.