The usual Pedersen Commitment looks like such:

C = xG + aH

Where x and a are scalars.

However, we can also commit vectors, s.t.

C = xG + (a_1 * H_1 + a_2 * H_2)

Could anyone point out why we change the H values for each vector value (a_1 and a_2)? To my knowledge, having the same H for a_1 and a_2 would still be perfectly hiding.

a_1 means 'a subscript 1' denoting the first scalar value in the vector a.

I believe H_i is calculated s.t. H_i = Hash(G + i) * G

1 Answer 1


It is correct that using the same H each time would be perfectly hiding. However, the job of a Pedersen Commitment is not only to hide, but to commit.

If you used the same H each time, then all you would be committing to would be the sum of all components. You could later pretend that you had committed to a different number of components or to different component values as long as they still added up to the same amount.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.