Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H which are group elements. I am not sure who generates it? Is trusted setup assumed?
1 Answer
G
is a universally agreed-upon base point. Almost everyone that uses ed25519, including Monero, uses the same G
.
H
is an agreed-upon base point within Monero's implementation of the Pedersen commitment scheme. It is chosen arbitrarily such that it is impossible to know the discrete log with respect to G
(i.e. there is some x
such that xG == H
, but x
will never be known).
The security of Pedersen commitments relies on x
being unknowable.
Bottom line: All Monero wallets and daemons use the same values of G
and H
.