# Explanation of how exactly the pederson commitments in monero work?

so lets say for the first commitment (after a mined transaction)

let `a = miner_reward`

this is a known number.

to generate the first commitment, one does;

``````input = x.G + a.H; output = x.G + a.H
``````

Then using diffie-hellman the sender lets the receiver know the values of both x an a. The problem is, if the receiver now wants to spend the outputted commitment, he must add a further layer of masking/encryption. Because if he doesn't and some malicious actor down the road receives a payment, all the bad actor has to do is reveal x, and everyone in the chain that used x as a blinding key, will have their amounts compromised.

So my question is, how exactly does the receiver add the further encryption to the commitment? Proofs of why its valid would be nice as well.

• Ok so it would look like this; `original = xG + aH`. `new = yG + aH`. Then to prove the value sums to zero you do `(xG + aH) - (yG + aH)`. which is the same as `xG-yG` or `(x-y)G`. and `x-y` is the private key used to generate a signature that proves the value of `a` was not changed. Is this correct? Nov 9 '18 at 12:47