So as i understand it (though im not sure if its the same w/ bulletproofs so please correct me if im wrong), a commitment is generated like this;

commitment = (blinding_secret . G) + (value . H)

where G and H are both different generators on the same curve. But why is it necessary to have the second generator, H, instead of just using G twice?

1 Answer 1


Normally C = xG + aH where a is the amount and x is the blinding factor.

The point of a Pedersen Commitment is to commit you to a certain value of a. If instead you had C = xG + aG, then this simplifies to C = (x+a)G. So you could claim any value of a later by claiming you'd used a different blinding factor. Using H, which has an unknown DL w.r.t. G, prevents you from doing this.

  • And this is how commitments are calculated in the current version of monero as well? Or is there some variation because of bulletproofs?
    – cookiekid
    Commented Nov 8, 2018 at 7:01
  • @cookiekid There has been no change to commitment construction
    – knaccc
    Commented Nov 8, 2018 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.