So as i understand it (though im not sure if its the same w/ bulletproofs so please correct me if im wrong), a commitment is generated like this;

commitment = (blinding_secret . G) + (value . H)

where G and H are both different generators on the same curve. But why is it necessary to have the second generator, H, instead of just using G twice?

up vote 3 down vote accepted

Normally C = xG + aH where a is the amount and x is the blinding factor.

The point of a Pedersen Commitment is to commit you to a certain value of a. If instead you had C = xG + aG, then this simplifies to C = (x+a)G. So you could claim any value of a later by claiming you'd used a different blinding factor. Using H, which has an unknown DL w.r.t. G, prevents you from doing this.

  • And this is how commitments are calculated in the current version of monero as well? Or is there some variation because of bulletproofs? – cookiekid Nov 8 at 7:01
  • @cookiekid There has been no change to commitment construction – knaccc Nov 8 at 14:30

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.