Pedersen commitments: perfectly hiding and additive (1991)

Pedersen committed to a value v as C = g**v * h**r, with a random blinding factor r and a second generator h whose logarithm nobody knows. For any other value there is a blinding factor giving the same C, so the commitment hides v perfectly; opening it to a different value would reveal log_g(h). And commitments multiply to a commitment of the sum.

What to look for

Two commitments multiply into a commitment to the total, without anyone seeing the amounts. This homomorphism is how confidential transactions (Monero, Mimblewimble) let anyone check that inputs equal outputs.

The history behind this experiment: Breakthroughs in Cryptography.

Commit and add

import matplotlib.pyplot as plt

import blockchainkit as bk

G = bk.crypto.TEACHING_GROUP
g, h = bk.crypto.pedersen_generators(G)
inputs = [(40, 1111), (2, 2222)]  # (amount, blinding factor)
outputs = [(30, 1500), (12, 1833)]
c_in = [bk.crypto.pedersen_commit(v, r) for v, r in inputs]
c_out = [bk.crypto.pedersen_commit(v, r) for v, r in outputs]
balance_in = c_in[0] * c_in[1] % G.p
balance_out = c_out[0] * c_out[1] % G.p
assert balance_in == balance_out  # 40 + 2 == 30 + 12, blindings also balance.
print("Inputs and outputs balance without revealing any amount")

Inputs and outputs balance without revealing any amount

Perfect hiding in a group small enough to search

small = bk.crypto.DHGroup(1019, 509, 4)
target = bk.crypto.pedersen_commit(7, 100, small)
for value in (7, 8, 500):
    blinding = next(
        r for r in range(small.q) if bk.crypto.pedersen_commit(value, r, small) == target
    )
    print(f"the same commitment opens as value {value} with blinding {blinding}")

the same commitment opens as value 7 with blinding 100
the same commitment opens as value 8 with blinding 272
the same commitment opens as value 500 with blinding 402

Commitments look uniform whatever the value

from random import Random

rng = Random(1991)
zeros = [bk.crypto.pedersen_commit(0, rng.randrange(small.q), small) for _ in range(2000)]
hundreds = [bk.crypto.pedersen_commit(100, rng.randrange(small.q), small) for _ in range(2000)]
fig, ax = plt.subplots(figsize=(7, 3.5))
ax.hist([zeros, hundreds], bins=20, label=["commit(0, r)", "commit(100, r)"])
ax.set(xlabel="commitment value", ylabel="count", title="Random blinding hides the amount")
ax.legend()
fig.tight_layout()

Exercise

Suppose a dishonest committer knew x = log_g(h). Show how they could open C = g**v * h**r as any other value v’ by choosing r’. Why must h be derived by hashing rather than chosen by a participant?