Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H which are group elements. I am not sure who generates it? Is trusted setup assumed?
Add a comment
|
1 Answer
G is a universally agreed-upon base point. Almost everyone that uses ed25519, including Monero, uses the same G.
H is an agreed-upon base point within Monero's implementation of the Pedersen commitment scheme. It is chosen arbitrarily such that it is impossible to know the discrete log with respect to G (i.e. there is some x such that xG == H, but x will never be known).
The security of Pedersen commitments relies on x being unknowable.
Bottom line: All Monero wallets and daemons use the same values of G and H.
